How to use the new device hierarchy introduced by https://github.com/karwosts in the 2025.4 release of home assistant.

Go to your energy dashboard. Then edit one of your individual devices

Then you can select an upstream device. You can only select a device that is present on the Individual devices list

On the dashboard, the selected device is subtracted from the device it come from (untracked)

The upstream device must obviously have a greater value than the downstream devices, as they derive from it.

QNAP vulnerability list of march 2025. Multiple vulnerabilities have been discovered in Qnap products. Some of these allow an attacker to trigger remote arbitrary code execution, data confidentiality breaches, and data integrity violations.

Instructions to update (from QNAP)

Updating QTS or QuTS hero

1. Log in to QTS or QuTS hero as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

All versions bellow are vulnerable. Please update to last version available :

• File Station versions 5.5.x prior to 5.5.6.4741
• HBS 3 Hybrid Backup Sync versions 25.1.x prior to 25.1.4.952
• Helpdesk versions 3.3.x prior to 3.3.3
• Qfinder Pro Mac versions 7.11.x prior to 7.11.1
• Qsync Client versions 5.1.x prior to 5.1.3 for Mac
• QTS versions 4.5.x prior to 4.5.4.2957 build 20241119
• QTS versions 5.1.x prior to 5.1.9.2954 build 20241120
• QTS versions 5.2.x prior to 5.2.3.3006 build 20250108
• QuLog Center versions 1.7.x prior to 1.7.0.829
• QuLog Center versions 1.8.x prior to 1.8.0.888
• QuRouter versions 2.4.x prior to 2.4.6.028
• QuTS hero versions h4.5.x prior to h4.5.4.2956 build 20241119
• QuTS hero versions h5.1.x prior to h5.1.9.2954 build 20241120
• QuTS hero versions h5.2.x prior to h5.2.3.3006 build 20250108
• QVPN Device Client versions 2.2.x prior to 2.2.5 for Mac

How to disable swapp for best performance in proxmox.

So I read about swappiness and find this very usefull commands :

sysctl vm.swappiness=0
This will allow your system to swap when your physical memory is near to zero.
sysctl vm.swappiness=10
This will allow your system to swap when your physical is about 10 % memory remaining

So, you need to check your swappiness : cat /proc/sys/vm/swappiness and define a new limit. In my case, I don't want the SWAP to be used, so, I fix the value to 0.

# Check the current value
cat /proc/sys/vm/swappiness

# Define the new one
sysctl vm.swappiness=0

# Disable SWAP, it'll take some times to clean the SWAP area
swapoff -a

It take 15 minutes to clean the SWAP...

# Enable the SWAP with the new value
swapon -a

# Check if well applied
cat /proc/sys/vm/swappiness

The execution is Shell JS from Proxmox !

Nextcloud to influxDB (Grafana for display) with telegraf.

Nextcloud allows you to see some of your instance statistics by accessing a simple URL : https://instance_dns_name/ocs/v2.php/apps/serverinfo/api/v1/info

To find which one you can use, go on Settings => Administration => System and a section called External monitoring tool

If you append ?format=json to the end of the url, you'll see the data on JSON format. Logged as an admin, that's how datas looks :

Telegraf

At this point, I was wondering : how to get and parse datas. After a little bit of research, I found the input plugin HTTP from telegraf

https://github.com/influxdata/telegraf/blob/master/docs/DATA_FORMATS_INPUT.md

The documentation looks promissing :

And the JSON format is supported. Successful candidate.

Because we need an admin account, I created one for telegraf, named telegraf-http

Based on the documentation I add a new section on /etc/telegraf/telegraf.conf for http input (all passwords have been re-generated before the publication ;))

[[inputs.http]]

urls = [
    "https://instance_dns_name/ocs/v2.php/apps/serverinfo/api/v1/info?format=json"
  ]

method = "GET"

username = "telegraf-http"
password = "%@R$GVCMRzBJsr#VR4Hm7ngrU$"

data_format = "json"

success_status_codes = [200]
timeout = "30s"
interval= "60s"

name_prefix = "nextcloud_"

And I run a simple test, before reloading, with the command

telegraf --input-filter http --test

And ... I got an 401 (Unauthorized). It's because I've removed my user telegraf-http from the admin group to test something else before. After re-adding the user, the test looks much better

After this I restart the telegraf service to refresh the configuration

/sbin/service telegraf restart

Grafana

On grafana, I see my new dataset : nextcloud_http

Now, I can create a nice dashboard to follow my Nextcloud activities.

