ovos-control-panel

A local web page for an OpenVoiceOS device. It runs on the device. It shows you if the device works, it lets you change the settings, and it makes backups.

There is no cloud account and no internet connection. Every file the page needs is in the package.

Read the full guide — start here

What you can do

Signing in is covered in security.md. The interface is keyboard- and screen-reader-friendly and follows the device language, including right-to-left — see accessibility.md.

The page works on a phone. It follows the light or dark setting of your device.

Install

pip install ovos-control-panel

Run

ovos-control-panel                        # 127.0.0.1:8500, this device only
ovos-control-panel --host 0.0.0.0 --token my-secret   # reachable from your phone
ovos-control-panel --port 9000
ovos-control-panel --no-bus               # do not connect to the message bus

Then open http://<the address of your device>:8500/. If a token is set, the page asks you to sign in once and then remembers you in a cookie.

Run it as a service

Write this to ~/.config/systemd/user/ovos-control-panel.service:

[Unit]
Description=OpenVoiceOS Web UI
After=ovos-messagebus.service
Wants=ovos-messagebus.service

[Service]
Type=simple
ExecStart=%h/.venvs/ovos/bin/ovos-control-panel --host 0.0.0.0 --port 8500 --token CHANGE-ME
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target

Then start it:

systemctl --user daemon-reload
systemctl --user enable --now ovos-control-panel
journalctl --user -u ovos-control-panel -f

The service starts even when the message bus is down. The dashboard then tells you that the bus does not answer.

Security

The page changes the configuration of your device, so treat it like a key.

• The default bind is 127.0.0.1, so only a user of the device can reach it.

• On any other address, set a token. Put it in mycroft.conf:

  {"webui": {"access_token": "a long random string"}}
  

  Or start the service with --token. The page then asks you to sign in. The token goes in the body of a POST and comes back as a cookie, so it never appears in an address, a log or the browser history.

• With a token set, every page, asset and API call needs a sign in. Only the sign in page, /api/status, /api/login, /api/logout and /healthz answer without one.

• Requests that change something must come from this page, not from another web site.

• Without a token on a network address, the page shows a red banner.

• The service never runs a shell command.

• Do not put this page on the public internet. It has no TLS.

Backups

Every save first copies the old file into a .ovos-webui-backups directory beside it. The name of the copy holds the time of the save. The last 20 copies are kept. To undo a change, copy a backup back over the file.

Documentation

The full guide, with a page-by-page navigation table and a first-run walkthrough, lives in docs/README.md.

Development

pip install -e .[dev]
pytest tests -v

The tests need no network and no message bus. Bus behaviour is tested with FakeBus from ovos-utils.

Related projects

• ovos-config — the configuration layers this page writes to
• ovos-busmon — watch the messages on the bus while you debug
• ovos-yaml-editor — a smaller editor for the configuration file alone
• ovos-plugin-manager — the source of the plugin lists in the Settings page
• ovos-core — the services the dashboard asks about

License

Apache-2.0 — see LICENSE.

Credits

Developed by TigreGotico for OpenVoiceOS.

Funded by NGI0 Commons Fund / NLnet under grant agreement No 101135429, through the European Commission's Next Generation Internet programme.