Bridge local MQTT broker to SAJ server

[paolosabatino]

This post comes from this issue, in particular it has been posted by @h3llrais3r

My inverter is an H1-3.6K-S2 with firmware 1.361

Ok, I thought the infamous firmware was for the inverter... but it's for the battery I assume?
My inverter is the H1-5K-S2 with firmware 1.202.
For the battery I can see a software version, which seems to be 1.152

Can you explain how to do that bridging?

Based on https://solar-assistant.io/help/home-assistant/broker-setup

• Add DNS rewrite in adguard for mqtt.saj-solar.com to your mqtt ip address (I'm running the mosquitto addon in HA, so for me it's the HA ip)
• Add mqtt bridge configuration in HA mqtt addon configuration:
  • add saj mqtt username/password to list of allowed logins in mosquitto config (this is required as the inverter is sending these credentials to the mqtt server and I don't think there is any way to change that):

    logins:
      - username: "!secret mqtt_saj_user"
        password: "!secret mqtt_saj_password"

  • set customize: true and folder: mosquitto to mosquitto config
  • add /share/mosquitto/saj_mqtt_bridge.conf with following content to bridge saj app topic to still have access to the data from the saj app:

    connection saj-mqtt-bridge
    address 47.254.120.144
    remote_username <mqtt_saj_user>
    remote_password <mqtt_saj_password>
    topic saj/<serial>/realtime_data both
    topic saj/<serial>/realtime_dataPlus both
    

    • address contains the real ip of mqtt.saj-solar.com
    • remote_username contains the username used by saj to connect to mqtt.saj-solar.com
    • remote_password contains the password used by saj to connect to mqtt.saj-solar.com
    • topics are the list of topic we want to bridge (in my case it's saj/<serial>/realtime_dataPlus, but other firmwares might be using saj/<serial>/realtime_data)

With this setup, the app still gets the data, but I don't think remote control is still possible as I'm not bridging the data_transmission topic, so even if it's published on the remote broker, it won't be bridged as it's not part of the bridge topic config.

Only problem I can see now is that the ip address of mqtt.saj-solar.com can change and the bridge woudn't work anymore until the ip is updated in the bridge config.
If I would be able to change the mqtt server on the aio3 module directly (I know you can change it via the app, but I never tested it yet) and it actually also keeps that value after a reboot, then the adguard dns rewrite could be removed and in the bridge config, I could put mqtt.saj-solar.com as address instead. Then it should work also when the ip address is changing at saj side..
So I still need to check if the mqtt server can be changed and if it's kept after a restart of the aio3 module.

PS: I suppose you know the credentials for saj mqtt? If not, I can share in PM.

[h3llrais3r]

Let me know if the bridging works for you as well. 😉

If you already poisened your dns locally, you can skip the adguard step for dns rewrite.

[h3llrais3r]

If you have wifi2 dongle, I suppose you still have the web integration where you could login remotely on the ip of the dongle?
In that case, I would probably use the web integration instead myself. 😉
With the AIO3 dongle however, this internal webserver is gone, and there is (according to me) no other way to integrate besides the modbus integration (with additional hardware, didn't try myself as I want to keep the dongle), the saj modbus over bluetooth app (https://github.com/sgsancho/saj_h1_s2_modbus_bluetooth, but didn't try myself yet) or mqtt (this integration).

[paolosabatino]

@walkjivefly if you have connection issues to MQTT by HomeAssistant and the integration, perhaps you should first configure HomeAssistant MQTT integration to talk with the broker.

In my setup I have mosquitto MQTT broker and HomeAssistant running on the same machine.
I also configured HomeAssistant to talk with MQTT to localhost (AFAIK HomeAssistant could also spawn its own MQTT broker).

The DNS is poisoned to induce the inverter to talk to my MQTT broker instead of the SAJ one.

The integration also only uses data_transmission and data_transmission_rsp messages:

saj-mqtt-ha/custom_components/sajmqtt.py

Line 66 in 20120d2

MQTT_DATA_TRANSMISSION = "data_transmission"

[h3llrais3r]

And be aware that the inverter is sending credentials to the mqtt broker. So you have to make sure that you allow the saj credentials on your local broker (without configuring those, I always got client not authorized error in the mosquitto logs)

[maegibbons]

Hi

Can I ask, how do you find the credentials that saj use for mqtt?

