Honeywell Galaxy SIA Notification Server

SIA-Server is a lightweight, self-hosted Python service that receives SIA protocol messages from Honeywell Galaxy Flex alarm systems and forwards them as prioritized push notifications to your phone or computer.

It was created as a replacement for the discontinued free Honeywell push notification service, allowing users to regain full control over their alarm alerts without ongoing subscription costs.

Notifications are delivered via ntfy.sh — a free, open-source push notification service. Just install the ntfy app on your phone (Android/iOS), subscribe to a topic, and you're done. No account, no registration, no subscription required.

This project was developed and tested on a Honeywell Galaxy Flex 20. It is likely compatible with other Honeywell Galaxy panels, but this has not been verified.

If your Galaxy Flex notifications suddenly stopped working, or you are looking for a simple self-hosted alternative without installing a full home automation ecosystem, this project is for you.

IMPORTANT SECURITY NOTICE By default, the communication between the alarm panel and this server is unencrypted. This server is designed to be run on a trusted local network only. Please read the full Security & Privacy Guidelines before installation.

Features

• Self-Hosted: Runs on any local Windows or Linux machine (like a Raspberry Pi), or in a Docker container.
• Real-time Notifications: Instantly forwards alarm events to your devices.
• Prioritized Alerts: Uses ntfy.sh priorities to distinguish between urgent alarms and routine events.
• Advanced Notification Routing: Route notifications for different accounts to different ntfy.sh topics, each with its own optional authentication (Bearer Token or User/Pass).
• Robust Protocol Handling: Correctly parses the multi-message protocol used by Galaxy Flex panels.
• Broad SIA Level Support: The flexible parser can correctly handle event data from SIA Levels 0, 1, 2, and 3.
• Optional Heartbeat Server: Includes an optional server to handle the proprietary Honeywell "IP Check" heartbeat, with connection watchdog monitoring that sends notifications when a panel stops sending heartbeats.
• Connection Security Policies: Per-account ENABLED policy (Yes/No/Secure) and a configurable REJECT_POLICY (respond/drop) to control how invalid connections are handled.
• Protocol State Machine: Enforces correct SIA message ordering. Any connection that does not start with a valid ACCOUNT_ID is immediately rejected or silently dropped.
• Character Encoding Fixes: Decodes the proprietary character set used by Galaxy panels (e.g., Å, Ä, Ö).
• Highly Configurable: Most user settings are in a simple sia-server.conf file, with advanced protocol constants located in the galaxy/ directory.

Prerequisites

• A Honeywell Galaxy Flex alarm system with an Ethernet module (e.g., A083-00-10 or E080-4).
• A Linux or Windows machine on the same network as the alarm system (a Raspberry Pi running Raspberry Pi OS is perfect).
• Python 3.
• The python3-requests package and the optional python3-uvloop package (for Linux).

File Structure

The project is structured to separate the server logic, protocol parsing, and configuration.

.
├── sia-server.py           # The main server application
├── sia-server.conf         # Main user configuration file.
├── configuration.py        # Loads and validates all configuration.
├── notification.py         # Handles formatting and sending of notifications.
├── ip_check.py             # Optional subprocess for answering heartbeats.
├── sia_server_tester.py    # Test client for sending SIA packets to the server.
├── Dockerfile              # Docker container definition for portable deployment.
├── docker-compose.yml      # Docker Compose configuration for easy container management.
├── README.md               # This file.
├── PanelSetup.md           # Panel Configuration help.
├── requirements.txt        # Required python packages.
├── galaxy/
│   ├── __init__.py
│   ├── README.md           # Technical description of the protocol.  
│   ├── parser.py           # Handles parsing of the Galaxy SIA protocol.
│   └── constants.py        # Constants used in the SIA protocol.
└── asuswrt-merlin/
    ├── README.md           # Install instructions for Asuswrt-Merlin.
    ├── S99siaserver        # Entware service (init.d) file.
    └── check-sia.sh        # Watchdog script for Entware service.

Installation & Setup

This guide will walk you through the five main steps to get your server running.

Step 1: Download the Server Code

The recommended way is to download the latest stable release.

1. Go to the Releases page on GitHub.
2. Under the latest release, download the Source code (zip) file.
3. Unzip the file to your chosen directory (e.g., /home/pi/Scripts/sia-server on Linux or C:\siaserver on Windows).