Exemple, ocs_data_nextcloud_storage_num_files with difference transformation. AKA : how many files are added per minutes :

Dell ECS est une solution de stockage object proposée par Dell. Comme la plupart des stockages object, cette solution supporte l'API S3, étant déjà utilisateur de S3 via restic, j'ai décidé d'écrire un article parlant des deux technologies.

Le choix d'ECS est intéressant pour avoir des fonctionnalités et des espaces cloud mais en on premise.

Installation

La première chose à faire est d'installer le binaire restic. L'installation est plutôt simplissime car restic est un simple binaire qui exécute l'ensemble du travail de sauvegarde.

On se rend sur le dépôt des release restic : https://github.com/restic/restic/releases et on cherche la version souhaitée

Les release sont là pour faire gagner un peu de temps lorsque vous avez des OS assez standard.

En l'occurence faisant un test sur Debian, je vais prendre la version : restic_0.9.6_linux_amd64.bz2

On "installe" donc cela :

wget https://github.com/restic/restic/releases/download/v0.9.6/restic_0.9.6_linux_amd64.bz2
bunzip2 restic_0.9.6_linux_amd64.bz2
# Si commande inconnue, installer de cette manière : apt-get install bzip2
mv restic_0.9.6_linux_amd64 /usr/local/bin/restic
chmod 510 /usr/local/bin/restic

# J'ai choisi de limiter les droits pour contrôler qui a le droit d'utiliser restic, de ce fait seul les membres du groupe restic-user ont les droits d'exécution

addgroup restic-user
chown root:restic-user /usr/local/bin/restic
addgroup vincent restic-user

On vérifie

Dépôt (repository) = destination de sauvegarde

Restic fonctionne sur un système de dépôt de fichier s'apparentant à git. L'idée à comprendre derrière ces dépôts (repository) est que ce sont nos cibles de destination, donc nos cibles de sauvegardes.

Plusieurs backend

Il est possible de faire sauvegarder restic vers presque n'importe quoi grâce à son utilisation de rClone, mais plusieurs sortent du lot pour des questions de coût, tel que BackBlaze avec leur stockage B2 ou encore Amazon S3 (ou S3 compatible) dont Dell ECS.

Création du dépôt

Pour créer le dépôt, nous allons taper la commande restic init et ... Ce n'est pas tout, c'est là que tout diffère.

restic init -r /home/vincent
# pour du local ou même 
restic -r sftp:utilisateur@hôte:/sauvegarde init
# pour du SFTP ou encore 
restic -r s3:s3.amazonaws.com/nom_bucket init
# pour du S3 de chez Amazon

-r ou --repo pour indiquer la destination

Voici un exemple pour une cible locale

Pas d'accès demandé pour le stockage, car accessible localement. Le mot de passe de dépôt (password for new repository) est utilisé pour chiffrer les clés présentes dans le dépôt créé par init. Il impossible de ne pas chiffrer un dépôt restic. (ce qui est un très bon point)

Voici l'arborescence crée :

A partir de là, le dépôt contenu dans /home/vincent/RESTIC-ECS/sauvegarde est utilisable comme répertoire de sauvegarde.

Sauvegardes

Sauvegarde locale

J'ai par exemple ce magnifique ISO de debian que je souhaite sauvegarder.

Il me suffit de taper cela pour le sauvegarder dans le dépôt précédemment créé.

On remarque un ajout de 500 Ko au dépôt car la déduplication fonctionne très bien et que j'ai déjà sauvegardé ce fichier il y a quelques jours.

Sauvegarde distante

Création du dépôt S3

Mon stockage distant sera en environement Dell ECS compatiable object S3.

Comme précédemment, l'étape 1 est d'initialiser notre dépôt : restic -r s3:beta.cloudstart.fr/bucket-de-test init

Cela ne pourra fonctionner sans authentification, car nous essayons de créer une dépôt sur un serveur distant.

Pour se faire, il faut faire un export son compte de connexion.

En l'occurence, ECS étant S3 compatible, nous ferons nos exports via AWS :

Sauvegarde de test

On lance une sauvegarde pour valider le fonctionnement du dépôt

En interactif

Pour utiliser restic de manière ponctuelle : ce que nous avons vu précédemment.

