Build it yourself: Octopus, Powerwall and Zappi on Node-RED

Three flows run on one always-on box. The Octopus flow works out the energy mode every minute; the Powerwall and Zappi flows act on it and talk to their own cloud APIs. The only way in from the internet is a Cloudflare Tunnel that carries Tesla's sign-in and key check.

What you need

Running costs are small: the Cloudflare Tunnel and Telegram are free, and polling the Tesla Fleet API every 10 minutes is about 4,300 data requests a month, which fits inside Tesla's monthly credit for personal use. Tesla's prices can change, so check the developer dashboard after the first week.

Data and secrets map

Every value the build needs, where it lives and whether it must be kept secret. The values shown are examples or placeholders; none are real. The rule throughout: secrets never go in a flow or a comment, because both are exported as plain text.

Node-RED stores credential-type values encrypted in flows_cred.json. They are not included when you export a flow, so re-enter them after any import.

Step 1: prepare the Node-RED box

The box runs Node-RED as root, as a system service, with three changes to settings.js.

1. Install Node-RED with the official script and enable it at boot:

bash <(curl -sL https://github.com/node-red/linux-installers/releases/latest/download/update-nodejs-and-nodered-deb)
systemctl enable nodered

2. Edit /root/.node-red/settings.js and set these three things:

// let function nodes load built-in modules (fs, crypto)
functionExternalModules: true,

// keep flow/global context on disk, so Zappi history survives restarts
contextStorage: {
    default: { module: "localfilesystem" }
},

// password-protect the editor
adminAuth: {
    type: "credentials",
    users: [{ username: "admin", password: "<hash from: node-red admin hash-pw>", permissions: "*" }]
},

3. Restart with systemctl restart nodered and open http://192.168.1.50:1880.
4. Create the private folder the Tesla flow uses:

mkdir -p /data/tesla && chmod 700 /data/tesla

If Node-RED runs as a user other than root, chown -R <that user> /data/tesla.

Step 2: domain and Cloudflare Tunnel

Tesla must reach two things on your own domain over HTTPS: a public key file and a sign-in callback. A Cloudflare Tunnel gives the box a public HTTPS name without opening any router ports, and Cloudflare issues the certificate automatically.

Pick a subdomain without the word "tesla" in it, because Tesla's portal rejects those. This guide uses energy.example.co.uk. Your main website on the same domain is not affected.

1. In Cloudflare go to Networking → Tunnels → Create Tunnel, name it (e.g. nodered-home), choose Debian and your architecture.
2. On the box, install cloudflared:

mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | tee /etc/apt/sources.list.d/cloudflared.list
apt-get update && apt-get install -y cloudflared

3. Connect it to the tunnel without copying the token by hand:

cloudflared tunnel login        # open the printed link, pick your domain, Authorise
cloudflared service install $(cloudflared tunnel token <TUNNEL_ID>)
systemctl enable cloudflared && systemctl status cloudflared   # active (running)

4. In the tunnel's Routes, add a Published application:

The path filter is the security boundary: only those three addresses reach Node-RED, and everything else, including the editor, gets a 404. Don't use /auth/... paths, because Node-RED uses /auth/login for its own admin login.

Check from any browser: https://energy.example.co.uk/ should return 404 with a valid padlock.

Step 3: Telegram bot

1. In Telegram, message @BotFather, send /newbot and follow the prompts. Keep the token it gives you; it's a secret.
2. Send any message to your new bot, then open https://api.telegram.org/bot<TOKEN>/getUpdates in a browser and read chat.id. That's your chat ID.
3. You'll paste the token and chat ID into the Tesla config.json (step 5) and the Octopus tab (step 4). The Zappi flow sends through the Tesla tab's telegram link, so it needs neither.

If a token is ever exposed, send /revoke to @BotFather and update both places.

Step 4: Octopus Energy flow

Install this flow first: the Powerwall and Zappi flows read the state it publishes.

