SMLIGHT key connection to Zigbee2Mqtt on Gladys (Full SSL/TLS) (external MQTT and Z2M)

[prohand]

Hello,

As promised, here is a tutorial to connect an SMLIGHT key to Gladys via the network and not via USB, otherwise you lose all the interest of this key by plugging it in via USB

Since Gladys only supports USB mode @pierre-gilles stop me if I’m wrong , I went for an installation with an MQTT and Z2M external to Gladys.
This could perhaps be the subject of a feature request, what do you think @pierre-gilles ?

Here for z2m in https I use port 443 but to avoid any conflict if you decide to install everything on the same machine you should change it to port 4343 for example

I had already made a complete tutorial on HAOS at the time when I was using it that you can find here :

[Tuto] Installer HAOS sur Proxmox avec Z2M et MQTT (Full SSL/TLS - Lets Encrypt)

Mosquitto (Mqtt) Installation

Install a VM under ubuntu 24.04, update it completely and run the following commands :

To install docker :

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker

Add a docker_mosquitto user for example :

adduser docker_mosquitto

Get its ID : (Here 1002)

cat /etc/passwd [ grep docker_mosquitto

Create the mosquitto folder in /opt

mkdir /opt/mosquitto

Create the docker-compose.yml file with the following content : (Replace 1002 with the IDs we retrieved just before)

services:
  mosquitto:
    image: eclipse-mosquitto:2.0.22
    container_name: mosquitto
    restart: unless-stopped
    user: "1002:1002"
    ports:
      - "1883:1883"    # MQTT
      - "8883:8883"    # MQTTS (secure)
      - "9001:9001"    # WebSockets
    volumes:
      - ./mosquitto/config:/mosquitto/config
      - ./mosquitto/data:/mosquitto/data
      - ./mosquitto/log:/mosquitto/log
      - /etc/localtime:/etc/localtime:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem:ro

Create a mosquitto folder and subfolders and apply the rights : (This one will contain the configuration, data and logs)

mkdir /opt/mosquitto/mosquitto
mkdir /opt/mosquitto/mosquitto/data
mkdir /opt/mosquitto/mosquitto/config
mkdir /opt/mosquitto/mosquitto/log
touch mkdir /opt/mosquitto/mosquitto/log/mosquitto.log
chown -R 1002:1002 /opt/mosquitto/mosquitto

Create the config file in /opt/mosquitto/mosquitto/config/mosquitto.conf

persistence true
persistence_location /mosquitto/data/

log_dest file /mosquitto/log/mosquitto.log

listener 1883 localhost
allow_anonymous false
#password_file /mosquitto/config/passwd
tls_version tlsv1.3

listener 8883
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

listener 9001
protocol websockets
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

Enable SSL : (To be adapted according to the plugin you use to retrieve the certificate of your domain name) Here it is an example with infomaniak

apt install certbot
apt install python3-pip

pip install certbot-dns-infomaniak

export INFOMANIAK_API_TOKEN=xxx

certbot certonly \
  --authenticator dns-infomaniak \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  --rsa-key-size 4096 \
  -d 'mqtt.xxx.local.srv-home.fr'

By default, certbot installs a service that periodically renews its certificates automatically. For this, the command must know the API key, otherwise it will fail silently.

In order to activate the automatic renewal of your generic certificates, you will have to modify /lib/systemd/system/certbot.service. Add the following line in Service, replacing Replace your token with the following:

Environment="INFOMANIAK_API_TOKEN=<YOUR_API_TOKEN>"

Then open the config file

nano /etc/letsencrypt/renewal/xxx.conf

Add

renew_hook = docker restart mosquitto

chmod -R 755 /etc/letsencrypt/live
chmod -R 755 /etc/letsencrypt/archive

Launch the container

cd /opt/mosquitto
docker compose up -d

You can view the Docker container logs:

docker logs mosquitto -f

Enable authentication (Replace username with a user, for example « mqttuser »

docker exec -it mosquitto mosquitto_passwd -c /mosquitto/config/passwd username

Uncomment the line « password_file /mosquitto/config/passwd » in the file « /opt/mosquitto/mosquitto/config/mosquitto.conf » which will now give

persistence true
persistence_location /mosquitto/data/

log_dest file /mosquitto/log/mosquitto.log

listener 1883 localhost
allow_anonymous false
password_file /mosquitto/config/passwd
tls_version tlsv1.3

listener 8883
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

listener 9001
protocol websockets
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