For Developers: Cloning with Git

If you want the latest development code, you can clone the repository directly:

git clone https://github.com/ZebMcKayhan/SIA-Server.git sia-server
cd sia-server

Step 2: Install Python and Dependencies

This server requires Python 3. The installation steps are different for Linux and Windows.

For Linux (e.g., Raspberry Pi, Debian, Ubuntu)

1. Install Python (if needed): Most modern Linux systems come with Python 3 pre-installed. You can check with python3 --version. If you need to install it

   sudo apt update
   sudo apt install python3

2. Install Dependencies: Use apt to install the required packages. uvloop is an optional performance enhancement.

   sudo apt update
   sudo apt install python3-requests python3-uvloop

For Windows

1. Install Python: Download and install the latest Python 3 from the official Python website. Important: During installation, make sure to check the box that says "Add Python to PATH".
2. Install Dependencies: Open a PowerShell or Command Prompt. It is strongly recommended to use python -m pip to ensure you are installing packages for the correct Python interpreter.

   python -m pip install requests pyopenssl

   Note: The extra package pyopenssl are optional but recommended to avoid potential HTTPS/SSL errors when sending notifications from Windows.

Step 3: Get the Notification App and Topic

Before configuring the server, get the ntfy.sh app on your phone or computer.

1. Follow the instructions at the ntfy.sh documentation to get the app.
2. Inside the app, subscribe to a new topic. Choose a long, random, unguessable name for your topic to keep it private (e.g., alarm-skUHvisapP2J382MDI2).
3. You will use the full URL of this topic (e.g., https://ntfy.sh/alarm-skUHvisapP2J382MDI2) in the configuration file.

Step 4: Configure Your Alarm Panel

Log into your Galaxy Flex panel's installer menu and configure the Ethernet module. The numbers in parentheses are the menu codes for a Galaxy Flex 20.

• ARC IP Address: The IP of the machine running sia-server.py (e.g., 192.168.128.10). (Menu 56.1.1.1.4.1)
• ARC Port: The port for the [SIA-Server] and optionally the [IP-Check] server. (Menu 56.1.1.1.4.1)
• Protocol: SIA. Levels 0-3 are supported; Level 3 is recommended for the most detail. (Menu 56.1.1.1.4.2)
• Account Number: Your 4 or 6-digit alarm account number. SIA Level 3 requires 6 digits. (Menu 56.1.2.1.1)
• Encryption: Set to Off unless you have galaxy/encryption.py installed. (Menu 56.3.3.5)
• IP-Check: (Optional) To use the heartbeat feature, enable it by setting a time interval (e.g., 00:30 for 30 minutes). 00:00 means disabled. (Menu 56.3.3.7.1)
• Eng. Test: Use this to send a test notification without generating a fault. (Menu 56.7.1)

Step 5: Configure the Server

Edit the sia-server.conf file to match your setup. The file is pre-populated with examples to guide you.

# On Linux
nano /path/to/your/sia-server/sia-server.conf

On Windows, simply edit the file with a text editor like Notepad.

Configuration

For most users, only three things need to be changed in sia-server.conf:

1. Your account number and ntfy.sh topic — Add a section with your panel's account number and your ntfy.sh topic URL.
2. Port numbers — Match the ports you configured on the alarm panel.
3. Logging — Choose Screen for testing, or File with a path for permanent use.

Everything else works out of the box with sensible defaults.

Configuration Explained

The primary configuration is done in sia-server.conf. This file is designed to be user-friendly and not sensitive to Python syntax. Advanced, technical constants are located in galaxy/constants.py.

• Site Sections ([012345]): Each site is defined by a section where the header is the panel's unique Account Number.

  • SITE_NAME: A friendly name for the site (e.g., "Main House"). If omitted, the account number is used.
  • ENABLED: Controls the connection policy for this account. Accepts Yes, No, or Secure.
    • Yes — Accept all connections to this account (default).
    • No — Reject all connections from this account.
    • Secure — Only accept encrypted connections. Plaintext connections will be rejected. You will need to supply galaxy/encryption.py to enable encryption.
  • NTFY_ENABLED, NTFY_TOPIC, NTFY_TITLE: Configure notification delivery for this site.
  • NTFY_AUTH: Set to None, Token, or Userpass for private topics and provide the corresponding NTFY_TOKEN or NTFY_USER/NTFY_PASS keys.

