openthread-border-router: init at unstable-2024-10-18 #332296

mrene · 2024-08-04T17:03:51Z

Description of changes

This adds OpenThread's open source border router component along with a NixOS service.

Thread is a mesh networking technology based on 6LoWPAN (ipv6-based) and 802.15.4. The border router component bridges the mesh network to an ipv6 network on a local interface. If no ipv6 connectivity exists, it'll advertise a new prefix for the local network so communication is possible.

Once setup, it can be used to bridge a Thread network with the local network to expose IoT devices to other systems like Home Assistant, Apple Home, etc..

I've been using this implementation along with Home Assistant and some Nanoleaf light bulbs using both Matter and their proprietary "ltpdu" protocol for about a week now. It's pretty stable.

For the SkyConnect specifically, some options have to be used (see example). There doesn't seem to be a lot of hardware-specific options in nixpkgs so I chose not to include an option for this. Do let me know if there is an appropriate pattern to use here.

 services.openthread-border-router = {
   enable = true;
   radio =  {
     device = "/dev/serial/by-id/.....";
     baudRate = 460800;
     flowControl = true;
   };
 };

Things done

Add a 👍 reaction to pull requests you find important.

Pandapip1

Move the changelog addition to its own commit

mrene · 2024-10-20T14:51:38Z

I pushed a few changes:

Bumped the package to its latest commit
Added the packaged otbr-firewall script (with patches) in order to setup ip6tables rules referencing the otbr ipset
Added the included otbr-web service which provides a web interface
Cleaned up some of the cmake options which were already set by default
Split the changelog entry in its own commit
Rebased over master

pkgs/by-name/op/openthread-border-router/package.nix

nixos/modules/services/home-automation/openthread-border-router.nix

SuperSandro2000

LGTM

nixos/modules/services/home-automation/openthread-border-router.nix

mrene · 2024-10-24T03:29:43Z

Pushed:

Applied suggestions
Convert log level to an enum

mrene · 2024-10-24T03:31:40Z

Rebased over master to resolve conflicts in changelog.

Pandapip1

Diff LGTM; not tested

nixos-discourse · 2024-10-26T19:16:51Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-already-reviewed/2617/2060

milas

I have been running this on arm64 / NixOS 24.11 for the past month:

  services.openthread-border-router = {
    enable = true;
    backboneInterface = "end1";
    radio = {
      device = "/dev/serial/by-id/<your-device-id-here>";
      baudRate = 460800;
      flowControl = true;
    };
  };

It's been working great and stable.

This can be used to use compatible Thread radios (such as HomeAssistant's SkyConnect) in order to create a thread border router.

mrene · 2024-12-26T15:28:39Z

Thanks for testing!

Rebased over master and moved the changelog entry to rl-2505.

Pandapip1

How many of those patches have been upstreamed? The "don't install systemd units" patch can be easily modified to look at a variable:

if (SYSTEMD_FOUND AND (NOT DEFINED INSTALL_SYSTEMD_UNIT OR INSTALL_SYSTEMD_UNIT))
    pkg_get_variable(OTBR_SYSTEMD_UNIT_DIR systemd systemdsystemunitdir)
endif()

and then lib.cmakeBool "INSTALL_SYSTEMD_UNIT" false could be added to cmakeFlags

The static libs patch can instead be changed to:

if (NOT DEFINED Boost_USE_STATIC_LIBS)
    set(Boost_USE_STATIC_LIBS ON)
endif()

and then lib.cmakeBool "Boost_USE_STATIC_LIBS" stdenv.targetPlatform.isStatic could be added to cmakeFlags.

I'm not sure if the firewall script or the home assistant patch could be upstreamed, but any progress in that direction would be useful.

milas · 2024-12-27T15:41:53Z

I opened two upstream PRs with your CMake suggestions:

The firewall patch is slightly less straightforward as you noted, I need to dig into that a bit more to understand it from the OTBR side before I open an issue upstream, but it seems tractable as well.

The two Home Assistant-derived patches are a bit murkier.

openthread_border_router: Fix TREL and enable channel manager home-assistant/addons#3396
- Desire to add channel monitor to help users find least busy channel
- This build option means OTBR starts the monitor by default, HASS patch removes that auto-start so that it can be toggled manually
- Desire to not have it always running is from concern over potential interference
- Some suggestions
  - Leave as-is -> might consider bringing the patch into nixos/nixpgs, as it's trivial/one-liner
  - Disable channel monitor in NixOS builds for now -> OPENTHREAD_CONFIG_CHANNEL_MONITOR_ENABLE
  - Open upstream issue re: behavior - adding OPENTHREAD_CONFIG_CHANNEL_MONITOR_AUTOSTART or similar would be straightforward
openthread_border_router: enhance REST API to allow dataset reset home-assistant/addons#3083
- Patch/changeset is ~1.5yo
- First issue: uninitialized data -> upstreamed @ [rest] initialize dataset openthread/ot-br-posix#1892
- Second issue: delete/reset fabric
  - Original upstream attempt @ [rest] support deleting the dataset openthread/ot-br-posix#1893
    - This is what we're carrying as a patch right now - "delete dataset"
  - Accepted upstream PR @ [rest] support erasing all persistent info openthread/ot-br-posix#1908
    - Revised based on upstream feedback from original approach - "Delete node"