Krs

Mark

[h3llrais3r]

@maegibbons You can DM me on [email protected]

[h3llrais3r]

My inverter has (if the label is to believed) the eSolar WiFi2 dongle and although there is the option to reconfigure the destination address in the inverter; it is ignored and then reset to the default on reboot.

That doesn't sound good, will have to try myself to see if it happens as well with the AIO3 module... 😢

I managed to get the inverter talking to mosquitto but couldn't get the integration to work. I found the first thing it does is subscribe to four topics:
• saj/xxx/terminal_param_read
• saj/xxx/terminal_param_write
• saj/xxx/data_transmission
• saj/xxx/update
and then starts publishing on
• saj/xxx/update_rsp
• saj/xxx/realtime_data
• saj/xxx/information

Hmm, I'm not seeing all these topics when I sniffed my network with tcpdump...
I only saw traffic on saj/<serial>/realtime_dataPlus topic...
Maybe the topic are different depending on the type of wifi module?
Maybe I didn't look good enough? How did you sniff the network for these topics?

[paolosabatino]

@walkjivefly Beware that you have H1-3.6K.S2 model; mine is H1.6K.S2 and @h3llrais3r is a H1.5K.S2; probably firmware version differs significantly!

[walkjivefly]

There is no webserver in my dongle. I'm using one of the integrations which talks to the SAJ server to get its data. Definitely not ideal and it needed tweaking to make it work. Messing around with a modbus hardware intervention was more effort than I wanted to make. mqtt was the middle ground and seemed like a good compromise which I'll try again with.

I used wireshark to capture what the dongle was up to - which also got me the credentials I needed to allow the dongle to connect to mosquitto after poisoning the DNS. I was surprised I had to sniff on the actual wifi rather than on the eth adapter where the mqtt server was, after all, the traffic ends up on the eth for the server to see it.

I hadn't thought about the possibility of different capacity inverters using different firmwares. But that could explain why nothing I've tried works "out of the box". In which case it'll probably need more time spent on it than I'll have available this weekend. Ugh.

[Argon007]

interesting! I like the MQTT approach (if we get it working). I still want to use the SAJ mobile app but also get the real time info from the inverter in Home Assistant. So poisoning the DNS to a local MQTT broker in the LAN and forward the MQTT message to SAJ makes sense to me.

I have a H1-5K-S2 device with an AIO3 module

[Argon007]

Didn't had the time yet to try it out. I have Scarlet as ISP with a BBOX3, so first need to setup a DNS/DHCP server so that I can spoof the SAJ MQTT server. What did you use?

So to be clear, it works for you and you can capture the MQTT messages and read the current output in Watt for example? It would also mean that we can connect those MQTT messages and use it in Home Assistant in the Energy Dashboard. How fast are updates coming in via MQTT?

Thanks!
(ps: is there a way to send DM's directly to you in Github? I can't seem to find a way to do this)

[h3llrais3r]

I'm already running HA with adguard home addon. So with adguard Home you can rewrite the mqtt.saj-solar.com dns to your local broker instance (in my case it's the ip of HA as I'm running the mosquitto broker addon, not standalone).
Once you have that configured, the mqtt messages are posted to your local broker, but with the bridge config, also the messages for the app are still forwarded to the mqtt.saj-solar.com ip address (47.254.120.144)

This means that you can now use the scripts from https://github.com/paolosabatino/saj-mqtt to try to pull the data. These scripts have also been created by Paolo (owner of this repo) to test is standalone.
If you test and you get meaningful results (would like to see if you get similar values as me) then you can add this custom integration to get the data in home assistant.

[BertBJ40]

h3llrais3r,
i'm a hardware men, programming is a lot harder for me.
I'm also from Belgium. I want to control my SAJ home batteries. In winter months charging at night.
i have an existing home assistant installing with mqtt broker for my home automation system. Mqtt broker with username and password.
Is this a problem?
the rewrite of the mqtt.saj-solar.com dns can be done in home assistant/adguard?
do i need to install the scipts from https://github.com/paolosabatino/saj-mqtt or can i skip this?

