Onboarding Report: Roborock s8

[corke2013]

Latest firmware update works fine with letsencrypt certs.

Awesome work!

It would be ideal to try get this working behind a reverse proxy such as Traefik and a docker image that can be pulled instead of needing to be built.

Happy to try help out with the docker stuff if needed.

[corke2013]

I managed to get it working behind a reverse proxy (traefik).

I generated a self signed cert that just gets the server running without complaining about a missing cert.

I updated the config.toml

[network]
stack_fqdn = "api-rr.example.com"
bind_host = "0.0.0.0"
https_port = 443
mqtt_tls_port = 8881
region = "us"

[broker]
mode = "embedded"
host = "127.0.0.1"
port = 18830
mosquitto_binary = "mosquitto"
enable_topic_bridge = true

[storage]
data_dir = "/data"

[tls]
mode = "provided"
cert_file = "/data/certs/cert.pem"
key_file = "/data/certs/key.pem"

I added the following labels to the docker container. This allows HTTPS and TLS termination between the vacuum and traefik. The connection between traefik and the server is plaintext.

labels:
      - traefik.enable=true
      - traefik.http.routers.roborock-443.entrypoints=https-tcp-443
      - traefik.http.routers.roborock-443.rule=Host(`api-rr.example.com`)
      - traefik.http.routers.roborock-443.service=roborock-443
      - traefik.http.services.roborock-443.loadbalancer.server.port=443
      - traefik.tcp.routers.roborock-8881.entrypoints=roborock-tcp-8881
      - traefik.tcp.routers.roborock-8881.rule=HostSNI(`api-rr.example.com`)
      - traefik.tcp.routers.roborock-8881.service=roborock-8881
      - traefik.tcp.routers.roborock-8881.tls=true
      - traefik.tcp.services.roborock-8881.loadbalancer.server.port=8881

Finally, I updated tls_enabled=Falsein server.py here

local_roborock_server/src/roborock_local_server/server.py

Line 1576 in 0e3aab6

tls_enabled=True,

and here

local_roborock_server/src/roborock_local_server/server.py

Line 1602 in 0e3aab6

tls_enabled=True,

I was getting errors about incompatible cyphers when the vacuum tried connecting to MQTT. The solution was updating my letsencrypt certificate key type

certificatesResolvers:
  letsencrypt:
    acme:
      keyType: "EC384"

Last thing was to make sure the traefik container exposed both port 443 and 8881 and removed ports completely from the roborock container compose file.

I think a setup like this will work well, especially with the built in certificate renewal built into traefik.