Given that, my suggestion would be to drop the Home Assistant addon patch references entirely:

See above: channel monitor patch is trivial and could be "inlined" to this repo (or avoided)
Dataset reset is custom to Home-Assistant and will never be upstreamed, so I don't think should be in nixpkgs

milas

I pulled the latest changes and rebuilt my config on arm64 without any issues.

While reviewing the diff, I realized I'd made a couple local changes around network security that might be worth incorporating.

milas · 2024-12-27T16:39:22Z

nixos/modules/services/home-automation/openthread-border-router.nix

+    rest = {
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "::";


It looks like this should default to 127.0.0.1. (Specifically, a localhost IP, and it appears that this is the convention throughout NixOS/nixpgs.)

The REST API works fine on IPv4 even though Matter comms themselves use IPv6.

(Users can still pass ::1 if they want to listen on IPv6 localhost instead or :: as currently to listen on all.)

milas · 2024-12-27T16:39:52Z

nixos/modules/services/home-automation/openthread-border-router.nix

+      enable = lib.mkEnableOption "the web interface";
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "::";


Similarly, I think the web interface should default to a local IP, i.e. 127.0.0.1.

milas · 2024-12-27T16:44:48Z

nixos/modules/services/home-automation/openthread-border-router.nix

+{
+  meta.maintainers = with lib.maintainers; [ mrene ];
+
+  options.services.openthread-border-router = {


EDIT: Hmm...it looks like the port number for the listening service is dynamic. I was confused and thought 49154 was hardcoded somewhere (note: there ARE other hardcoded ports in OpenThread code 🙈) but I think now it's simply from the "Dynamic and/or Private Ports (49152-65535)" range and shows up a lot in the OpenThread docs by coincidence.

Frustratingly, from what I can tell, it's not clear if this is customizable after compile-time, which makes this tricky.

Original comment:

I think we also need an openFirewall option:

networking.firewall.allowedUDPPorts = [ 49154 ];

I don't think it makes sense to have firewall options for REST/web.

In a VM/lab environment, the admin should add allowedTCPPorts for web.listenPort / rest.listenPort themselves.

Opened a discussion about listener ports upstream: https://github.com/orgs/openthread/discussions/11093

Pandapip1 · 2024-12-28T17:58:54Z

pkgs/by-name/op/openthread-border-router/package.nix

+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ mrene ];
+    mainProgram = "ot-ctl";
+    platforms = lib.platforms.linux;


Suggested change

platforms = lib.platforms.linux;

platforms = lib.platforms.unix;

If upstream claims that it supports POSIX, we should let it run on all POSIX systems, not just linux.

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Aug 4, 2024

mrene force-pushed the openthread-border-router branch 8 times, most recently from f771469 to bc2168f Compare August 4, 2024 18:52

ofborg bot added 8.has: package (new) This PR adds a new package 11.by: package-maintainer This PR was created by the maintainer of the package it changes 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 1-10 labels Aug 4, 2024

mrene force-pushed the openthread-border-router branch from bc2168f to a83e1b9 Compare August 5, 2024 00:41

github-actions bot added 8.has: documentation This PR adds or changes documentation 8.has: changelog labels Aug 5, 2024

mrene marked this pull request as ready for review August 5, 2024 00:42

h7x4 added the 8.has: module (new) This PR adds a module in `nixos/` label Aug 5, 2024

Pandapip1 suggested changes Aug 29, 2024

View reviewed changes

wegank added the 2.status: merge conflict This PR has merge conflicts with the target branch label Sep 10, 2024

mrene force-pushed the openthread-border-router branch from a83e1b9 to 0d941cf Compare October 20, 2024 14:47

mrene changed the title ~~openthread-border-router: init at unstable-2024-07-26~~ openthread-border-router: init at unstable-2024-10-18 Oct 20, 2024

mrene force-pushed the openthread-border-router branch from 0d941cf to a9d1c74 Compare October 20, 2024 14:49

ofborg bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Oct 20, 2024

Pandapip1 reviewed Oct 20, 2024

View reviewed changes

pkgs/by-name/op/openthread-border-router/package.nix Outdated Show resolved Hide resolved

mrene force-pushed the openthread-border-router branch from a9d1c74 to 269e1ea Compare October 20, 2024 21:59