Last but not least : can i communicate with you in dutch?

[Argon007]

Hi all,

I installed Adguard and can spoof the SAJ MQTT address now.
I've created a Telegram Group so that we can easily communicate and maybe help eachother to get it up and running. I also have some questions now about the next steps to take... :-)

You can join the group via this link: t.me/+e1OFuJBu49k1NDNk (append https:// at the beginning of the link).

[h3llrais3r]

Last but not least : can i communicate with you in dutch?

@BertBJ40 Join the telegram group. There whe can communicate in Dutch.😉

[h3llrais3r]

h3llrais3r, i'm a hardware men, programming is a lot harder for me. I'm also from Belgium. I want to control my SAJ home batteries. In winter months charging at night. i have an existing home assistant installing with mqtt broker for my home automation system. Mqtt broker with username and password. Is this a problem? the rewrite of the mqtt.saj-solar.com dns can be done in home assistant/adguard? do i need to install the scipts from https://github.com/paolosabatino/saj-mqtt or can i skip this?

Last but not least : can i communicate with you in dutch?

Not a problem, I'm also running mqtt broker with username/password. You'll just need to add the saj username/password to the list of logins in the mqtt broker config.

The dns rewrite can be done in adguard with a single line (replace with your HA ip if you are running the mqtt broker addon in HA, or the IP of your mqtt standalone instance):

Scripts don't need to be installed themselves, you can just run them with python.
But you need to install python 3 and also install the python dependencies with pip once python is installed. (pip install pymodbus paho-mqtt)
Only change you have to make in the script itself is setting the username/password of your mqtt broker in the readregs.py

Then you can run it like this (if you are on Windows):
python readregs.py <your mqtt broker ip> <your inverter serial> 0x4000 0x100 | python parsedata.py -p

Dutch is fine for me in direct communication. On github I rather keep it in English so everyone can follow. 😉

[miquelbotanch]

may you DM SAJ user and password please?

[h3llrais3r]

@miquelbotanch Please DM me on [email protected] so I can reply.

[erelke]

@miquelbotanch Please DM me on [email protected] so I can reply.

I sent a DM with password req on 15. dec. Can you reply for me?

[h3llrais3r]

@miquelbotanch Please DM me on [email protected] so I can reply.

I sent a DM with password req on 15. dec. Can you reply for me?

Replied ;)

[h3llrais3r]

@miquelbotanch Please DM me on [email protected] so I can reply.

Replied as well ;)

[miquelbotanch]

Done!I’m looking forward to see how this works. I think is much cleaner than the elfin solution.Do you resend the information to the original broker ? Or do you use it isolated ?El 31 des. 2024, a les 20:22, h3llrais3r ***@***.***> va escriure: @miquelbotanch Please DM me on ***@***.*** so I can reply. Replied as well ;) —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[h3llrais3r]

Yes, data is still sent to the original broker. That's why we are bridging it, so you can still use the saj e-solar app. ;)

[miquelbotanch]

And what if they force an update using the broker, and the we loose the magic, because as far as I know, bringing is both ways so, exist the possibility that they force the upgrade and this propagate to our MQTT and then we loose all the magic.Enviat des del meu iPhoneEl 2 gen. 2025, a les 22:14, h3llrais3r ***@***.***> va escriure: Yes, data is still sent to the original broker. That's why we are bridging it, so you can still use the saj e-solar app. ;) —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[h3llrais3r]

The bridge only bridges the 'realtime' data:

topic saj/<serial>/realtime_data both
topic saj/<serial>/realtime_dataPlus both

This is done to keep the saj app working.

Updates/changes are done via other topics.
Since they are not bridged, they cannot change anything anymore remotely, so they can't mess up your config. ;)
I know it's the case, because when I had some issues with my inverter, they contacted me that they couldn't do anything anymore remotely. So I had to temporarily remove the bridge to allow remote changes.