En script

Pour le script un simple export des mêmes clés AWS est nécessaire, mais également du mot de passe de dépôt, celui-ci étant tapé de manière interactive lors des exécutions en direct.

Le script va donc lancer une sauvegarde de tout le répertoire ECS

Statistiques et restauration

Afin d'en savoir plus sur la place occupée sur la destination, nous utilisons commande suivante

restic -r s3:beta.cloudstart.fr/bucket-de-test stats

Du côté ECS ont voit bien nos données. Avec la déduplcation, les données ne prennent qu'une partie réduite de l'espace :

Et il est même possible de suivre les performances sur une certaine période

Restic fonctionne sous un principe de snapshot que nous pouvons considérer comme des points de rétention, pour les lister

restic -r s3:beta.cloudstart.fr/bucket-de-test snapshots

Plusieurs options sont disponibles pour la restauration, par exemple restaurer l'ensemble des données depuis un snapshot précis. Nous n'indirons pas la date, ni le chemin désiré pour le snapshot, mais son ID, par exemple acd25382 qui est celui du 07-09-2020 à 18h43

Je vérifie simplement les données avec une commande sha et, pas de souci :

La suite

Les sauvegardes et scripts présentés sont très sommères et on ne suit pas forcément les dites sauvegarde. Avec quelques modifications des scripts, j'arrive au monitoring suivant :

Ce sont des éléments que j'aborderais dans d'autres articles si cela vous intéresse !

Last night, I was broswing my HUE app, and I saw that my motion sensor did send temperature information.

So, I instantly wanted to add this input temperature to my Grafana dashboard.

HUE API

I've read the introduction about token generation on the official philips hue documentation : https://developers.meethue.com/develop/get-started-2/

Discovery

To automate the process of token generation OR if you don't know the IP address of your bridge, you wan surf on this page : https://discovery.meethue.com/ but you need to be on the same network as your hue bridge (or with m-dns rules).

As you can see, the answer is a JSON format (I've hidden the bridge ID) and the internalipaddress is 192.168.100.50 (IOT VLAN in my case). It also works with curl / wget / others broswers :

You can test it by browsing the IP address

Token generation

Before I read the documentation, in my mind : the application needed to initiate the token generation before pressing the link button on the bridge, but ... The application doesn't need to initiate anything before, you need to send a token generation request, after pressing the link button.

The API URL is ... /api (👍 philips) and, the second path in the URL must be the token. If you send a fake / wrong token you'll have the message

You need to send a JSON encoded POST request with the device type you "need" to process the token registration. It can be anything. Philips hue documentation exemple :

{"devicetype":"my_hue_app#iphone peter"}

So, I prepared the JSON encoded POST request with CURL, then I pressed my bridge link, and immediatly AFTER I ran this CURL command

curl -d '{"devicetype":"test#monitor01"}' -H "Content-Type: application/json" -X POST http://192.168.100.50/api

The request response is simple : the status (success), and our username (which is actually a token). Keep it securely. If you don't run the command fast enough, you'll have this error

List all sensors

Now, we have the IP address of the hue bridge and a functionnal token, we could list all sensors by sending this request

curl http://192.168.100.50/api/YOURTOKENHERE/sensors

It's JSON format and could easily by parsed by using jq command, a simple pipe to jq will display the informations in a JSON conventionnal reading format, this will help to understand the structure and will be used after to extract the datas.

curl http://192.168.100.50/api/YOURTOKENHERE/sensors|jq

As you can see, there is an ID and a name, you can scroll until you find the sensor you need.

Also, you can use this command to only extract the ID and the name

curl -s  http://192.168.100.50/api/YOURTOKENHERE/sensors|jq -r 'keys[] as $k| "\($k) \(.[$k].name)"'

As you can see I have a lot of  sensors, but a sensor is not a full device, it's just a sensor. For exemple, the motion sensor create a least this sensors :

• The motion sensor (5 in my previous list)
• The temperature sensor (4 in my previous list)
• The ambiant light sensor (6 in in my previous list)

Use a sensor

Now that we have spotted all the sensors we need (4 for temperature and 6 for lux) we want to display all the informations contained by the sensor. The request is simple (jq is only for human reading purpose) :

curl http://192.168.100.50/api/YOURTOKENHERE/sensors/4|jq

We see

• The temperature (in celcius and that need to be divided by 100, I guess a int to float trick)
• The battery level
• The name

We have all the informations we want, it's extraction time ! As mentionned earlier, I will be using JQ :

curl http://192.168.100.50/api/YOURTOKENHERE/sensors/6|jq .state

It's keeps all the state part

And finally

curl http://192.168.100.50/api/YOURTOKENHERE/sensors/6|jq .state.temperature

2454 (so 24.54 °C).

