Set up OMNIVAREN

Connect the services you use, add phone alerts, watch your other computers, and keep backups safe. Everything here is optional; use what fits your network.

How configuration works

Integrations live in one settings file on the Pi. For each one: set enabled = true, fill in its address and credentials, test, then restart.

sudo nano /etc/lodestar/lodestar.toml  # edit; Ctrl+O then Enter saves, Ctrl+X exits
sudo omnivaren check  # tests every enabled connection and shows ✓ or the reason it failed
sudo omnivaren restart  # applies your changes

In the console, Systems › Integrations lists every service with a Test button, and Systems › Modules shows what's online.

Pi-hole (for threat detection)

OMNIVAREN reads Pi-hole's query log to spot devices contacting malicious sites. It needs Pi-hole v6.

1. In Pi-hole: Settings › Web interface / API › Configure app password. Copy the password (it's shown only once) and click Enable.
2. Recommended: untick Permit destructive actions via API, then Save & Apply.

[pihole]
enabled = true
url = "http://192.168.1.10"
password = "the-app-password"

Pi-hole allows one app password; replacing it disconnects anything else that used the old one.

UniFi

1. In UniFi: Admins & Users › Add. Account type Admin, management type Local Only, a username such as omnivaren and a strong password.
2. Admin privileges: Custom. Network: View. Everything else: None.

[unifi]
enabled = true
url = "https://192.168.1.1"
username = "omnivaren"
password = 'the-password'
site = "default"
unifi_os = true  # UDM, UCG, Cloud Key Gen2+; false for a self-hosted controller (url https://host:8443)
verify_tls = false
allow_actions = false  # true enables Quarantine and speed tests (needs client-management rights)

Plex, Sonarr, Radarr and qBittorrent

Plex token: in Plex Web open any title › ⋯ › Get Info › View XML; the token is the value after X-Plex-Token= in the address bar. Use the server's LAN address. If Plex requires secure connections, use https with verify_tls = false.

[plex]
enabled = true
url = "https://192.168.1.15:32400"
token = "..."
verify_tls = false

[sonarr]  # Sonarr: Settings › General › API Key
enabled = true
url = "http://192.168.1.15:8989"
api_key = "..."

[radarr]  # Radarr: Settings › General › API Key
enabled = true
url = "http://192.168.1.15:7878"
api_key = "..."

[qbittorrent]  # 5.2+: Tools › Options › WebUI › API key; older versions: username and password
enabled = true
url = "http://192.168.1.15:8080"
api_key = "qbt_..."
username = ""
password = ""

Threat feeds and vulnerability checks

The malware-domain feeds (URLhaus and ThreatFox) need a free abuse.ch Auth-Key: sign in at auth.abuse.ch with Google, Microsoft, GitHub or LinkedIn and copy your key. Without it, detection uses only the botnet IP list.

[security]
enabled = true
abusech_auth_key = "..."  # required for the URLhaus and ThreatFox feeds
nvd_api_key = ""  # optional: faster vulnerability (CVE) checks; free at nvd.nist.gov/developers
iot_networks = ["iot", "camera", "guest"]  # devices on these networks start in strict mode

After saving and restarting, Security › Scan now loads the feeds straight away.

Any router (no UniFi)

Without UniFi, OMNIVAREN reads your router's internet status over UPnP and discovers devices on your network itself. Both switch on automatically when UniFi isn't enabled. For router status, UPnP must be turned on in the router.

[gateway]
enabled = "auto"  # auto, true or false
url = ""  # optional: the router's UPnP description address if discovery fails

[discovery]
enabled = "auto"

Access points, switches, printers (SNMP)

No file editing needed: in the console go to Network › SNMP Devices › Add device. Use SNMPv3 when the device offers it (authenticated and encrypted). For devices that only support v1/v2c, such as some access points, choose Device only has v1/v2c, and on the device:

• set a long random Get (read) community, never public;
• set Get Source to your Pi's address only;
• give the Set community a different random value, with Set Source pointing at an unused address. OMNIVAREN never changes settings over SNMP.

Weather, wildfire, markets, uptime checks and UPS

[weather]
enabled = true
label = "Home"
lat = 39.7392  # right-click your home in Google Maps: the first number is lat, the second lon
lon = -104.9903
units = "imperial"
nws_alerts = true

[fire]  # US wildfires near you
enabled = true
radius_miles = 50
alert_miles = 15

[markets]  # free key at finnhub.io
enabled = true
api_key = "..."
symbols = ["VTI", "QQQ"]

[ups]  # a UPS on a NUT server; a USB UPS on Windows is read by the Windows agent instead
enabled = false
host = "192.168.1.20"

Uptime checks are easiest from Network › Uptime Monitor › Add check: pick a device from the network list or enter an address.

