openWB EV Wallbox and Home Energy Manager

This lab explores the deployment and configuration of an intelligent electric vehicle charging and home energy management system using the open-source openWB platform. Students deploy the controller stack on a single-board computer running Linux and integrate it with DIN-rail electric vehicle supply equipment, bidirectional Modbus energy meters, switching contactors, and authentication hardware. Through hands-on integration, learners measure power flows, monitor IEC 62196 Control Pilot and Proximity Pilot signals, and implement dynamic load balancing alongside photovoltaic surplus solar charging algorithms. By completing the lab, students gain practical expertise in smart charging standards, industrial serial and network protocols like Modbus RTU, Modbus TCP, and MQTT, and the architectural principles governing modern distributed energy resources and microgrid power management.

electric vehicle supply equipment EVSE smart charging home energy management system HEMS photovoltaic surplus charging solar energy IEC 62196 dynamic load management Modbus RTU Modbus TCP MQTT Raspberry Pi single-board computer energy metering Control Pilot power electronics distributed energy resources

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: openwb_README.md · openwb_install.sh · openwb_requirements.txt

Readiness checks

  • complete 2026-09-03 02:17 🛡 Cybersecurity: Do not place on an open network · 11 findings 10 searches · 19 pages
    view · PDF

Latest report — 2026-09-03 02:17

Readiness: openWB EV Wallbox and Home Energy Manager

Verdict: Ready with caveats · 2026-09-03 · est. parts cost insufficient pricing (priced lines $105–$168 plus €235 for the meter; the EVSE DIN controller and the turnkey wallbox are unpriced) Cybersecurity — software & network: Do not place on an open network

Every part this lab needs can be bought today, and nothing on the bill of materials is unobtainable. The caveats are about where you buy, not whether you can. Four lines — the Raspberry Pi, the SD card, the power supply and the optional RFID reader — are ordinary retail items available from many sellers at commodity prices. The other four are European DIN-rail energy hardware, and each carries a wrinkle: the Phoenix Contact EVSE controller the lab's notes name as an example is now obsolete with zero stock at any authorized distributor; the EVSE DIN controller openWB actually sells, and openWB's own turnkey wallbox, are sold through small German shops whose listed prices could not be captured, so those two lines have no price on record; the Eastron meter is not carried by any authorized electronics distributor at all and is priced only in euros; and the Finder contactor, while active and in stock, is thin (12 units across two distributors) and its three-phase 400 V rating is not confirmed by the distributor data. This is the cold check — no previous report exists, so these figures establish the baseline that future checks will measure drift against.

Action required

Part Problem Recommended action
Phoenix Contact EM-CP-PP-ETH (2902802) Obsolete at DigiKey; 0 stock at DigiKey (13-week factory lead), Master Electronics (8-week lead) and Mouser; ECIA lifecycle risk High Do not design around this part. Use the Simple EVSE DIN with RS485 Modbus that openWB sells, or the EVSE WBDIN RS485 controller — both are what the openWB software is built around. See Substitutes for the Phoenix successor.
EVSE DIN charge controller (openWB / EVSE-WiFi) No price on record — both shop pages fetched fine but their price elements are not in the extracted text, and no distributor carries the part Request a quote from the shop before budgeting. The product is live and listed as delivered pre-configured.
Eastron SDM630 Modbus V2 meter Not carried by any ECIA-authorized distributor; only a EUR price is on record Order through a solar/metering reseller and budget import lead time and currency conversion.
Finder 22.34.0.230.4320 contactor Only 12 units across two authorized distributors; the 400 V phase-to-phase rating is not established by the distributor parametrics Fine for one or two charge points; order early for a class set. Confirm the 400 V three-phase rating on Finder's datasheet before wiring mains.
openWB series2 standard+ wallbox No price on record — the shop page's price element could not be extracted Request a quote from openWB directly. This is the alternative turnkey route, not a required part.

Cybersecurity — software & network

Do not place on an open network — The MQTT broker accepts anonymous connections on all interfaces and ships a published default administrator password, and the required Debian 11 platform stopped receiving security updates on 2026-08-31 — none of which can be fixed within the lab's own documented constraints.