Everything in a script

The final script temp-hue.sh, I used the -s parameter to prevent curl to display the request status, and I do use bc to calculated the float value

#!/bin/bash

token="YOURTOKENHERE"
ip_bridge="192.168.100.50"
temp=$(curl -s "http://$ip_bridge/api/$token/sensors/4"|jq .state.temperature)
temp=$(echo "scale=2;$temp / 100"|bc)

lux=$(curl -s "http://$ip_bridge/api/$token/sensors/6"|jq .state.lightlevel)

echo "philips-hue,device=capteur-salon temperature=$temp,lux=$lux"

And ... The telegraf input exec

Then the owner and execution flag for the script file

And finally service telegraf restart

Now I switched to my grafana dashboard and created a dashboard to visualize the new incoming data

If you have any question, please react on https://www.reddit.com/r/homelab/comments/cxmy9r/philips_hue_temperature_monitoring_grafana/

In this article I'll show you how to backup your data from QNAP to BackBlaze B2 object storage, by using Hybrid Backup Sync 3

HBS 3 is in beta, you can tested it out here : https://www.qnap.com/solution/hbs3
You can ask / comment on this reddit post : https://www.reddit.com/r/homelab/comments/c0am7v/qnap_hybrid_backup_sync_30_to_backblaze_b2/

Here's the backup plan

1. My PROXMOX node backup all very important VM on a QNAP volume with only one backup retain
2. Hybrid Backup Sync backup all the data to B2 object storage with a 30 days retain on all data

Create the bucket on BackBlaze

Before going on QNAP, we need to define the bucket, in my example, the bucket name would be qnap-tuto-lbdg

In the object storage world, the bucket is the "data deposit"

First logon your BackBlaze account, and browse on Buckets

Then, create a new bucket
Choose a name for the bucket, and set it as Private

The bucket is created, now, I don't recommand to use your master key to connect from QNAP, so we create a new application key

Click on the App Keys menu

Then Add a New Application Key

• Chose a name for the key, it could be everything, it's more like a description
• Select to allow access on qnap-tuto-lbdg (previously created bucket)
• Chose Write-Read

And create new key. At this point, don't leave the page.
BackBlaze will display a keyID & an applicationKey, the applicationKey only shows at this point and never could be displayed after.

Configuration the Storage Space on HBS 3

The new HBS 3 have more "split configuration" for the backup / sync jobs

Create the BackBlaze profile on Storage Spaces

We browse to Storage Spaces to define the BackBlaze profil that will be used for the backup job.

We create a new profil for Storage Spaces

Select the service you want to connect, in our case, BackBlaze B2

The login informations are

Fill the forms with the previous generated app keys on the BackBlaze website

And then press create.
Now, the BackBlaze profile is created and can be used for the backup / restore configuration

Create the backup job

We create a backup job, that we can scheduled after the proxmox backup

We select the concerned folder to backup "pve01-important"

Then the destination, BackBlaze B2 :

We see the previously BackBlaze profile, this contain all the connexion datas

And we scroll down to the BackBlaze B2 bucket name which we give access to ; and choose a multipart size, which is the size a single request on backblaze

We also need to create a folder on the bucket, we cannot upload on the root folder

A short summary of the source and destination

It could be enought for a simple backup job, but we want retention.

We go on the Policies tag, and check Remove deleted data from the destination, and define a retention of 30 days

The last summary before creating the job

Then the job will process

After ~15 minutes for 5.5 GB, the job is finished

In the BackBlaze website, we saw our files.

Resume

My average upload rate on BackBlaze B2 is 4.5 MB/sec. But my internet connexion is 500 Mbps. BackBlaze told me that is the performance for their service, it could be better with more parallel tasks.

Here's some results :

BackBlaze is affordable and less than 1$ (for 100 GB) a month is worth it to have peace of mind over critical data