MyActiveTask: user guide

What MyActiveTask does

MyActiveTask runs automations. An automation watches a set of conditions: the Wi-Fi you are connected to, the time, the battery, a Bluetooth device, a place, a message from your smart home and others. When the conditions become true it runs one list of actions, called on enter. When they stop being true it runs a second list, called on exit.

The case it was built for is a VPN to your own server. When the phone leaves your home Wi-Fi, the app sends a "knock": one encrypted packet that makes your server open its VPN port for your phone. Then it starts OpenVPN and waits until the tunnel is up. When you come home it stops the VPN again. The knock uses fwknop, a program for Single Packet Authorization (SPA), which must run on your server.

The same engine does other things: call a webhook when the car's Bluetooth connects, switch Do Not Disturb on at work, play internet radio on a speaker, wake a PC when you arrive.

First steps

1. Open Setup (the gear icon on the main screen) and grant the permissions it lists under "Needs attention".
2. Create an automation with the + button, or tap New from template for a ready-made one.
3. Start the automation service. The main screen offers a button for it while the Master switch is on, and Setup has one too. The service runs in the background and does the watching; a permanent notification shows that it is running.

The main screen lists your automations. Each one shows whether it is active, has its own on/off switch, and a menu with Snooze, Duplicate, Share and Delete. The icons at the top open Help, Status and Setup; the three-dot menu opens SPA targets, the Condition simulator, Trusted networks, the MQTT broker settings, and the About, Change log, Privacy policy, EULA and Open-source licenses screens.

How an automation works

An automation has conditions and two lists of action steps. The background service compares the conditions with the state of the phone all the time.

• Active and inactive. When the conditions become true and stay true for the debounce time, the automation becomes active and its on-enter steps run. When they stop being true, again after the debounce time, it becomes inactive and its on-exit steps run.
• Debounce. A short wait (10 seconds unless you change it) before a change counts. Walking past the edge of your Wi-Fi then does not switch the VPN on and off. A change that reverts within the wait is dropped.
• Master switch. Off pauses everything. Whatever was active runs its on-exit steps first, so nothing is left half done.
• Per-automation switch and snooze. Each automation can be switched off on its own, or snoozed for 1 hour or 8 hours; it resumes by itself.

Steps run in order. A step can retry after a failure, with a short pause in between. If a step of the on-enter list still fails, the list stops there, the reason is written to the log and you get a notification. The on-exit list is cleanup: a failed step is reported, and the remaining steps still run.

Conditions and OR groups

Within one group every enabled condition must hold. An automation can have several groups, and it is active when any one group is fully met.

Most automations need one group. For alternatives, tap Add OR group in the editor and put a second set of conditions there. Example: "(on a trusted network and between 18:00 and 23:00) or (weekend and charging)" is two groups.

Each condition has a switch. A condition that is switched off is skipped and shown struck through, which is handy while testing.

The Live status card in the editor shows each condition with a tick or a cross and the value the phone has now, for example "SSID in HomeNet ✗ · now: CafeNet". So you see why an automation is active or not.

The conditions, one by one

Some notes:

• On a Wi-Fi whose name the app cannot read, "not in" and "Untrusted net" are not true either. Otherwise a missing permission would look like being away from home, and the VPN would start at home.
• Time windows open and close by an alarm that Android may delay by a few minutes while the phone sleeps deeply.
• The position for a geofence is read only while an enabled automation has a geofence condition. It comes from Android's network-based location and is refreshed about every five minutes.
• A ping (no port given) is unreliable on many devices. Name a port, such as 22, 80 or 445, for a dependable check.
• For a Bluetooth condition, connect the device and look for the line "Bluetooth:" in the Status log; it shows the exact names to copy.

The action steps, one by one

Some notes:

• "Healthy" in a Wait until step means that the VPN is connected and the VPN health probe host answers through the tunnel. Without a probe host it means connected, and the Wi-Fi or mobile network underneath reaches the internet.
• An HTTP step counts as done when the server answers with a status from 200 to 299. Redirects are not followed; enter the final address.
• "Trust self-signed certificates" on an HTTP step lets it talk to a device on your own network whose HTTPS certificate no authority has signed. It applies to that one request only.
• Launch app and Open URL can start another app while MyActiveTask is in the background only with the permission "Display over other apps". Without it the step fails and says so.
• Audio steps need Do Not Disturb access; the wireless debugging step needs a permission granted once from a computer. Both are explained under Permissions and setup.
• Two automations that start the same VPN share it: it is stopped only when the last of them has run its stop step.

Debounce, cooldown and run once

Three settings per automation control timing:

• Debounce (seconds). How long the conditions must hold before a change counts.
• Cooldown (minutes, 0 is off). After the on-enter steps have run, they do not run again for this many minutes. The automation still becomes active; if it is still active when the cooldown ends, the held-back steps run then. On exit is never held back. Good for a condition that flickers.
• Run once. The on-enter steps run a single time and are then skipped: "Once per day" allows them again each day, "Once ever" runs them exactly once until you change the setting. On exit still runs as usual. Good for "open this app when I get home, then leave me alone".