Component Version How known Support status
Debian GNU/Linux 11 "Bullseye" / Raspberry Pi OS Lite 11 inferred (Required by the lab's documentation per the snapshot; the fetched install scripts install packages against whatever ${VERSION_CODENAME} is present rather than pinning a release.) unsupported since 2024-08-14
PHP 7.4 read from project (fetched openwb-install.sh lines 101-107 write the upload-limit ini into /etc/php/7.4/apache2/conf.d/ (falling back to /etc/php/7.3/).) unsupported since 2022-11-28
Apache HTTP Server 2 (with ssl, proxy_wstunnel, headers) not determined unpinned (fetched runs/install_packages.sh installs apache2 and libapache2-mod-php from apt with no version; fetched runs/setup_apache2.sh enables ssl and proxy_wstunnel.) —
Eclipse Mosquitto MQTT broker not determined unpinned (fetched runs/install_packages.sh adds repo.mosquitto.org as an apt source and installs mosquitto/mosquitto-clients unversioned.) —
openWB 2 application core not determined unpinned (fetched openwb-install.sh clones https://github.com/openWB/core.git --branch master; no tag or commit is pinned.) —
openWB prebuilt Raspberry Pi disk image not determined not determined (link.openwb.de/lateststableimage is a floating redirect to the current stable image; no version is stated and the redirect was not followed this run.) —
aiohttp 3.13.4 read from project (pinned in the fetched requirements.txt) —
pytest 8.4.2 read from project (pinned in the fetched requirements.txt) —
pymodbus 2.5.3 read from project (pinned in the fetched requirements.txt) —
umodbus 1.0.4 read from project (pinned in the fetched requirements.txt) —
paho_mqtt 1.6.1 read from project (pinned in the fetched requirements.txt) —
ocpp 1.0.0 read from project (pinned in the fetched requirements.txt) —
websockets 12.0 read from project (pinned in the fetched requirements.txt) —
cryptography 50.0.0 read from project (pinned in the fetched requirements.txt) —
evdev 1.5.0 read from project (pinned in the fetched requirements.txt) —
Component Finding Severity Fix available?
aiohttp The pinned aiohttp 3.13.4 — the HTTP and WebSocket client openWB uses to reach inverters, vehicle cloud APIs and OCPP endpoints — is affected by 14 published advisories, including an out-of-bounds heap read in its C HTTP response parser when a server returns a malformed chunked response. — GHSA-CQ5V-8Q36-5273, GHSA-4FVR-RGM6-GQMC, GHSA-63HW-FMQ6-XXG2, GHSA-G3CQ-J2XW-WF74 (+2 more) high No — project pins aiohttp==3.13.4 (fixes land in 3.14.0 through 3.14.3 and would need an upstream bump)
pytest pytest 8.4.2 ships in the same requirements file that is installed on the device and has a vulnerable temporary-directory handling issue; it is a test tool rather than something reachable over the network, so the practical risk here is low. — GHSA-6W46-J5RX-G56G moderate No — project pins pytest==8.4.2 (fixed in 9.0.3)
Apache HTTP Server 2 and Eclipse Mosquitto (TLS) Both the HTTPS web interface and the TLS MQTT listeners are configured with Debian's self-signed 'snakeoil' certificate, so nothing a browser or client connects to can be verified as the real charger and every user is trained to click through the warning. posture Mitigation only — install a certificate from your institution's CA, or keep the device off shared networks.
Debian APT packages (apache2, libapache2-mod-php, php, mosquitto) The entire network-facing stack is installed unversioned from apt on an operating system that no longer receives security updates, so no version could be checked and no fixes are coming. posture Mitigation only — track and patch these packages yourself, or move the lab to a supported OS image.
Debian GNU/Linux 11 "Bullseye" openWB requires Debian 11, whose standard support ended 2024-08-14 and whose extended LTS security support ended 2026-08-31, so the host operating system now receives no security updates at all — and openWB's documentation states newer Debian releases are not supported. posture No — requires platform migration
Eclipse Mosquitto MQTT broker The installer seeds the broker with a fixed administrator account 'admin' whose password 'openwb' is printed by the setup script and shipped as a hard-coded hash, and that account holds the dynsec-admin and full-access roles. posture Mitigation only — change the admin password immediately after installation, before the charger touches any network.
Eclipse Mosquitto MQTT broker The public MQTT listener on port 8883 and the public WebSocket listener on port 9002 are configured with no bind address and allow_anonymous true, so any host on the same network can connect to the charger's message bus without credentials. posture Mitigation only — isolate the charger on its own network segment and block ports 8883 and 9002 at the network boundary.
openWB 2 application core The installer creates the system user 'openwb' with unrestricted passwordless sudo (openwb ALL=(ALL) NOPASSWD: ALL) and sets no password for the account, so anything running as that user has full root on the device. posture Mitigation only — set a password for the openwb account and narrow its sudoers entry to the commands openWB actually needs.
openWB 2 application core Installation pipes a script downloaded from the master branch straight into bash and then clones master, so what lands on the device is whatever was in the repository at that moment, with no signature, tag or checksum verified. posture Mitigation only — review the install scripts and check out a release tag rather than master before running them on lab hardware.
openWB remote support and simpleAPI services The installer enables and starts openwbRemoteSupport.service and openwb-simpleAPI.service automatically, and the snapshot records that their listening ports are not stated anywhere in the sources. posture Mitigation only — disable openwbRemoteSupport and openwb-simpleAPI unless they are wanted, and port-scan the device before it joins a campus network.
PHP The web interface runs on PHP 7.4, which reached end of life on 2022-11-28 and has received no upstream security fixes since. posture No — requires platform migration