Phone alerts

1. Install the free ntfy app (App Store or Google Play).
2. Make up a private topic name. On the Pi, this prints a good one: echo omnivaren-$(openssl rand -hex 10). Anyone who knows the name can read your alerts, so keep it secret.
3. In the app tap +, paste the topic, keep the server as ntfy.sh, and subscribe.
4. Add it to the settings file, restart, then use Systems › Phone Notifications › Send test notification.

[notify]
ntfy_url = "https://ntfy.sh/omnivaren-4f9c2a71be03d5e8a6c1"
min_level = "critical"  # info, warning or critical
digest = "weekly"
digest_day = "sunday"
digest_time = "08:00"

Your other computers

The Agents tab has everything for watching other machines: Windows and Linux agents, and agentless SSH.

Windows

1. Agents › Add Windows agent, give it a name, and copy the command shown.
2. Download omnivaren-windows-agent.zip from the Agents tab and unzip it on the PC.
3. Open PowerShell as Administrator in that folder and paste the command. It looks like this:

powershell -ExecutionPolicy Bypass -File .\install.ps1 -Url https://192.168.1.250:8443 -Token lsa_... -Thumbprint ABCD...

The agent is read-only and reports every 5 minutes: drive health and space, Defender, which Windows updates are waiting (or that a restart is needed), and key apps.

Linux or another Raspberry Pi

unzip omnivaren-linux-agent.zip && cd omnivaren-linux-agent
sudo sh install.sh --url https://192.168.1.250:8443 --token lsa_... --thumbprint ABCD...

Agentless (SSH)

Agents › SSH Hosts › Add host shows the setup commands, including OMNIVAREN's restricted key, which permits commands only: no terminal, tunnels or file transfer.

Updating agents

When a newer agent is available, the Agents page shows Update and Update all. Nothing changes until you approve, and each agent checks the publisher's signature itself before updating. Agents installed before version 1.9.3 need one manual update first: run their installer again with -Update (Windows) or --update (Linux) from a freshly downloaded agent package.

Backups

Every night OMNIVAREN encrypts its database and settings (AES-256), saves them and verifies the result, and every week it test-restores the newest one. Keep backups off the Pi by mounting a network share at the backup folder. A NAS or Windows share (SMB) example:

sudo apt install -y cifs-utils
sudo nano /etc/omnivaren-nas.cred  # two lines: username=...  password=...
sudo chmod 600 /etc/omnivaren-nas.cred
id lodestar  # note the uid and gid numbers

Add this line to /etc/fstab (sudo nano /etc/fstab) with your share's address and the uid and gid from above, then run sudo mount -a and sudo omnivaren backup:

//192.168.1.20/backups/omnivaren /mnt/lodestar-vault cifs credentials=/etc/omnivaren-nas.cred,uid=999,gid=999,file_mode=0600,dir_mode=0700,_netdev,nofail 0 0

Restoring

• In the console: Systems › Backups, choose a snapshot, Restore. A safety snapshot of the current state is taken first.
• Onto a new Pi: install OMNIVAREN, run sudo omnivaren import-key --force and paste your saved vault key, mount the share, then sudo omnivaren snapshots and sudo omnivaren restore <name>.

Updates and reverting

When a new version is out, Systems › Updates shows it with its release notes. Download and install verifies the publisher's signature, takes a safety snapshot, installs, and switches back automatically if the new version doesn't start. Your settings carry over.

OMNIVAREN keeps your last five versions. If an update ever causes a problem, Systems › Updates › Installed Versions › Revert goes back to any of them: the software only (your data stays), or the software and data as they were then. If we ever withdraw a version because of a serious bug or vulnerability, your console tells you straight away and offers the fix.

From the command line, with a package file:

sudo omnivaren upgrade ~/omnivaren-X.Y.Z-signed.zip
sudo omnivaren versions  # list installed versions
sudo omnivaren revert 1.11.0  # software only
sudo omnivaren revert 1.11.0 --with-data  # software and data as they were

License and renewal

Systems › License shows who OMNIVAREN is licensed to and the date updates are included until. To add or replace a license (for example after renewing), paste the whole license there and choose Verify & save. Licenses are checked offline. After your update period ends everything keeps working; renewing ($19 a year) adds another year of new versions on top of any time you have left.

Command reference

Troubleshooting

Uninstall

sudo omnivaren uninstall  # removes OMNIVAREN; settings, data and backups stay for a reinstall
sudo omnivaren uninstall --purge  # also deletes settings and data (save your vault key first)

The Caddy web server stays installed; remove it with sudo apt remove caddy if nothing else uses it.