1. In Octopus, go to Account → Personal details → API access and copy your API key.
2. In Node-RED: ☰ → Import, then select octopus-energy.json, then Import.
3. Double-click the Octopus Energy v3 tab and fill in its Environment variables:

4. Optional: Insights Hub. Set the three asset IDs and the aspect name in the Insights Hub requests node. Make sure your Insights Hub auth flow keeps global.access_token and global.url up to date. Without it the flow still runs, but it skips the Insights Hub writes.
5. Disable any older Octopus tab, then Deploy.

To check it's working:

• Output 1: state shows a status such as normal/day 26.52p→16.08p @16:00 within a minute.
• List products in section F returns data.
• At 20:00 the outlook arrives on Telegram.

Never paste the API key into a comment node, even temporarily. Comments are exported in plain text.

Step 5: Tesla Powerwall flow

5a. Create the Tesla developer app

At developer.tesla.com, create an app and set:

The tunnel from step 2 must already be live: Tesla checks the domain has a valid certificate before it accepts it. UK accounts use the EU region.

5b. Keys and config on the box

cd /data/tesla
openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem
openssl ec -in private-key.pem -pubout -out com.tesla.3p.public-key.pem
chmod 600 private-key.pem && chmod 644 com.tesla.3p.public-key.pem

Create /data/tesla/config.json, entering the secrets without them showing on screen:

read -rsp "Tesla client secret: " CS; echo
read -rsp "Telegram bot token: " BT; echo
LK=$(openssl rand -hex 24)
cat > /data/tesla/config.json <<EOF
{
  "client_id": "YOUR_TESLA_CLIENT_ID",
  "client_secret": "$CS",
  "redirect_uri": "https://energy.example.co.uk/powerwall/callback",
  "partner_domain": "energy.example.co.uk",
  "audience": "https://fleet-api.prd.eu.vn.cloud.tesla.com",
  "auth_base": "https://auth.tesla.com/oauth2/v3",
  "token_url": "https://fleet-auth.prd.vn.cloud.tesla.com/oauth2/v3/token",
  "scope": "openid email offline_access energy_device_data energy_cmds",
  "site_id": "YOUR_ENERGY_SITE_ID",
  "login_key": "$LK",
  "telegram": { "bot_token": "$BT", "chat_id": 0 },
  "billing_day": 1,
  "tariff": {
    "standing_charge_per_day": 0.55,
    "import": { "default": 0.21, "bands": [{ "from": "16:00", "to": "19:00", "rate": 0.28 }] },
    "export": { "default": 0.15, "bands": [{ "from": "16:00", "to": "19:00", "rate": 0.28 }] }
  }
}
EOF
unset CS BT; chmod 600 /data/tesla/config.json
echo "Login link: https://energy.example.co.uk/powerwall/login?k=$LK"

Then edit client_id, chat_id, billing_day and your real tariff rates with nano. Keep the login link in a password manager. If you don't know your site ID yet, set site_id to "0" for now (a YOUR_ value stops the config loading) and fix it in step 5d.

5c. Import and register

1. Import tesla-powerwall.json, disable any older Tesla tab, and click Deploy. Apply config turns green.
2. Check https://energy.example.co.uk/.well-known/appspecific/com.tesla.3p.public-key.pem shows your public key.
3. In section 10 · One-off setup:
   • Click 1 · Get partner token.
   • Click 2 · Register partner domain. You should get HTTP 200 and a public_key starting 04.
   • 3 · Verify may return 403 on personal accounts. That's harmless.

5d. Sign in once

1. Open the login link, sign in with Tesla, and allow energy information and energy control. You land on "Tesla account linked" and get a Telegram message.
2. Click Products to find your energy_site_id. Put it in config.json, then Deploy.
3. Click Today now. A summary should arrive on Telegram.

Without the right ?k= key the login link answers 403, so nobody else can link their own Tesla account in place of yours. After this, the flow refreshes its tokens itself.

