diff --git a/matter_server/CHANGELOG.md b/matter_server/CHANGELOG.md index 10e1bf69c..0d2a393aa 100644 --- a/matter_server/CHANGELOG.md +++ b/matter_server/CHANGELOG.md @@ -1,8 +1,18 @@ # Changelog -## 9.0.4 +## 9.1.0 - **⚠️ When upgrading from 8.x, please also consider the release notes for 9.0.0.** +- Update [Matter Server from 1.1.7 to 1.2.6](https://github.com/matter-js/matterjs-server/blob/main/CHANGELOG.md) + - Supports Matter 1.6.0 + - Synchronize Time to devices that support this + - Experimental Support for Battery Saving mode of ICD devices + - Many Optimizations and Fixes +- Add `time_sync` option (`auto`/`on`/`off`, default `auto`) to push the current time to Matter devices via the Matter Server's `--enable-time-sync` flag. `auto` enables time sync only when the host clock is NTP synchronized; `on` always enables it (with a warning if NTP is not synchronized); `off` disables it. +- Add `default_fabric_label` option to pin the fabric label via the Matter Server's `--default-fabric-label` flag. When set, changing the label via the WebSocket API is blocked. + +## 9.0.4 + - Update [Matter Server from 1.1.2 to 1.1.7](https://github.com/matter-js/matterjs-server/blob/main/CHANGELOG.md#117-2026-07-01) to address reported issues and optimize RAM and CPU usage (a lot) ## 9.0.3 diff --git a/matter_server/DOCS.md b/matter_server/DOCS.md index 4b9e93d69..b0a31b2fd 100644 --- a/matter_server/DOCS.md +++ b/matter_server/DOCS.md @@ -53,6 +53,8 @@ App configuration: | log_level | Logging level of the Matter Server component. | | beta | Install the latest `matter-server` from npm on startup instead of the bundled version. On failure a warning is logged and the bundled version is started. | | enable_test_net_dcl | Enable test-net DCL for PAA root certificates, OTA updates and other device information. | +| time_sync | Whether the Matter Server pushes the current time to Matter devices: `auto` (default; on only when the host clock is NTP synchronized), `on` (always; warns if NTP is not synchronized), or `off`. | +| default_fabric_label | Pin the fabric label (shown on Matter devices, max 32 characters) to this value. By default the Home Assistant home name is used. This is useful if the Matter Server is used from multiple Home Assistant instances, which otherwise each keep pushing their own home name as the label. When set, changing the label via the WebSocket API is blocked. | | ble_proxy | Expose the BLE proxy endpoint so the Home Assistant Matter integration can drive BLE commissioning through Home Assistant's bluetooth stack. Mutually exclusive with `bluetooth_adapter_id`. | | bluetooth_adapter_id | **Deprecated** — use `ble_proxy` instead. Set BlueZ Bluetooth Controller ID (for local commissioning). Still works for now. | | matter_server_args | Extra command-line arguments passed to the Matter Server at startup (advanced). | diff --git a/matter_server/build.yaml b/matter_server/build.yaml index 68f5f8fa7..1f9c0aca1 100644 --- a/matter_server/build.yaml +++ b/matter_server/build.yaml @@ -1,7 +1,7 @@ --- build_from: - aarch64: ghcr.io/matter-js/matterjs-server:1.1.7 - amd64: ghcr.io/matter-js/matterjs-server:1.1.7 + aarch64: ghcr.io/matter-js/matterjs-server:1.2.6 + amd64: ghcr.io/matter-js/matterjs-server:1.2.6 args: BASHIO_VERSION: 0.17.1 TEMPIO_VERSION: 2024.11.2 diff --git a/matter_server/config.yaml b/matter_server/config.yaml index 89f682717..340235798 100644 --- a/matter_server/config.yaml +++ b/matter_server/config.yaml @@ -1,5 +1,5 @@ --- -version: 9.0.4 +version: 9.1.0 breaking_versions: [9.0.0] slug: matter_server name: Matter Server @@ -28,10 +28,13 @@ options: log_level: info beta: false enable_test_net_dcl: false + time_sync: auto schema: log_level: list(debug|info|notice|warn|error|fatal|verbose|warning|critical) beta: bool? enable_test_net_dcl: bool? + time_sync: list(auto|on|off) + default_fabric_label: match(^.{1,32}$)? ble_proxy: bool? bluetooth_adapter_id: int? matter_server_args: diff --git a/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run b/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run index 7d5cdd8fa..7c764171b 100755 --- a/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run +++ b/matter_server/rootfs/etc/s6-overlay/s6-rc.d/matter-server/run @@ -131,6 +131,44 @@ if bashio::config.true "enable_test_net_dcl"; then extra_args+=('--ota-provider-dir' "/config/updates") fi +# Resolve whether to enable time sync for nodes with the TimeSynchronization +# cluster. The 'time_sync' option has three modes: +# - on: always enable (warn if the host clock is not NTP synchronized) +# - off: always leave disabled +# - auto: enable only when the host clock is NTP synchronized (default) +time_sync_mode="$(bashio::string.lower "$(bashio::config 'time_sync' 'auto')")" +ntp_synchronized="$(bashio::api.supervisor 'GET' '/host/info' '' '.dt_synchronized')" +time_sync_enabled=false + +case "${time_sync_mode}" in + on) + time_sync_enabled=true + if [ "${ntp_synchronized}" != "true" ]; then + bashio::log.warning \ + "Time sync is enabled but host NTP is not synchronized — time pushed to Matter devices may be inaccurate" + fi + ;; + off) + bashio::log.info "Time sync is disabled ('time_sync' set to off)." + ;; + *) + if [ "${ntp_synchronized}" = "true" ]; then + time_sync_enabled=true + bashio::log.info "Time sync 'auto': host NTP is synchronized, enabling time sync." + else + bashio::log.info "Time sync 'auto': host NTP is not synchronized, leaving time sync disabled." + fi + ;; +esac + +if [ "${time_sync_enabled}" = "true" ]; then + extra_args+=('--enable-time-sync') +fi + +if bashio::config.has_value "default_fabric_label"; then + extra_args+=('--default-fabric-label' "$(bashio::config 'default_fabric_label')") +fi + primary_interface="$(bashio::api.supervisor 'GET' '/network/info' '' 'first(.interfaces[] | select (.primary == true)) .interface')" # Try fallback method (e.g. in case NetworkManager is not available) @@ -168,7 +206,6 @@ bashio::log.info "Using '${primary_interface}' as primary network interface." # shellcheck disable=SC2164 cd /root -# shellcheck disable=SC2206 matter_server_args+=( '--storage-path' "/data" '--port' "${server_port}" @@ -176,7 +213,7 @@ matter_server_args+=( '--primary-interface' "${primary_interface}" '--fabricid' 2 '--vendorid' 4939 - ${extra_args[@]} + "${extra_args[@]}" ) exec node --enable-source-maps "${server_entry}" "${matter_server_args[@]}" diff --git a/matter_server/translations/en.yaml b/matter_server/translations/en.yaml index 8afc2f87d..24e3d93da 100644 --- a/matter_server/translations/en.yaml +++ b/matter_server/translations/en.yaml @@ -15,6 +15,23 @@ configuration: Enable PAA root certificates, software updates and other device information from test-net DCL. This is meant for development and testing purposes. + time_sync: + name: Time synchronization + description: >- + Control whether the Matter Server pushes the current time to Matter + devices. "auto" (default) enables it only when the host clock is NTP + synchronized; "on" always enables it (a warning is logged if the host + clock is not NTP synchronized, since the time sent to devices is only as + accurate as the host clock); "off" disables it. + default_fabric_label: + name: Default Fabric Label + description: >- + Pin the fabric label (shown on Matter devices for this controller, max + 32 characters) to this value. By default the Home Assistant home name is + used. This is useful if the Matter Server is used from multiple Home + Assistant instances, which otherwise each keep pushing their own home + name as the label. When set, changing the label via the WebSocket API is + blocked. bluetooth_adapter_id: name: Bluetooth Adapter ID (deprecated) description: >- diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md index dadaaf19d..0cf6c091d 100644 --- a/samba/CHANGELOG.md +++ b/samba/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog +## 12.8.0 +- Add configuration option to disable NetBIOS. When disabled, the nmbd service is not started and only port 445 is allowed (port 139 is blocked.) + ## 12.7.1 - Enabled kernel oplocks in smb.conf to ensure changes made to files on disk are available immediately via SMBD. This covers all shares except backup, and media as the contents shouldn't be changed by the server once they're written in those shares. diff --git a/samba/DOCS.md b/samba/DOCS.md index 90c95ab85..7947d44e2 100644 --- a/samba/DOCS.md +++ b/samba/DOCS.md @@ -35,10 +35,9 @@ Directory | Description App configuration: ```yaml -workgroup: WORKGROUP -local_master: true username: homeassistant password: YOUR_PASSWORD +workgroup: WORKGROUP enabled_shares: - addons - addon_configs @@ -47,6 +46,17 @@ enabled_shares: - media - share - ssl +compatibility_mode: false +apple_compatibility_mode: true +netbios: true +local_master: true +server_signing: "default" +veto_files: + - ._* + - .DS_Store + - Thumbs.db + - icon? + - .Trashes allow_hosts: - 10.0.0.0/8 - 172.16.0.0/12 @@ -54,21 +64,8 @@ allow_hosts: - 169.254.0.0/16 - fe80::/10 - fc00::/7 -veto_files: - - "._*" - - ".DS_Store" - - Thumbs.db -compatibility_mode: false ``` -### Option: `workgroup` (required) - -Change WORKGROUP to reflect your network needs. - -### Option: `local_master` (required) - -Enable to try and become a local master browser on a subnet. - ### Option: `username` (required) The username you would like to use to authenticate