What this means for your lab

Treat this charger as an untrusted device on your network until you have hardened it. Out of the box its message bus accepts connections from anyone on the same network without a password, and it ships with a published administrator login (user 'admin', password 'openwb') that grants full control — so a student, a guest on the campus Wi-Fi, or anything else on that subnet could read the charger's live data and, with the published password, start and stop charging or change its settings. The operating system it requires, Debian 11, stopped receiving security updates on 31 August 2026, and the PHP version behind its web interface stopped in 2022, so neither will be patched again. The HTTPS certificate is self-signed, meaning nobody can tell a real charger from an impostor. Before you connect this to anything: change the MQTT admin password, set a password on the 'openwb' system account, turn off the remote-support service if you do not want it, and ask campus IT to put the charger on its own isolated network segment rather than the general campus network. None of this makes the lab unusable — it makes it a lab that has to live behind its own boundary.

Not checked

  • openWB prebuilt Raspberry Pi disk image: link.openwb.de/lateststableimage is a floating redirect with no stated version; there is no version to check.
  • openWB 2 application core (git master): Tracks a moving branch with no commit or tag pinned, and source-only projects have no advisory database.
  • Eclipse Mosquitto (version): Installed unversioned from the upstream apt repository; no version to look up.
  • Apache HTTP Server 2 (version): Installed unversioned from apt; no version to look up.
  • Debian system packages: Installed unversioned by the install script; individual package versions were not determined.
  • aiohttp (remaining advisories): The lookup reported 14 advisories for 3.13.4 but enumerated 6 IDs; the other 8 were not listed this run.
  • SSH exposure: The snapshot records that whether SSH is instructed or enabled is not stated in the lab's sources, and nothing fetched this run settles it.

Parts

Host platform

Part Spec/Package Status Stock Price Source
Raspberry Pi 3 Model B / B+ SBC, 85 × 56 mm; 5 V DC ≥ 2.5 A; 3.3 V 40-pin GPIO readily available multiple sellers $35.00 Mouser (also CanaKit, Newark at $35.00; eBay $29.00; B+ $40.00 PiShop USA, $52.59 Best Buy)
MicroSDHC / MicroSDXC card, 16 GB min Class 10 / UHS-I, 3.3 V readily available commodity $6.99 eBay — SanDisk Ultra UHS-I microSDHC (PNY Elite $8.53, Team $9.99, Centon $13.99, Kodak $16.99)
5 V DC power supply, ≥ 2.5 A Micro-USB 100–240 V AC in, 5 V ±5% out, ≥ 12.5 W readily available multiple sellers $4.99 eBay — Raspberry Pi 12.5 W Micro USB PSU; official 5.1 V 2.5 A 13 W $5.90 at Newark; UL-listed HQRP $13.95 at Best Buy

