2

I am working on home automation system and I my idea was this:
There will be client app, which will be running on a classic HTTP server (on internet). It will communicate with firebase realtime (NoSQL) database. This app will also run on Raspberry Pi (Raspberry Pi will serve as local HTTP server).

Raspberry Pi will also listen to database changes and control ESP32 modules (according to entries in database). There is block diagram of my system:

System architecture

My question is - is it bad idea to have a remote database (firebase database)? This home automation system is actually my bachelor thesis and commenting on my work, one professor claimed that this is a bad architecture, since the database should be on a local Raspberry Pi: no real projects use this type of architecture (database on the internet instead of local on RPi). He claimed that it is insecure and just - nobody does that. Is he right?

NOTE: Reason why I have the "internet" database is to have ability to control system via internet and not only locally... It seemed to me simplest solution for a global control feature...
So who is right? And if the professor, what is the simplest way to implement global (via internet) control? Any ideas?
Thanks!

anonymous2
  • 4,872
  • 3
  • 20
  • 48
Petr Marek
  • 121
  • 2
  • 1
    You can set up remote access to a local db via a VPN tunnel, or expose the Pi using a no-ip type service. These both require an external service/server (but then so does the remote firebase) -- whether they are utlimately more secure or not I can't say. – goldilocks Feb 05 '21 at 17:00

2 Answers2

2

In general, NoSQL's only advantage over a relational database is scalability. Read about ACID and decide if you're ready to give those properties away in exchange for it.

Remote access usually is only beneficial to the frontend, not the database. Exposing the database to the Internet is not an advantage, it's a tradeoff. Again, you sacrifice desirable properties (in this case, security) for scalability.

Dmitry Grigoryev
  • 121
  • 3
1

It is common in the industry to have a data store in the cloud where the last "desire" and last "actual state" are both stored. The two clients (one being the "controller/monitor" interface and the other being the "controlled/monitored"). The two clients will also store the last desire and last actual state. The advantage of that type of a setup is that the two clients do not need to be connected at the same time. So, in the case of spotty cellular coverage, etc, the system still works. Also, the two clients do not need to be on the same network and can work on the internet.

There are various implementations of this paradigm. Databases such as Couchbase and mongoDB allow replication between the clients and server as a means to do this. MQTT allows a broker to have the feature of "LastWillAndTestament" for this. The AWS implementation of "device shadow" is the same type of concept with a data store in the cloud. Azure digital twins is similar. Firebase has been used by game developers for a while now, to sync state across devices and server. It is a good way to sync application state. AWS Appsync is another option. Azure has some features such as Azure SQL edge, cosmos db and are coming up with something closer to AppSync soon. Without something in the cloud, even connecting the two clients together would be painful because the discovery needs something in the middle (unless it is all on the same network).

In terms of security, yes there would be more pieces to secure because communications are happening on the internet. But systems have been evolved over the last 20 years to make this secure with certificates, etc (atleast the protocols are secure. People can still be fooled and spoofed !). The local-network-only system does not need any security if you can depend on only trusted devices being on the network (which is less and less true, with so many devices coming on our home networks and being hackable). But it would be limited and you cannot operate the system on the internet without security.

So, you have two objectives here. One is to navigate the people who will guide and approve your thesis and the other is to have an industry relevant thesis ! Best of both worlds is if you can educate everyone involved. Wish you all the best.

kalyanswaroop
  • 1,158
  • 4
  • 15