with the Samba server. @@ -77,6 +74,10 @@ The username you would like to use to authenticate with the Samba server. The password that goes with the username configured for authentication. +### Option: `workgroup` (required) + +Change WORKGROUP to reflect your network needs. + ### Option: `enabled_shares` (required) List of Samba shares that will be accessible. Any shares removed or commented out of the list will not be accessible. @@ -107,6 +108,19 @@ This can cause issues with file systems that do not support xattr such as exFAT. Defaults to `true`. +### Option: `netbios` + +NetBIOS is a legacy network protocol for accessing SMB/CIFS shares. Enable for legacy clients older than Windows Vista (Windows 95/98/ME, Windows NT, +Windows 2000, Windows XP and LanManager), or OS X 10.9 (Mavericks). This setting is enabled by default for compatibility; disable it on modern installations. + +Defaults to `true`. + +### Option: `local_master` + +When NetBIOS is enabled, try and become a local master browser on a subnet. + +Defaults to `true`. + ### Option: `server_signing` Configure the SMB server signing requirement. This option can improve security by requiring message signing, which helps prevent man-in-the-middle attacks. diff --git a/samba/Dockerfile b/samba/Dockerfile index 63b54d91d..c7cd5390d 100644 --- a/samba/Dockerfile +++ b/samba/Dockerfile @@ -19,3 +19,6 @@ COPY rootfs / HEALTHCHECK --start-period=3s \ CMD smbclient -L '\\localhost' -U '%' -m SMB3 + +ENV \ + S6_STAGE2_HOOK=/etc/s6-overlay/scripts/enable-check.sh diff --git a/samba/config.yaml b/samba/config.yaml index 00bdbc2aa..e716065da 100644 --- a/samba/config.yaml +++ b/samba/config.yaml @@ -1,5 +1,5 @@ --- -version: 12.7.1 +version: 12.8.0 slug: samba name: Samba share description: Expose Home Assistant folders with SMB/CIFS @@ -23,7 +23,6 @@ options: username: homeassistant password: null workgroup: WORKGROUP - local_master: true enabled_shares: - addons - addon_configs @@ -34,6 +33,8 @@ options: - ssl compatibility_mode: false apple_compatibility_mode: true + netbios: true + local_master: true server_signing: "default" veto_files: - ._* @@ -52,11 +53,12 @@ schema: username: str password: password workgroup: str - local_master: bool enabled_shares: - "match(^(?i:(addons|addon_configs|backup|config|media|share|ssl))$)" compatibility_mode: bool apple_compatibility_mode: bool + netbios: bool + local_master: bool server_signing: list(default|auto|mandatory|disabled) veto_files: - str diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh new file mode 100755 index 000000000..4643c916e --- /dev/null +++ b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh @@ -0,0 +1,12 @@ +#!/command/with-contenv bashio +# shellcheck shell=bash +# ============================================================================== +# Enable/disable nmbd service per config +# ============================================================================== +if bashio::config.true 'netbios'; then + touch /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd + bashio::log.info "Service nmbd enabled" +else + rm -f /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd + bashio::log.info "Service nmbd disabled" +fi diff --git a/samba/rootfs/usr/share/tempio/smb.gtpl b/samba/rootfs/usr/share/tempio/smb.gtpl index 2a321b5a7..df72fcca1 100644 --- a/samba/rootfs/usr/share/tempio/smb.gtpl +++ b/samba/rootfs/usr/share/tempio/smb.gtpl @@ -32,6 +32,10 @@ vfs objects = catia fruit streams_xattr {{ end }} + {{ if not .netbios }} + smb ports = 445 + {{ end }} + server signing = {{ .server_signing }} kernel oplocks = yes diff --git a/samba/translations/en.yaml b/samba/translations/en.yaml index 7fee4e38d..43ba9a80d 100644 --- a/samba/translations/en.yaml +++ b/samba/translations/en.yaml @@ -11,9 +11,6 @@ configuration: workgroup: name: Workgroup description: Change WORKGROUP to reflect your network needs. - local_master: - name: Local master - description: Enable to try and become a local master browser on a subnet. enabled_shares: name: >- Enabled Shares - allowed values are: @@ -33,6 +30,17 @@ configuration: Enable Samba configurations to improve interoperability with Apple devices. May cause issues with file systems that do not support xattr such as exFAT. + netbios: + name: Enable NetBIOS over IP + description: >- + Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows + NT, Windows 2000, Windows XP and LanManager clients). Disable to improve + security and performance if you do not have legacy SMB clients. + local_master: + name: Local master + description: >- + When NetBIOS is enabled, try and become a local master browser on a + subnet. server_signing: name: Server signing description: >-