Charging hardware

Part Spec/Package Status Stock Price Source
EVSE DIN charge controller (openWB Simple EVSE DIN / EVSE-WiFi EVSE WBDIN) DIN-rail EN 50022; IEC 61851-1 Type 1/Type 2; CP ±12 V 1 kHz PWM, PP sense; RS485 Modbus pre-enabled (slave ID 1) readily available not stated not established openWB shop · EVSE-WiFi shop
Phoenix Contact EM-CP-PP-ETH (2902802) — named example only DIN-rail AC charge controller, Ethernet obsolete 0 at DigiKey, Master Electronics, Mouser $342.34 (last DigiKey price) DigiKey — Obsolete, 13-week factory lead; ECIA lifecycle risk High, supply-chain risk Med
Finder 22.34.0.230.4320 modular contactor DIN rail; 4PST-NO (4 Form A); 25 A contact rating; 230 VAC/DC coil; 250 VAC nom switching; −20 °C to +50 °C Active 4 (DigiKey) + 8 (Newark) $64.16 DigiKey (Newark $70.98); ECIA lifecycle risk Low, supply-chain risk Low

Metering and input

Part Spec/Package Status Stock Price Source
Eastron SDM630 Modbus V2 three-phase meter Four-module DIN rail; 3 × 230/400 V; 100 A direct; RS-485 Modbus RTU + pulse; MID B and D; self-supplied readily available (non-distributor channel) not stated €235,00 SolarTopStore; specs from the Eastron product page. No ECIA-authorized distributor lists this part number
USB RFID reader / keypad (optional) USB bus-powered; must appear as a Linux evdev input device readily available; evdev compatibility not verified multiple sellers $13.66 yarongtech.com — YARONGTECH MIFARE 13.56 MHz USB (also $24.69 newegg.com, SparkFun $29.95 at DigiKey, PRX-USB $59.99)
openWB series2 standard+ complete wallbox (alternative turnkey) IP-rated wall-mount station; 22 kW max, limitable to 11 kW; MID meter and type B RCD integrated; automatic 1↔3 phase switching available from the manufacturer not stated not established openWB shop

Substitutes

For part Substitute Differences Verified Judgment
Phoenix Contact EM-CP-PP-ETH (2902802) — obsolete Phoenix Contact CHARX SEC-3000 (1139022) — Active, $560.00, stock 2 at DigiKey Manufacturer's own named successor in the same AC charge-controller family, so the IEC 61851/62196 pilot-generation role is the same. Costs 64% more than the obsolete part's last price ($560.00 vs $342.34). The lab's binding constraint is that the controller be supported by openWB's communication interfaces, and the evidence says nothing about that. verified: lifecycle status, price and stock (DigiKey lookup this run); manufacturer-recommended-successor relationship (DigiKey substitute type "MFR Recommended"). Not verified: openWB driver/communication support; DIN module width and mounting; pilot signalling details — no parametrics block was returned and no datasheet was fetched. Plausible successor, not verified for this lab. For an openWB build the openWB/EVSE-WiFi DIN controller is better evidenced and far cheaper; the CHARX is the answer only if you are committed to Phoenix Contact hardware.
Finder 22.34.0.230.4320 — thin stock Finder 22.34.0.230.1320 — $64.16, stock 1 at DigiKey DigiKey lists it as a "Parametric Equivalent" with the same description text, "MODULAR CONTACTOR, 4PST-NO 25A". What the ".1320" versus ".4320" variant code encodes is not stated anywhere in the evidence. verified: manufacturer, description text, price and stock (DigiKey lookup this run). Not verified: lifecycle status, contact configuration, switching voltage, coil parametrics, footprint, and the meaning of the variant code. Unverified — a lead to check, not a drop-in. With one unit in stock it adds no meaningful supply depth anyway.

Verify any substitute against its datasheet before ordering — the comparisons above are made from distributor data, not from the manufacturer's full specification.