• [Default] Section: A special section for events from account numbers not specifically listed.

• [SIA-Server] Section: Configure the ports and addresses for the main server.

  • REJECT_POLICY: Controls how invalid or unauthorised connections are handled. Accepts respond or drop.
    • respond — Send a SIA REJECT frame to the client (default).
    • drop — Silently close the connection without sending anything.

• [IP-Check] Section: Configure the ports and addresses for the optional heartbeat server.

  Note: The IP Check server validates all incoming heartbeat packets before responding. It verifies the packet length and header. Invalid packets are dropped.

  • WATCHDOG_THRESHOLD: Controls how many missed pings trigger a lost-connection notification. 2.1 means 2 missed pings + 10% buffer. Set to 0 to disable watchdog alerts entirely.
  • WATCHDOG_LOST_PRIO / WATCHDOG_RESTORE_PRIO: The ntfy.sh priority (1-5) for lost and restored connection notifications respectively.

• [Logging] Section: Control the log level and output destination.

  • LOG_LEVEL: Set the verbosity of logs (DEBUG, INFO, WARNING, ERROR). INFO is recommended for normal use.
  • LOG_TO: Choose Screen, File, or Syslog.
    • Screen is best for manual testing and standard systemd services.
    • File is best for creating a dedicated log file (e.g., on Windows or for cron jobs).
  • File-Specific Settings: LOG_FILE, LOG_MAX_MB, and LOG_BACKUP_COUNT are only used when LOG_TO = File.

Advanced Logging: Using LOG_TO = Syslog

Setting LOG_TO = Syslog integrates the server's logging with the native operating system logger. This is an advanced option recommended for embedded systems like routers.

• Log Format: When using Syslog, the server uses a simpler log format (SIA-Server: LEVEL - Message) because the syslog service adds its own timestamps and hostname.

• On Linux/Unix Systems:

  • The server will attempt to write to the standard /dev/log socket.
  • For non-standard systems, you can specify a different path with the optional SYSLOG_SOCKET key.
  • You can also change the syslog "facility" (which controls how the system syslogd categorizes the messages) using the optional SYSLOG_FACILITY key. Common values are daemon or local0 through local7. This can be useful for tailoring log filtering rules on your specific system.

• On Windows Systems:

  • This will log messages to the Windows Event Log under the "Application" section with the source name "SIA-Server".
  • Dependencies: This feature requires the pywin32 package. You must install it from an Administrator prompt: python -m pip install pywin32.
  • Permissions: The very first time you run the server with this option, it must be run as an Administrator to register the "SIA-Server" source in the Windows Registry. After that, it can be run as a normal user.
  • If either the dependency is missing or the registration fails due to permissions, the server will print a clear warning and automatically fall back to logging to the screen.

• [Notification] Section: Configures the server's resilient retry queue for handling network outages.
  • MAX_QUE_SIZE, MAX_RETRIES, MAX_RETRY_TIME control the queue and retry behavior.
  • PRIORITY_1 through PRIORITY_5: Assign SIA Event Codes to different priority levels.
  • DEFAULT_PRIORITY: The priority to use for any unlisted event code.

Usage

For Linux

Manual Start (for testing)

Note: It's convenient to set LOG_TO = Screen in sia-server.conf to see live events in your terminal.

cd /path/to/your/sia-server
python3 sia-server.py

Press Ctrl+C to stop.

Custom Configuration File Path

By default, the server looks for sia-server.conf in the current directory. You can specify a different path using the --config argument:

python3 sia-server.py --config /path/to/your/sia-server.conf

As a Service (Recommended)

Note: Set LOG_TO = File in sia-server.conf to keep a persistent log.

1. Create the Service File: sudo nano /etc/systemd/system/sia-server.service
2. Paste this content, changing the paths in WorkingDirectory and ExecStart.

   [Unit]
   Description=Galaxy SIA Alarm Server
   After=network.target
   [Service]
   Type=simple
   User=pi
   WorkingDirectory=/home/pi/Scripts/sia-server
   ExecStart=/usr/bin/python3 /home/pi/Scripts/sia-server/sia-server.py
   Restart=on-failure
   RestartSec=5s
   [Install]
   WantedBy=multi-user.target

   Note: You may need to add firewall rules (e.g., via ExecStartPre= & ExecStopPost=). If your firewall commands require root, you may need to remove or comment out the User=pi directive.

