Access to pimatic via internet

---

hi guys,
How can i get access from the internet to my pimatic frontend at home?
And is it possible to set the permissions for this usecase to read only?

Next question: is it possible the have different frontend layouts (favourites) per userlogin in pimatic?

Thanks.
dk00000

It’s a router setting.
You have to map your Internet-IP address of your router (Port 80) to the internal IP of your Raspberry running pimatic.

DerIng

Okay.
But is it save? Then there is just the password protection of pimatic. I’m not sure if its save enough. Because everybody can try to login.

@dk00000 just a few thing which come to my mind here …

• Make sure, external access is possible via https, only. See http://pimatic.org/guide/getting-started/remote-ssl/
• Choose secure passwords!
• To have a read-only user account you need to add an new access role next to admin role - see example “resident” below.

roles:
      description: "Array of user roles"
      type: "array"
      default: [
        {
          name: "admin"
          permissions:
            pages: "write"
            rules: "write"
            variables: "write"
            messages: "write"
            events: "write"
            devices: "write"
            groups: "write"
            plugins: "write"
            updates: "write"
            config: "write"
            controlDevices: true
            restart: true
        },
        {
          name: "resident"
          permissions:
            pages: "read"
            rules: "read"
            variables: "read"
            messages: "read"
            events: "read"
            devices: "none"
            groups: "none"
            plugins: "none"
            updates: "none"
            config: "none"
            controlDevices: true
            restart: false
        }
      ]

"users": [
...
    {
      "username": "externalUser",
      "password": "secureAndSecret",
      "role": "resident"
    }
  ]

But keep in mind that the access to an https site needs a certificate.

This is often not for free - except you generate your own one.

But self generated certificates will not be accepted by
e.g. Android based smartphones … (And that makes sense of course!)

So afraid that disabling http will not help much.

Anyone here who can shed a bit of light to that issue?

DerIng

@DerIng said:

Anyone here who can shed a bit of light to that issue?

Well, you can create your own server certificate for free as described on (http://pimatic.org/guide/getting-started/remote-ssl). However, as this certificate has not been signed by trusted CA you have no trust in the identity and your web browser will complain, but it is still possible to open the web page. In my opinion it is still better to use an untrusted certificate than using plain http over the Internet, as this way the messages between client and server will be encrypted (including your pimatic credentials which can be sniffed easily otherwise).

EDIT: Generally, trustworthy certificates do not come for free. There are some site like startssl.com offering free server certificates, but the assurance given is low. For higher assurance you need to pay.

Another solution would be to use a VPN Tunnel into your Network.
Maybe your Router has a build in VPN function, just like the AVM Fritzboxes have. Or you setup an OpenVPN Server on the rPi which is running Pimatic.

So the complete traffic into your Homenetwork is secured and you dont have to bother about selfsigned certs etc.