Restart the container afterwards:

docker restart mosquitto

You can then enter this login in Gladys and then in zigbee2mqtt

Zigbee2mqtt Installation

Install a VM under Ubuntu 24.04, update it completely and follow the following procedure:

Linux Docker | Zigbee2MQTT

To install Docker:

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker

Here is my docker-compose.yml file:

services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    image: koenkk/zigbee2mqtt:2.8.0
    restart: unless-stopped
    volumes:
      - ./data:/app/data
      - /run/udev:/run/udev:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem:/etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem:ro
      - /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem:/etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem:ro
#    devices:
#      - /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0:/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0
    ports:
      - "443:443"  # External port 443 → internal port 443
    environment:
      - TZ=Europe/Paris
    networks:
      - z2m_net

networks:
  z2m_net:
    driver: bridge

Here is my /opt/z2m/data/configuration.yaml file as an example, you need to modify the auth_token which will allow you to connect to the web interface as well as the password of the z2m user that we set up previously during the MQTT installation

homeassistant:
  enabled: false
mqtt:
  base_topic: zigbee2mqtt
  server: mqtts://mqtt.xxx.local.srv-home.fr:8883
  user: mqttuser
  password: tochange
  keepalive: 60
  reject_unauthorized: true
  version: 4
  include_device_information: true
serial:
  port: tcp://192.168.xx.xx:7638
  baudrate: 460800
  adapter: zstack
  disable_led: false
advanced:
  pan_id: GENERATE
  network_key: GENERATE
  channel: 25
  homeassistant_legacy_entity_attributes: false
  legacy_api: false
  legacy_availability_payload: false
  log_level: info
  log_syslog:
    app_name: Zigbee2MQTT
    eol: /n
    host: localhost
    localhost: localhost
    path: /dev/log
    pid: process.pid
    port: 514
    protocol: udp4
    type: '5424'
  last_seen: ISO_8601
frontend:
  enabled: true
  package: zigbee2mqtt-windfront
  port: 443
  host: 0.0.0.0
  url: https://z2m.xxx.local.srv-home.fr
  ssl_cert: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem
  ssl_key: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem
  auth_token: tochange

Replace this with the IP of your key and don’t forget to change auth_token and password

port: tcp://192.168.xx.xx:7638

Enable SSL: (To be adapted according to the plugin you use to retrieve the certificate of your domain name) Here is an example with Infomaniak

apt install certbot
apt install python3-pip

pip install certbot-dns-infomaniak

export INFOMANIAK_API_TOKEN=xxx

certbot certonly \
  --authenticator dns-infomaniak \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  --rsa-key-size 4096 \
  -d 'z2m.xxx.local.srv-home.fr'

By default, certbot installs a service that periodically renews its certificates automatically. For this to happen, the command must know the API key, otherwise it will fail silently.

To enable automatic renewal of your generic certificates, you will need to modify /lib/systemd/system/certbot.service. Add the following line in Service, replacing <YOUR_API_TOKEN> with your token:

Environment="INFOMANIAK_API_TOKEN=<YOUR_API_TOKEN>"

nano /etc/letsencrypt/renewal/z2m.xxx.local.srv-home.fr

Add (If you have a tip for integrating a reload, I’m interested

renew_hook = docker restart zigbee2mqtt

chmod -R 755 /etc/letsencrypt/live
chmod -R 755 /etc/letsencrypt/archive

In the file /etc/systemd/system/zigbee2mqtt.service I had to replace User=pi with User=root. I haven’t found a way to do otherwise for the moment but if you have an idea to run it with a user with fewer rights, I’m interested as well