Step 6: Zappi flow

1. In the myenergi app or account portal, generate an API key for your hub (the menu wording changes between app versions). Note your hub serial.
2. Import zappi.json and disable any older Zappi tab. Two copies would both switch the charger.
3. Double-click the myenergi API node, then Use authentication → Digest:
   • Username: your hub serial (or the Zappi serial if you have no hub).
   • Password: your API key.
4. Double-click the tab and set the environment variables:
   • ZAPPI_SERIAL: the serial on the Zappi.
   • MYENERGI_SERVER: the server your account uses, for example s18.myenergi.net.
5. Make sure something sets global.home to HOME when you're home and anything else when you're away. This is usually a phone presence flow. After a restart, the Zappi waits for it rather than guessing.
6. Deploy.

To check it's working:

• Within 10 seconds, Parse status shows something like Eco+ · EV connected · 0 kW.
• Tap the Stop inject: the charger switches, then hands back to the schedule after 3 hours or when you press Clear override.

The daily summary is sent on the zappi-summary link. Wire it to Telegram if you want it.

Step 7: start on boot and final tests

systemctl enable cloudflared nodered
systemctl list-unit-files | grep -Ei 'node-?red|cloudflared'   # both: enabled

Before you call it done:

• Editor password set (adminAuth)
• Older tabs disabled or deleted
• Login link saved in a password manager
• No keys in any comment node

How it runs

Every minute the Octopus flow sets one mode, and the Powerwall and Zappi act on it. They react straight away through the Octopus mode change link, and re-check on their own timers in case a message is missed.

The modes are checked in that order, so powerdown beats free. The Zappi also has a manual override, which comes before everything else for 3 hours. When a free or power-down period ends, the Powerwall puts back the reserve and grid-charging setting it had before, even if Node-RED restarted in between.

Schedule

All times are UK time and follow the clock changes.

Storage, power cuts and security

After a power cut the whole system recovers on its own: no sign-in, no clicks. Both services start at boot, each flow reloads what it saved, and Telegram says the system is back.

Security model

• Nothing is exposed except three paths. The tunnel lets through only the public key, the login link and the callback. The editor and all other paths return 404 from outside, and the editor has a password on the LAN.
• The login link is keyed and single-use per sign-in. Without the long ?k= key it returns 403, and each sign-in carries a random check value that expires after 10 minutes.
• No secrets in flows or comments. Keys live in config.json (mode 600), credential-type environment variables, or node credentials. A flow can be exported, shared or backed up without leaking anything.
• A pre-commit check. If you keep the flows in git, run a scanner for key-shaped strings (sk_live_, ta-secret., bot tokens, JWTs, private keys) before every commit.
• If a key leaks, rotate it. Octopus: regenerate the API key. Tesla: rotate the client secret. Telegram: /revoke with @BotFather. myenergi: generate a new API key. Login link: change login_key and Deploy.

Troubleshooting

Lessons learned

• No "tesla" in the domain. Tesla's portal rejects it outright.
• Certificate before portal. Tesla checks HTTPS on the domain when you save the allowed origin.
• Node-RED owns /auth/. Its admin login lives there, so use your own prefix such as /powerwall/.
• UK Tesla accounts are in the EU region. The North America endpoints give confusing errors.
• Save the new refresh token first. Tesla's refresh tokens are single use; losing the new one means signing in again.
• Write state atomically. A plain file write interrupted by a power cut leaves a corrupt file; temp file, fsync and rename doesn't.
• Credentials don't travel with exports. Re-enter them after every import, and never park a key in a comment "for later".
• Let Octopus define peak. Working out bands from the actual prices copes with tariff changes and clock changes; fixed times are only a fallback.
• Only one copy of each flow enabled. Two copies fight over the same charger or the same URLs.
• Poll gently. Tesla bills data requests and limits energy sites to one every five minutes, plus about five settings changes a day.

Sources

• Tesla Fleet API documentation
• Tesla Fleet API energy endpoints
• Tesla Developer pricing
• Fleet API partner endpoints (Postman collection)
• Cloudflare Tunnel routing