A shelf of IoT devices with no vendor in the path
Problem
Cheap consumer infrared controllers built on the Tuya BK7231N ship tethered to a vendor cloud: an account, an outbound tunnel that is always up, and a third party in the path of every button press inside the house. The device works until somebody else's service does not.
Action
Reflashed the chip to ESPHome and moved every control path onto an authenticated one. The controller talks to each node over ESPHome's encrypted native API with a per-node key; the unauthenticated per-device web dashboard is gone from the firmware; the build dashboard sits behind an authenticating reverse proxy with automated certificates instead of on a flat network. Nothing accepts an inbound connection from the internet.
Outcome
No vendor account, no cloud dependency, no third party in the path, and a control plane authenticated at the device layer rather than trusted because it happens to be on the LAN.
Two details worth keeping, because they are the kind you only have if you did it. Removing the dashboard from the configuration did not close it: old firmware keeps serving what it was flashed with, so it stayed open until each node was re-flashed. And the on-board temperature sensor self-heats about 20 °C inside a sealed case, so the reading is corrected with a calibration offset against a reference thermometer. Hardware is never the ideal on paper.
Discuss your project
Email me with what your system does, what is failing or missing, and your timeline.
Limited slots, and a short discovery call to confirm fit, scope and timelines before anything is agreed.