Launch the container

cd /opt/z2m
docker compose up -d

Zigbee2mqtt should now be available at the address https://z2m.xxx.local.srv-home.fr indicating the password you put in auth_token

Do not use SSL/TLS

You can very well do without the SSL/TLS part and use port 8080 for Z2M and port 1883 with Mqtt by modifying the configuration

Z2M Configuration:

docker-compose.yml:

services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    image: koenkk/zigbee2mqtt:2.8.0
    restart: unless-stopped
    volumes:
      - ./data:/app/data
      - /run/udev:/run/udev:ro
      - /etc/localtime:/etc/localtime:ro
#    devices:
#      - /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0:/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0
    ports:
      - "8080:8080"  # External port 8080 → internal port 8080
    environment:
      - TZ=Europe/Paris
    networks:
      - z2m_net

networks:
  z2m_net:
    driver: bridge

configuration.yaml:

homeassistant:
  enabled: false
mqtt:
  base_topic: zigbee2mqtt
  server: mqtt://mqtt.xxx.local.srv-home.fr:1883
  user: mqttuser
  password: tochange
  keepalive: 60
  reject_unauthorized: true
  version: 4
  include_device_information: true
serial:
  port: tcp://192.168.xx.xx:7638
  baudrate: 460800
  adapter: zstack
  disable_led: false
advanced:
  pan_id: GENERATE
  network_key: GENERATE
  channel: 25
  homeassistant_legacy_entity_attributes: false
  legacy_api: false
  legacy_availability_payload: false
  log_level: info
  log_syslog:
    app_name: Zigbee2MQTT
    eol: /n
    host: localhost
    localhost: localhost
    path: /dev/log
    pid: process.pid
    port: 514
    protocol: udp4
    type: '5424'
  last_seen: ISO_8601
frontend:
  enabled: true
  package: zigbee2mqtt-windfront
  port: 8080
  host: 0.0.0.0
  url: http://192.168.xx.xx
 # ssl_cert: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem
 # ssl_key: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem
  auth_token: tochange
**MQTT config:**

persistence true
persistence_location /mosquitto/data/

log_dest file /mosquitto/log/mosquitto.log

listener 1883
allow_anonymous false
password_file /mosquitto/config/passwd

**Configure Gladys to use the external MQTT broker:**

![image|690x346](upload://89sCSttGIcTvVAX5KPpkoGeYo55.png)

And everything should be okay:

![image|690x186](upload://vtIXMTY5QPHGYzJqxCMQ8mJA7hm.png)

The tutorial may not be perfect but it tries to cover all possible cases and I may have forgotten things, so if you have any comments or questions, feel free to ask :slight_smile:

[pierre-gilles]

Thanks for the tutorial!

To install Mosquitto, using Docker would be much simpler though ^^

@prohand

That could perhaps be the subject of a feature request — what do you think, @pierre-gilles?

Yes, absolutely!

[prohand]

@pierre-gilles

To install Mosquitto, going through Docker would be much simpler anyway ^^

Yes, when I have a bit of time I’ll look at applying it on my setup and modify the tutorial

@pierre-gilles

Yes, absolutely!

It’s done here: https://community.gladysassistant.com/t/prise-en-charge-des-cles-smlight-via-reseau/

[prohand]

@prohand

Yes, when I have a bit of time I’ll see about applying it on my setup and modifying the tutorial

There, it’s been modified

[prohand]

Following this post:

Zigbee2mqtt non fonctionnel

Hello, Je ne sais pas si c’est depuis la mise à jour ou bien depuis ma modification de mqtt que j’ai passé dans docker mais plus aucun appareil zigbee2mqtt n’est controlable dans Gladys. J’ai pas mal de logs comme ceci dans les logs : 2026-02-23T19:05:07+0100 <error> handleMqttMessage.js:109 () Failed to convert value for device Prise baie informatique: Error: Zigbee2mqqt expose not found on device "Prise baie informatique" with property "linkquality". at Zigbee2mqttManager.readValue (/sr…

I forced the mosquitto version to 2.0.22