3. Enable and Start:

   sudo systemctl daemon-reload
   sudo systemctl enable sia-server.service
   sudo systemctl start sia-server.service

4. Manage:
   • Check status & recent logs: sudo systemctl status sia-server.service
   • Stop the service: sudo systemctl stop sia-server.service
   • Start the service: sudo systemctl start sia-server.service
   • Restart the service: sudo systemctl restart sia-server.service
   • View live logs: journalctl -u sia-server.service -f (if not logging to a file) or tail -f /path/to/your/log/file.log (if logging to a file).

For Windows

Manual Start (for testing)

Note: Set LOG_TO = Screen in sia-server.conf to see live events.

cd C:\path\to\your\sia-server
python sia-server.py

Note: If your network setting is set to public, instead of private, you may need to add a rule windows firewall to accept inbound connections on the port (i.e. 10000) you are using. Search online how to do this for your windows version.

Press Ctrl+C to stop.

Custom Configuration File Path

By default, the server looks for sia-server.conf in the current directory. You can specify a different path using the --config argument:

python sia-server.py --config C:\path\to\your\sia-server.conf

As a Service (Recommended)

Note: Set LOG_TO = File in sia-server.conf to keep a persistent log.

1. Download NSSM.
2. Open a Command Prompt as an Administrator.
3. Run the installer: C:\path\to\nssm.exe install SIA-Server
4. In the GUI that pops up:
   • Path: Browse to your Python executable (e.g., C:\Python312\python.exe).
   • Startup directory: Browse to your script folder.
   • Arguments: sia-server.py
5. Click Install service. You can now manage it from the Windows Services app (services.msc).

Using Docker

Prerequisites

• Docker and Docker Compose installed on your machine.

Setup and Start

1. Place your configured sia-server.conf in the same directory as docker-compose.yml.
2. Check that the ports in docker-compose.yml match the ports configured in sia-server.conf:

ports:
  - "10000:10000"   # Must match [SIA-Server] LISTEN_PORT
  - "10001:10001"   # Must match [IP-Check] LISTEN_PORT

3. Build and start the container:

docker compose up -d

4. The server is now running. To verify:

docker compose ps

View Logs

docker compose logs -f

Stop the Server

docker compose down

File Logging (Optional)

By default the server logs to screen, which is captured by Docker and visible via docker compose logs. If you prefer a persistent log file, set the following in sia-server.conf:

LOG_TO = File
LOG_FILE = /logs/sia-server.log

The log file will appear as ./logs/sia-server.log on the host machine. The ./logs directory will be created automatically by Docker if it does not exist.

Timezone

By default the container runs in UTC. Set your local timezone in docker-compose.yml:

environment:
  - TZ=Europe/London    # Change to your local timezone

Security & Privacy Guidelines

Please read these guidelines carefully.

1. Local Network Communication (Panel to Server)

The communication between your alarm panel and this server is unencrypted. Run it on a trusted local network (LAN).

Warning: Do not expose the server's listening ports directly to the public internet. If you must, use a VPN (e.g., WireGuard).

2. Notification Privacy (Server to ntfy.sh)

• Transport Security: Communication to ntfy.sh uses HTTPS and is secure.
• Topic Privacy: ntfy.sh topics are public by default. To secure them:
  • Use a long, unguessable topic name.
  • Consider a generic Site Name that cannot be linked to your address.
  • Alternatively: Subscribe to NTFY.sh PRO to setup private channels with authentication. This server fully supports authentication via the NTFY_AUTH settings.
  • Alternatively: Host NTFY yourself to be able to setup private channels free of charge (Requires a machine with public ip)

Disclaimer: You are ultimately responsible for securing your own setup.

Alternative Versions

Looking for a fully containerized setup with Apprise notification routing and MQTT integration? @claesmathias maintains a fork of this project with Docker Compose, Apprise and Mosquitto pre-configured.

Acknowledgments

• This project was developed through a collaborative effort with Anthropic's AI assistant, Claude.
• The initial socket server structure was inspired by the nimnull/sia-server project.
• Some protocol information was found in dklemm/FlexSIA2MQTT project.
• sia_server_tester.py was contributed by @claesmathias.

License

This project is licensed under the MIT License.