The automation editor

The editor holds everything about one automation:

• Name, Debounce, Cooldown, the switches "Re-knock on network change" and "Reconnect VPN if it drops or stalls", and Run once.
• Live status, with the tick or cross for each condition.
• Warnings, hints that do not stop you from saving: a knock that points at a deleted target, a wait for a VPN that no step starts, a VPN started on enter and never stopped on exit, an unencrypted http:// address, a time window that starts and ends at the same minute, a placeholder that a template left in.
• Conditions, with Add OR group.
• On enter and On exit, the two step lists. Arrows change the order; each step has a switch, and a play button that runs just that step.
• Run enter now and Run exit now run a whole saved list at once. The result of each step appears below as "Last test run".
• Diagnose connection, a staged check for a VPN automation (see Testing).
• Recent activity, the last times this automation was entered and left.

Leaving with unsaved changes asks whether to discard them.

"Re-knock on network change" is on for a new automation. When the phone moves from Wi-Fi to mobile data, or to another network, while the automation is active, the knock and VPN steps run again, so that the server opens the port for your new address. Notifications, webhooks and app launches are not repeated.

Ready-made templates

"New from template" offers five automations. Each is created switched off, so you can fill in your own values first.

• VPN on untrusted Wi-Fi: knock, start the VPN and wait for it on any network that is not in your list of home Wi-Fi names; stop the VPN at home.
• VPN off trusted networks: the same, using the shared list of trusted networks, and waiting until the VPN is healthy.
• Do-Not-Disturb at work: Do Not Disturb while connected to a Wi-Fi you name; the ringer back to normal when you leave.
• Wake my NAS at home: a Wake-on-LAN packet when you arrive on a trusted network.
• Silence at night: silent from 22:00 to 07:00, normal in the morning.

Port knocking: SPA targets

An SPA target describes your fwknop server, so that a knock can open a port on it. The list is under the three-dot menu on the main screen.

A target has a name, the host or public IP address, the SPA port, the access string (which port to open, for example udp/1194), a user name, and two keys in base64: the key and the HMAC key.

Allowed IP says which address the server should open the port for:

• Source sends 0.0.0.0, and the server uses the address the packet came from. This is the default and suits mobile networks. It needs an fwknop server that does not insist on an address inside the packet.
• Resolve first asks the service api.ipify.org for the public IP address of your connection and puts that into the knock.
• Explicit sends a fixed address you type.

Importing from a QR code. fwknop can show its client settings as a QR code. "Scan QR" reads it with the camera, "QR image" reads it from a saved picture. A chip then lists the fields that were found. The same field names as in an fwknop client file are understood.

Test knock sends one packet right away, so you can check on the server that the port opened.

The app sends the knock over UDP, encrypted with AES-256 in CBC mode and signed with HMAC-SHA256, in the format of an fwknop access request.

OpenVPN

The VPN steps control a separate app, OpenVPN for Android (package de.blinkt.openvpn), not OpenVPN Connect. Install it and import your .ovpn profile there once.

Authorize once. In Setup, tap "Authorize OpenVPN control". Two questions follow: OpenVPN for Android asks whether MyActiveTask may control it, and Android asks for the VPN permission. Without this the VPN steps fail.

In an automation. A VPN step names a profile by the name it has in OpenVPN for Android. Put a start step in on enter and a stop step in on exit. A "Wait until VPN healthy" step after the start confirms that the tunnel carries traffic, if you have set a probe host.

Reconnect VPN if it drops or stalls. This switch is per automation and off unless you turn it on. If the VPN that the automation started is reported as disconnected while the automation is still active, the app waits a few seconds, then knocks and connects again. A VPN that OpenVPN paused by itself, for example with the screen off, is left alone.

Stalls and the VPN health probe. A tunnel can stay "connected" and carry nothing. Android cannot see that. To detect it, enter a VPN health probe host and port in Setup: a machine that can be reached only through the tunnel, such as a NAS behind the VPN server. While an automation with the reconnect switch holds the VPN, the app opens an empty TCP connection to that host through the tunnel once a minute. When the host has answered before and then stays silent for about three minutes, the app reconnects. Without a probe host only a reported drop is repaired.

A manual Stop VPN, from the notification or the Status screen, is respected: nothing reconnects until a VPN automation next becomes active. Stopping the automation service leaves the tunnel as it is.

Variables in texts

In the address, headers and body of an HTTP step, in an Open URL address, a notification text and the topic and payload of an MQTT publish step you can write placeholders. They are replaced with the phone's values at the moment the step runs:

${SSID}, ${CONN_TYPE}, ${INTERNET}, ${BATTERY}, ${CHARGING}, ${BT_DEVICES}, ${LATITUDE}, ${LONGITUDE}, ${TIME}, ${DAY}, ${TIMESTAMP}.

Example of a webhook body: {"net":"${SSID}","batt":"${BATTERY}"}.