Other dependencies

  • PCB fabrication: none required. The lab has no custom printed circuit boards, Gerber files, drill files or schematic design files. Assembly is wiring commercial DIN-rail modules (controller, contactor, meter, power supply) inside an electrical enclosure, or deploying onto a prebuilt openWB wallbox.
  • openwb.de and openwb.de/shop — live. Two shop product pages were fetched successfully this run.
  • github.com/openWB/core — live. The repository root was listed this run (19 entries) and the master branch is active. This is the site the lab downloads from; what it serves is covered under Cybersecurity above.
  • Debian 11 Lite OS image archive (downloads.raspberrypi.org/raspios_oldstable_lite_armhf/images/raspios_oldstable_lite_armhf-2025-05-07/) — not checked. The archive URL was not fetched this run.
  • link.openwb.de/lateststableimage — not checked. The redirect was not followed this run.

Watch list

  • Phoenix Contact EM-CP-PP-ETH. Already obsolete with zero authorized stock; the remaining grey-market supply will only get worse and more expensive. Treat the line as closed.
  • Finder 22.34.0.230.4320. Twelve units across two distributors is one classroom order away from zero. If you need more than a couple, order early and confirm the 400 V three-phase rating on the datasheet first.
  • Raspberry Pi 3 Model B / B+. The lab is pinned to this generation because Debian 11 is hard to run on a Pi 5. As the 3B ages out of retail channels, prices will drift upward and the lab's OS constraint will become the binding problem rather than the board itself.
  • Eastron SDM630 Modbus V2. No authorized-distributor coverage means no lifecycle or supply-chain signal to watch — availability can change without warning, and only a euro price is on record.
  • The two unpriced lines (EVSE DIN controller, openWB series2 wallbox). Until a quote lands, this lab has no defensible total cost; getting one should be the first budgeting step.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

This lab deploys the openWB 2 ("openWB EV Wallbox and Home Energy Manager") energy management and EV charge controller software stack. The system controls electric vehicle supply equipment (EVSE) charge points, manages PV surplus solar charging, interfaces with grid meters and solar inverters via Modbus, and enforces dynamic multi-wallbox load balancing over a local IP network. The host hardware operates at low-voltage DC logic levels (typically 5 V DC power and 3.3 V GPIO logic for a Raspberry Pi single-board computer, or standard PC rails for x86_64 hardware), while the external power contactors and EVSE hardware controlled by the system switch and monitor single-phase or three-phase mains AC power (230 V / 400 V AC nominal, up to 16 A or 32 A per charging standard IEC 62196).

Bill of Materials and Hardware Platform

The sources for this lab contain software deployment manifests and architecture setup scripts, but do not provide custom PCB design files or circuit board Gerber files. openWB is designed to run on a host single-board computer (or virtual machine) interfacing with commercial DIN-rail hardware modules or turnkey wallbox assemblies. The hardware components required or directly supported by the documented deployment are captured below.

Host Single-Board Computer:

  • Identity: Raspberry Pi Foundation Raspberry Pi 3 Model B (or Raspberry Pi 3 Model B+)
  • Quantity needed: 1
  • Footprint/package: Single-board computer form factor (85 mm x 56 mm)
  • Electrical constraints: Regulated 5 V DC supply (minimum 2.5 A current capacity, 12.5 W); 3.3 V logic on 40-pin GPIO header.
  • Substitution latitude: Strongly recommended platform in documentation. Alternatively, any x86_64 host system (bare metal or virtual machine) is documented as supported. Raspberry Pi 5 is explicitly discouraged by the documentation because Debian 11 "Bullseye" requires significant manual effort to run on it.
  • Actuator/Control: None (fixed host platform).
  • Sourcing plan: retail shopping search: Raspberry Pi 3 Model B SBC

Host Storage Media:

  • Identity: MicroSDHC / MicroSDXC flash memory card (Class 10 / UHS-1 recommended)
  • Quantity needed: 1
  • Footprint/package: MicroSD card standard form factor
  • Electrical constraints: Supply voltage 2.7 V to 3.6 V (3.3 V nominal); capacity 16 GB minimum recommended for Debian OS Lite image and openWB runtime files.
  • Substitution latitude: Any MicroSD card compatible with the Raspberry Pi 3 SD card slot.
  • Actuator/Control: None.
  • Sourcing plan: retail shopping search: MicroSDHC card 16GB Class 10 UHS-I

Host Power Supply:

