Homebridge NOAA Weather Plugin

Temperature and humidity sensors for HomeKit, powered by the free NOAA / NWS API. The plugin finds the observation station closest to your coordinates automatically, or you can point it at a specific station.

What's New in v1.9.x

• Kinder to NWS during outages. Adaptive polling no longer snaps back to the fastest rate while the API is failing, and refresh intervals are bounded so a misconfigured value can never turn into a continuous request loop (new in 1.9.2).
• Tighter HTTP hygiene. Error responses are now explicitly discarded so connections return to the keep-alive pool promptly in a process designed to run for months (new in 1.9.2).
• Verifiable releases, end to end. Every release ships a Sigstore-signed SBOM and SLSA build provenance generated by an isolated builder, alongside the existing npm provenance (new in 1.9.1).
• OpenSSF Best Practices badge. The project meets the passing criteria of the OpenSSF Best Practices program (new in 1.9.1).
• Survives offline starts. If the network is not up when Homebridge boots, station discovery retries automatically with a doubling backoff instead of staying inactive until a manual restart.
• Stale data is flagged. If a station stops reporting, the sensors are marked inactive in HomeKit after 2 hours instead of presenting old readings as current.
• Test suite. 77 tests, including randomized property-based tests of the parsing and clamping logic, run in every CI matrix cell.
• Hardened further. The redirect origin check runs before any response handling, CI runners enforce egress control, and polling gained jitter to be kinder to the free NWS API.

Recent releases brought Node 26 and Homebridge 2.x support, verifiable npm releases with provenance and SBOM, a hardened HTTP client, and a formal security policy. See CHANGELOG.md for full details.

Features

• Zero runtime dependencies. Built on native fetch; the published package contains only compiled plugin code.
• Automatic station discovery using the NOAA points and gridpoints APIs, cached for 30 days and retried with backoff when the network is down at boot.
• Adaptive polling that stretches the refresh interval up to 4x when readings are stable and snaps back on any change.
• Persistent readings. HomeKit shows the last known values immediately after a restart instead of blanks.
• Quality-controlled data. Readings that fail MADIS quality control are rejected, and temperatures reported in Fahrenheit or Kelvin are converted correctly.
• Stale-data detection. If the station stops reporting for 2 hours, the sensors are marked inactive in HomeKit so automations do not act on outdated readings.
• Verifiable releases. Published with npm provenance and a CycloneDX SBOM. See Security below.

Setup

1. No API key needed

The NOAA API is free and requires no registration. USA weather only.

2. Install

sudo npm install -g homebridge-weather-noaa

3. Configure

Use the settings UI under Plugins, Homebridge Weather NOAA, Settings, or add the platform to config.json directly.

| Setting | Key | Required | Default | Description | | ------- | --- | -------- | ------- | ----------- | | Latitude | latitude | Yes | none | Decimal degrees, for example 47.6204 | | Longitude | longitude | Yes | none | Decimal degrees, for example -122.3494 | | Refresh Interval | refreshInterval | No | 15 | Minutes between updates, minimum 5 | | NOAA Station ID | stationId | No | auto | Overrides discovery, for example KSEA | | Adaptive Polling | adaptivePolling | No | true | Slows polling while readings are stable | | Contact (User-Agent) | userAgentContact | No | none | Email or URL added to the NOAA User-Agent header so NWS can reach you about API issues |

Example config.json entry:

{
  "platform": "NOAAWeather",
  "name": "NOAA Weather",
  "latitude": 47.6204,
  "longitude": -122.3494,
  "refreshInterval": 15
}

The example coordinates are the Space Needle in Seattle, WA.

4. Run

Two accessories appear in HomeKit under "NOAA Weather":

• NOAA Temperature
• NOAA Humidity

Notes

• Data comes from the NOAA observation station nearest your coordinates.
• Per the NWS documentation, observations can lag up to 20 minutes due to quality-control processing, so refresh intervals shorter than 15 minutes provide diminishing value.
• HomeKit stores temperature in Celsius internally; iOS displays Fahrenheit automatically based on your region.
• Cache files live in the Homebridge persist path with owner-only permissions (0o600).
• Running the plugin as a child bridge is supported and recommended, as it is for any plugin: it isolates the plugin in its own process so an issue in one plugin cannot affect another.

Security

This project aims to be a best-practice example of a secure Homebridge plugin. Every release can be verified independently:

• npm provenance. Packages are published from GitHub Actions via trusted publishing, with a Sigstore attestation linking the tarball to its source commit. Verify with npm audit signatures.
• SBOM. A CycloneDX software bill of materials is attached to every GitHub release.
• Pipeline protections. CodeQL analysis, dependency review, lockfile linting, SHA-pinned actions, and branch protection on every change.
• OpenSSF Scorecard. An independent, continuously updated audit of this repository's security posture, published as a public badge above.
• OpenSSF Best Practices badge. The project meets the passing criteria of the OpenSSF Best Practices program for FLOSS development.
• Signed releases. The SBOM on each release carries a Sigstore signature, and new releases include SLSA build provenance generated by an isolated builder, so release artifacts are verifiable end to end.

Found a vulnerability? Please report it privately via the security policy. Reports are acknowledged within 48 hours.

Compatibility

| Requirement | Supported versions | | ----------- | ------------------ | | Node.js | 18, 20, 22, 24, 26 | | Homebridge | 1.8+, 2.x |

Every release is CI-tested across all fifteen Node and Homebridge combinations before it ships.

License

MIT