Security mode

The panel’s web interface, its API and its Home Assistant controls are designed for a trusted home network. Relaxed mode is the default: automations, installer tools and browser actions work without an extra prompt. One action is deliberately outside that rule. Turning the camera on through its Home Assistant entity asks for approval at the panel in every mode, including Relaxed. The Camera setting in Configure is a separate owner configuration path. Turning it off never asks.

For a panel on a network shared with less trusted devices, the optional Hardened mode adds approval in person to selected high-impact network operations. It is an extra safety boundary, not a replacement for a separate network or a firewall, and not general authentication for the API. Read-only endpoints and routine panel controls stay available under the normal trusted-network model.

In Hardened mode, protected direct LAN requests need physical access to the panel. They cannot go ahead until someone approves them on the panel’s screen, and that approval cannot be given remotely.

Administrators using the authenticated Panel Assistant sidebar can perform selected routine management actions without the physical prompt: display and power configuration, power-safety acknowledgement, profile activation, media playback, vendor-package taming and dashboard reload. Installation, uninstall, backups, restores, reboot and other protected operations still require approval on the panel. Direct LAN requests do not receive this exception.

The web interface marks affected actions with a small shield in both modes, so you can see which workflows cross the approval boundary before you turn Hardened mode on.

Turn on Hardened mode

This setting can only be changed on the panel itself:

1. Open the panel app’s Configure screen on the panel.
2. Open the toolbar’s overflow menu and choose Security mode.
3. Choose Enable Hardened mode.

Network ADB and Android’s wireless debugging must both be off first, because either one lets a remote ADB client inject input into the approval screen. Before committing the change, the panel app checks every supported Android property for network ADB, persistent network ADB, explicit ADB listen addresses and the state of wireless debugging. It also stops any active WebView developer tools relay on the network and verifies that its process and listener are gone. If it cannot establish that these remote-control routes are inactive, it refuses to turn Hardened mode on. Turn ADB and wireless debugging off in Android’s developer options and try again. If verifying the relay fails, restart the panel before trying again.

The setting belongs to the panel alone. It is not included in configuration exports or full backups, and it cannot be changed through the API, from Home Assistant, by a restore, by importing a configuration, or by an update run across several panels. An existing panel therefore stays in Relaxed mode unless someone turns Hardened mode on at the panel.

Use the same menu to return to Relaxed mode. Doing so clears any pending approval requests.

Approve a network request

When Hardened mode intercepts a protected request to the API, the first attempt returns HTTP 202 Accepted with an approval-required response, for example:

{
  "ok": false,
  "error": "approval-required",
  "approval_id": "…",
  "message": "Approve this request physically on the panel, then retry it; it cannot be approved remotely."
}

To complete the operation:

1. On the panel, open Configure, the toolbar’s overflow menu, Security mode, then Review approvals.
2. Check the operation, its summary and the device that asked, then approve or deny it.
3. Within ten minutes of the original request, send the identical request again from the same device.

An approval is bound to the operation, the requesting device and the protected content of the request, and it can be used once. Changing the request, sending it from another address, waiting more than ten minutes or restarting the panel app needs a new approval. Only the matching retry consumes an approval; it is not a temporary general bypass.

Native Home Assistant entity and automation commands carry Panel Assistant’s transport origin rather than the individual user’s identity. Their approvals are bound to that origin and the exact command. This differs from the authenticated administrator sidebar exception above.

Requests over loopback from software already running on the panel do not need network approval. Hardened mode treats local Android apps as trusted and does not isolate one app on the panel from another, so keep untrusted apps off the panel.

Protected operations

In Hardened mode, a direct network client needs approval at the panel before it can:

• install an uploaded app, or a managed copy of the panel app or a separate dashboard app;
• uninstall an app, or change whether a vendor package is enabled, running or allowed to draw over the screen;
• export a full backup, or a configuration bundle that contains secrets;
• import a configuration, restore a stored configuration revision or restore a panel backup;
• activate or roll back a hardware profile;
• play media fetched from a remote URL;
• reload the dashboard renderer or reboot the panel;
• download an app from a link, which is approved separately from installing it: the download is bound to that exact URL’s SHA-256 and no connection is opened until it is approved, so installing from a link in Hardened mode asks twice;
• advance database recovery maintenance;
• repair a separate dashboard app’s configuration, or clear the built-in renderer’s browsing data;
• change the system display density or font scale;
• turn off the configured keep-awake or prevent-idle-dim guards that keep the panel reachable, from the Configure page or Home Assistant;
• repair the panel’s power safety settings; or
• hide one exact, unchanged caution about a power safety setting that can only be fixed by hand. This changes only what is shown; the underlying assessment, the diagnostics and the installer result stay the same.

Turning on the panel’s camera through its Home Assistant entity requires approval on the panel in both modes. Turning it on from Configure remains a separate owner setting; Android camera permission and a working camera-in-use indicator are still required.

A remote Configure save in Hardened mode must save a power safety reduction separately from vendor package changes, because those need different kinds of approval. Combined saves in Relaxed mode, or over loopback, go through directly.

Hardened mode rejects tap injection from anywhere other than loopback, so a request cannot approve itself. It also refuses to turn on network ADB, Android’s wireless debugging or the WebView developer tools relay. Switch the panel back to Relaxed mode at the panel before using any of those.

The approval boundary does not make the rest of the API on port 8888 authenticated. Diagnostic and status reads and routine controls keep their normal trusted-network behaviour. Keep the panel’s API away from untrusted networks even with Hardened mode on; the security reference describes the full posture.

Updates start when you install through Panel Assistant or choose an installation yourself. The panel app has no scheduled installation policy or saved update channel. Owner-started installations from the Install tab remain available, with approval at the panel for protected remote requests in Hardened mode.

Changing the Home Assistant address

Changing the Home Assistant URL clears the previous sign-in credentials unless new credentials are supplied in the same save. This applies in both security modes. Ordinary saves that keep the same address retain stored secret values when those fields are left blank.