  • Identity: 5 V DC regulated power supply (Micro-USB connector or DIN-rail DC supply)
  • Quantity needed: 1
  • Footprint/package: External AC/DC wall adapter or DIN-rail mount power module
  • Electrical constraints: Input 100 V to 240 V AC; output 5 V DC +/- 5%, rated output current ≥ 2.5 A (≥ 12.5 W).
  • Substitution latitude: Any reliable power supply delivering clean 5 V DC at 2.5 A or higher to the Raspberry Pi.
  • Actuator/Control: None.
  • Sourcing plan: retail shopping search: Raspberry Pi 3 power supply 5V 2.5A Micro-USB

EVSE DIN Charge Controller:

  • Identity: IEC 62196 compliant DIN-rail EV charge controller (e.g. EVSE DIN, Phoenix Contact EM-CP-PP-ETH, SimpleEVSE, or Bender CC612)
  • Quantity needed: 1 (per wallbox charging outlet)
  • Footprint/package: Standard DIN-rail mount modular housing (EN 50022, 35 mm rail)
  • Electrical constraints: Operating voltage 230 V AC or 12 V DC depending on controller model; generates Control Pilot (CP) +/- 12 V 1 kHz PWM signal and senses Proximity Pilot (PP) per IEC 62196 standard; relay output contact to trigger charging contactor.
  • Substitution latitude: Any commercial EVSE controller module capable of standard IEC 62196 pilot generation and supported by openWB communication interfaces (Modbus RTU/TCP or direct pilot signal).
  • Actuator/Control: None during regular charging; set-once DIP switches on some modules for maximum current limit.
  • Sourcing plan: general web research: EVSE DIN rail charge controller IEC 62196

Mains Power Switching Contactor:

  • Identity: 4-pole modular AC contactor (for three-phase charging) or 2-pole modular AC contactor (for single-phase charging)
  • Quantity needed: 1 per charge point
  • Footprint/package: DIN-rail mount modular enclosure (EN 50022, typically 2-module or 4-module width)
  • Electrical constraints: AC-1 / AC-7a rating ≥ 20 A for 11 kW wallbox (or ≥ 32 A / 40 A for 22 kW wallbox); rated operational voltage 400 V AC (three-phase) / 230 V AC (single-phase); control coil voltage matched to EVSE DIN controller output (typically 230 V AC nominal).
  • Substitution latitude: Any certified DIN-rail contactor rated for continuous EV charging duty.
  • Actuator/Control: None.
  • Sourcing plan: distributor lookup (representative example — sources give spec only): Finder 22.34.0.230.4320

Grid / Solar Modbus Electricity Meter:

  • Identity: Bidirectional three-phase / single-phase DIN-rail electricity meter with RS-485 Modbus RTU or Modbus TCP (e.g., Eastron SDM630, Janitza, or compatible)
  • Quantity needed: 1 or more (for grid interconnection and EVSE energy measurement)
  • Footprint/package: DIN-rail mount enclosure (EN 50022)
  • Electrical constraints: Mains measuring voltage 3 x 230 / 400 V AC; current rating 63 A / 100 A direct measurement or current transformer (CT) inputs; Modbus RS-485 2-wire serial or Ethernet 10/100Base-TX interface.
  • Substitution latitude: Must be a model supported by openWB Modbus device drivers (evidenced by openWB's pymodbus and umodbus integration).
  • Actuator/Control: Pushbuttons on front panel for initial Modbus address and baud rate configuration.
  • Sourcing plan: general web research: Eastron SDM630 Modbus V2 three phase energy meter DIN rail

Linux Input Peripheral (RFID Reader or Keypad):

  • Identity: USB or serial RFID card reader / keypad / input button device
  • Quantity needed: 1 (optional, required when physical user authentication is deployed)
  • Footprint/package: Enclosure panel-mount or external USB dongle
  • Electrical constraints: 5 V DC USB bus-powered or 3.3 V logic interface; exposed as a standard Linux input event node (/dev/input/event*).
  • Substitution latitude: Any RFID reader or keypad that registers as an evdev-compatible Linux input device (relies on Python evdev).
  • Actuator/Control: RFID card presentation surface or user key buttons.
  • Sourcing plan: retail shopping search: USB RFID reader 13.56MHz 125kHz Linux evdev compatible

