[websocket] Secure websocket with address binding and SSL

README.md

@@ -15,6 +15,7 @@ The main differences with `dev_setup.sh` are the following:
 - Pulseaudio optimizations
 - Install and configure Mycroft AI Core on multiple hosts at the same time with the same configuration
 - Protect Mycroft message bus service port `8181`
+- Secure Mycroft message bus websocket
 
 `pairing-code.sh` script is generated during the installation process, this script helps you to retrieve the pairing code if you don't hear it.
 
@@ -105,6 +106,12 @@ mycroft_name: picroft
 # Protect Mycroft message bus port by dropping network connection on port 8181
 mycroft_bus_firewall: yes
 
+# Bind the Mycroft websocket on a specific IP address, by default listening on 0.0.0.0
+mycroft_bus_bind_address: "0.0.0.0"
+
+# Enable SSL encryption for Mycroft websocket
+mycroft_bus_ssl: yes
+
 # Confirmation about Mycroft AI Core uninstall
 mycroft_uninstall: no
 

defaults/main.yml

@@ -13,6 +13,8 @@ mycroft_confirm_listening: yes
 mycroft_log_level: INFO
 mycroft_name: picroft
 mycroft_bus_firewall: yes
+mycroft_bus_bind_address: 0.0.0.0
+mycroft_bus_ssl: yes
 mycroft_uninstall: no
 mycroft_extra_skills:
   - https://github.com/JarbasSkills/skill-ddg.git

templates/mycroft-core/mycroft.conf.j2

@@ -7,6 +7,10 @@
   "enclosure": {
     "platform": "{{ mycroft_name }}"
   },
+  "websocket": {
+    "host": "{{ mycroft_bus_bind_address }}",
+    "ssl": {{ mycroft_bus_ssl | lower }}
+  },
   "ipc_path": "{{ _mycroft_ipc }}",
   "log_level": "{{ mycroft_log_level }}",
   "skills": {
@@ -21,4 +25,4 @@
   {% else %},
   "debug": false
   {% endif %}
-}
+}