SuperSandro2000 reviewed Oct 21, 2024

View reviewed changes

mrene force-pushed the openthread-border-router branch from 269e1ea to 2f5ba3d Compare October 21, 2024 03:58

mrene force-pushed the openthread-border-router branch from 2f5ba3d to 31c3205 Compare October 21, 2024 04:00

mrene requested a review from SuperSandro2000 October 21, 2024 04:03

SuperSandro2000 approved these changes Oct 23, 2024

View reviewed changes

Pandapip1 suggested changes Oct 23, 2024

View reviewed changes

Pandapip1 requested a review from SuperSandro2000 October 23, 2024 16:25

mrene force-pushed the openthread-border-router branch from 31c3205 to 02f29a5 Compare October 24, 2024 03:29

mrene force-pushed the openthread-border-router branch from 02f29a5 to cf8dcf1 Compare October 24, 2024 03:31

Pandapip1 approved these changes Oct 24, 2024

View reviewed changes

wegank added the 12.approvals: 2 This PR was reviewed and approved by two reputable people label Oct 29, 2024

wegank added the 2.status: merge conflict This PR has merge conflicts with the target branch label Nov 9, 2024

milas approved these changes Dec 25, 2024

View reviewed changes

wegank added 12.approvals: 3+ This PR was reviewed and approved by three or more reputable people and removed 12.approvals: 2 This PR was reviewed and approved by two reputable people labels Dec 26, 2024

mrene added 3 commits December 26, 2024 10:21

openthread-border-router: init at unstable-2024-07-26

47fb760

rl-2505: mention openthread-border-router

027ba7b

openthread-border-router: add nixos module

faa9a55

This can be used to use compatible Thread radios (such as HomeAssistant's SkyConnect) in order to create a thread border router.

mrene force-pushed the openthread-border-router branch from cf8dcf1 to faa9a55 Compare December 26, 2024 15:27

Pandapip1 reviewed Dec 26, 2024

View reviewed changes

ofborg bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Dec 26, 2024

This was referenced Dec 27, 2024

[build] allow disabling systemd service unit install openthread/ot-br-posix#2652

Open

[build] allow using shared boost libraries openthread/ot-br-posix#2653

Open

milas reviewed Dec 27, 2024

View reviewed changes

Pandapip1 reviewed Dec 28, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

openthread-border-router: init at unstable-2024-10-18 #332296

openthread-border-router: init at unstable-2024-10-18 #332296

mrene commented Aug 4, 2024 •

edited

Loading

Pandapip1 left a comment

mrene commented Oct 20, 2024 •

edited

Loading

SuperSandro2000 left a comment

mrene commented Oct 24, 2024

mrene commented Oct 24, 2024

Pandapip1 left a comment

nixos-discourse commented Oct 26, 2024

milas left a comment

mrene commented Dec 26, 2024

Pandapip1 left a comment •

edited

Loading

milas commented Dec 27, 2024

milas left a comment

milas Dec 27, 2024

milas Dec 27, 2024

milas Dec 27, 2024 •

edited

Loading

milas Dec 27, 2024

Pandapip1 Dec 28, 2024

	platforms = lib.platforms.linux;
	platforms = lib.platforms.unix;

openthread-border-router: init at unstable-2024-10-18 #332296

Are you sure you want to change the base?

openthread-border-router: init at unstable-2024-10-18 #332296

Conversation

mrene commented Aug 4, 2024 • edited Loading

Description of changes

Things done

Pandapip1 left a comment

Choose a reason for hiding this comment

mrene commented Oct 20, 2024 • edited Loading

SuperSandro2000 left a comment

Choose a reason for hiding this comment

mrene commented Oct 24, 2024

mrene commented Oct 24, 2024

Pandapip1 left a comment

Choose a reason for hiding this comment

nixos-discourse commented Oct 26, 2024

milas left a comment

Choose a reason for hiding this comment

mrene commented Dec 26, 2024

Pandapip1 left a comment • edited Loading

Choose a reason for hiding this comment

milas commented Dec 27, 2024

milas left a comment

Choose a reason for hiding this comment

milas Dec 27, 2024

Choose a reason for hiding this comment

milas Dec 27, 2024

Choose a reason for hiding this comment

milas Dec 27, 2024 • edited Loading

Choose a reason for hiding this comment

milas Dec 27, 2024

Choose a reason for hiding this comment

Pandapip1 Dec 28, 2024

Choose a reason for hiding this comment

mrene commented Aug 4, 2024 •

edited

Loading

mrene commented Oct 20, 2024 •

edited

Loading

Pandapip1 left a comment •

edited

Loading

milas Dec 27, 2024 •

edited

Loading