Commercial Complete Wallbox Unit (Alternative turnkey option):

  • Identity: openWB complete charging station (e.g. openWB series2 standard+, openWB custom, or openWB Pro)
  • Quantity needed: 1
  • Footprint/package: IP54/IP65 wall-mount charging station enclosure with integrated Type 2 charging cable or socket
  • Electrical constraints: 230 V AC (single phase) or 400 V AC (three phase), 16 A (11 kW) or 32 A (22 kW), 50 Hz.
  • Substitution latitude: Proprietary turnkey hardware sold by openWB GmbH & Co. KG via their online shop.
  • Actuator/Control: Type 2 EV plug/cable insertion, optional integrated touch display.
  • Sourcing plan: general web research: openWB series2 wallbox openwb.de shop

Software and network dependencies

Operating System / Host Platform Image:

  • Debian GNU/Linux 11 ("Bullseye") / Raspberry Pi OS Lite (Bullseye)
  • Source: https://downloads.raspberrypi.org/raspios_oldstable_lite_armhf/images/raspios_oldstable_lite_armhf-2025-05-07/
  • Version: "raspios_oldstable_lite_armhf-2025-05-07" (Debian 11 "Bullseye")
  • Where the version came from: stated in documentation (in openwb_README.md). The documentation explicitly states that newer Debian releases such as Debian 12 ("Bookworm") are not supported.
  • Version pinning: Pinned to specific release archive directory in documentation URL; bare apt repository updates within Bullseye are unpinned.
  • Check plan: support-status lookup: Debian 11

Prebuilt openWB Raspberry Pi Disk Image:

  • openWB Official Image for Raspberry Pi 3
  • Source: https://link.openwb.de/lateststableimage
  • Version: not stated
  • Where the version came from: not stated (redirect link pointing to latest stable binary release). Flashed using balenaEtcher.
  • Version pinning: Unpinned (tracking floating latest stable redirect).
  • Check plan: not checkable: unpinned redirect URL with unstated version

openWB Application Core Repository:

  • openWB 2 application core codebase
  • Source: https://github.com/openWB/core.git
  • Version: master branch (git commit hash not stated)
  • Where the version came from: stated in documentation and pinned in openwb_install.sh line 34 (git clone https://github.com/openWB/core.git --branch master).
  • Version pinning: Unpinned (tracks the active master branch).
  • Manifest location: openwb_install.sh line 34.
  • Check plan: not checkable: unpinned git branch tracking master

Remote Installation Bootstrap Script:

  • openWB remote package setup script
  • Source: https://raw.githubusercontent.com/openWB/core/master/runs/install_packages.sh
  • Version: master branch (not stated)
  • Where the version came from: stated in openwb_install.sh line 12 (curl -s "https://raw.githubusercontent.com/openWB/core/master/runs/install_packages.sh" | bash -s).
  • Version pinning: Unpinned (executes master branch script over raw curl).
  • Manifest location: openwb_install.sh line 12.
  • Check plan: not checkable: unpinned remote script

Web Server Stack (Apache HTTP Server & PHP):

  • Apache 2 web server with ssl and proxy_wstunnel modules enabled
  • Source: Debian 11 APT repository
  • Version: not stated (system default Apache 2 for Debian Bullseye)
  • Where the version came from: not stated
  • Version pinning: Unpinned (managed via Debian system package manager).
  • PHP Runtime: PHP 7.4 (or 7.3 if Buster), checked in openwb_install.sh lines 72-78 (/etc/php/7.4/apache2/conf.d/20-uploadlimit.ini).
  • Where the version came from: stated in documentation (openwb_install.sh lines 72-78).
  • Check plan: support-status lookup: PHP 7.4

MQTT Broker Services (Eclipse Mosquitto):

  • Public Mosquitto Broker and dedicated mosquitto_local service instance
  • Source: Debian 11 APT repository
  • Version: not stated
  • Where the version came from: not stated
  • Version pinning: Unpinned (system apt package).
  • Manifest location: openwb_install.sh lines 43-69.
  • Check plan: not checkable: version not stated

Pinned Python Library Dependencies: The Python application dependencies are defined in openwb_requirements.txt (installed in openwb_install.sh line 92 via pip install -r /var/www/html/openWB/requirements.txt). All 27 packages are explicitly pinned with exact versions:

  1. typing-extensions: version 4.13.2; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: typing-extensions / PyPI / 4.13.2
  2. jq: version 1.1.3; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: jq / PyPI / 1.1.3
  3. paho_mqtt: version 1.6.1; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: paho-mqtt / PyPI / 1.6.1
  4. pymodbus: version 2.5.3; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pymodbus / PyPI / 2.5.3
  5. pytest: version 8.4.2; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pytest / PyPI / 8.4.2
  6. requests_mock: version 1.9.3; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: requests-mock / PyPI / 1.9.3
  7. lxml: version 6.1.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: lxml / PyPI / 6.1.0
  8. aiohttp: version 3.13.4; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: aiohttp / PyPI / 3.13.4
  9. schedule: version 1.1.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: schedule / PyPI / 1.1.0
  10. PyJWT: version 2.13.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: PyJWT / PyPI / 2.13.0
  11. bs4: version 0.0.1; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: bs4 / PyPI / 0.0.1
  12. pkce: version 1.0.3; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pkce / PyPI / 1.0.3
  13. evdev: version 1.5.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: evdev / PyPI / 1.5.0
  14. cryptography: version 50.0.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: cryptography / PyPI / 50.0.0
  15. msal: version 1.37.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: msal / PyPI / 1.37.0
  16. python-dateutil: version 2.8.2; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: python-dateutil / PyPI / 2.8.2
  17. umodbus: version 1.0.4; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: umodbus / PyPI / 1.0.4
  18. pysmb: version 1.2.9.1; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pysmb / PyPI / 1.2.9.1
  19. pytz: version 2023.3.post1; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pytz / PyPI / 2023.3.post1
  20. grpcio: version 1.60.1; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: grpcio / PyPI / 1.60.1
  21. protobuf: version 5.29.6; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: protobuf / PyPI / 5.29.6
  22. ocpp: version 1.0.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: ocpp / PyPI / 1.0.0
  23. websockets: version 12.0; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: websockets / PyPI / 12.0
  24. pycarwings3: version 0.7.14; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pycarwings3 / PyPI / 0.7.14
  25. asyncio: version 3.4.3; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: asyncio / PyPI / 3.4.3
  26. passlib: version 1.7.4; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: passlib / PyPI / 1.7.4
  27. pysolarmanv5: version 3.0.6; pinned in openwb_requirements.txt; PyPI. Check plan: vulnerability lookup: pysolarmanv5 / PyPI / 3.0.6

Network Exposure and Security:

  • Network Connection: Host single-board computer joins local IP network (Ethernet or Wi-Fi; specific link interface is not restricted).
  • Web Server Exposure: Apache 2 listens on standard HTTP (port 80) and HTTPS (port 443). apache-openwb-ssl.conf is enabled with proxy_wstunnel proxying WebSocket traffic to local backend daemons (openwb_install.sh lines 79-88).
  • MQTT Exposure: Eclipse Mosquitto broker exposes "public secure and unsecure mqtt and ws listeners with acl files" (openwb_install.sh line 52). Local instance mosquitto_local runs concurrently under /var/lib/mosquitto_local.
  • Cryptographic Credentials: Uses default Debian snakeoil certificates (/etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/private/ssl-cert-snakeoil.key) mapped to /etc/mosquitto/certs/openwb.pem and openwb.key (openwb_install.sh lines 53-56).
  • User Permissions and Accounts: System user openwb is created and granted unrestricted, passwordless sudo rights in /etc/sudoers.d/openwb: openwb ALL=(ALL) NOPASSWD: ALL (openwb_install.sh lines 26-27). No default password is configured; the installer script logs: "if you want to use this installation for development, add a password for user 'openwb'" (openwb_install.sh line 113).
  • Remote Services: Installer enables and automatically launches openwbRemoteSupport.service, openwb-simpleAPI.service, and openwb2.service (openwb_install.sh lines 94-111). Remote listening ports for simpleAPI and remote support are not stated in the source scripts.
  • SSH: Instructed or enabled state is not stated in the sources.

Fabrication and External Resources