The name of a Wi-Fi is chosen by whoever runs it, so each value is made safe for the place it lands in: encoded in an address, stripped of line breaks in a header, escaped inside a JSON body, stripped of wildcards in an MQTT topic. To choose yourself, write ${SSID|json}, ${SSID|url} or ${SSID|raw}. A placeholder the app does not know is left as it is.

Latitude and longitude are filled in only while a geofence condition is in use; otherwise they are empty.

MQTT

MQTT is a messaging protocol used by smart-home systems such as Home Assistant and Node-RED. Enter your broker under "MQTT broker": host, port, TLS on or off, and a user name and password if the broker wants them. A client ID is made up for you if you leave it blank.

• The MQTT condition is true when the latest message on a topic equals, does not equal or contains a value. Wildcards work: + for one level, # for the rest. The app subscribes only to the topics your conditions use.
• The MQTT publish step sends a payload to a topic.

Without TLS the user name and password travel unencrypted, and the screen warns you. Use TLS unless the broker is on a network you trust.

Trusted networks

One shared list of the Wi-Fi names you count as home or work. The conditions "Trusted net" and "Untrusted net" read this list, so every automation agrees on what "home" means and you type the names once. While connected, "Add current Wi-Fi" adds the network you are on.

Testing and finding out why

• Live status in the editor: each condition with its tick or cross and the current value.
• Condition simulator, in the three-dot menu of the main screen: set values that are not real, such as another Wi-Fi name or 15 % battery, and see for each automation whether it would become active, condition by condition. It runs nothing.
• Run enter now / Run exit now in the editor: run a real list and read the result of each step.
• Test a step: the play button on a step runs only that step.
• Diagnose connection in the editor: checks a VPN automation stage by stage: OpenVPN for Android installed, the host names of the SPA targets found, the on-enter list run, the tunnel connected, traffic through the tunnel. Each stage is marked passed or failed; after a failure the later stages are skipped. It runs the real list, so it does knock and connect. The last stage tests the tunnel itself only if a VPN health probe host is set; without one it can only tell whether the network underneath reaches the internet, and says so.
• Status screen: the service, the network, the VPN, the health probe, the active automations and MQTT, each with the time since it has been that way, what it was before and what caused the change. Below are a warning when the network has no internet access (usually a sign-in page), Connect VPN and Stop VPN buttons if one of your automations starts the VPN, and "Recently triggered" with the latest activations, exits and failures.
• Status log: every change with its cause, and for an automation the condition that flipped. Chips narrow the list to status changes, problems or one area. The log can be shared as a text file and cleared. It holds the latest 1000 entries in memory and starts empty when the app is restarted.

Notification, tiles, shortcuts and triggers from other apps

• The notification of the service shows how many automations are active and has the buttons Pause, Pause 1h and Stop VPN.
• Quick Settings tiles: "Automation" is the master switch, "Pause 1h" pauses everything for an hour. On Android 13 and newer, Setup has buttons that add them; on older versions add them in the Quick Settings edit panel.
• Launcher shortcuts: press and hold the app's icon for shortcuts that run the on-enter list of your first automations. A shortcut you pinned to the home screen is greyed out when its automation has been deleted.
• External triggers: off unless you switch them on in Setup. Then Tasker, an NFC tag app or adb can start an enabled automation by name, by sending a broadcast to this app that carries the secret token shown in Setup. "Copy trigger details" copies everything the other app needs, and "Generate a new token" replaces the token. An automation that is switched off or snoozed refuses, triggers are ignored while the service is stopped, and refused triggers appear in the Status log.

Backup, restore and sharing

Under Setup, "Backup & restore":

• Export backup (with keys): all automations and targets with every secret. Enter a passphrase and the file is encrypted with it; leave it blank and the file is plain text.
• Export config only (no keys): the same without the SPA keys, the MQTT user name and password, the trigger token, the values of headers that carry a credential, and MQTT payloads. Wi-Fi names, coordinates, host names, and a token written into an address or a request body stay in. Read the file before you post it anywhere.
• Import backup: replaces your whole configuration with the file's. The app asks first, and asks for the passphrase of an encrypted file.
• Import single automation: adds one shared automation to yours. It arrives switched off; look it over, add keys if needed, then switch it on.

To share one automation, open its menu on the main screen and choose Share. The file holds that automation and the SPA targets it uses, without their keys.

The app's settings are not part of Android's own backup. To move them to another phone, use Export and Import.

Permissions and setup

Setup lists what is missing, each with a Fix button. It asks for some permissions only when an automation uses them.

• Location, and "Allow all the time". Android shows the name of the connected Wi-Fi only to apps with the location permission, and while the app is closed only with "Allow all the time". Without it, an automation cannot notice that you came home. Geofence conditions use it too. Location must also be switched on in Android.
• Notifications: for the service's notification, failure alerts and your Notify steps.
• Battery not restricted: so that Android does not stop the service.
• OpenVPN for Android installed and authorized, for the VPN steps.
• Bluetooth: to read the names of connected devices, for Bluetooth conditions.
• Do Not Disturb access: for Audio/DND steps.
• Display over other apps: for Launch app and Open URL steps that run in the background. The app draws nothing over other apps.
• Wireless debugging: the step needs the permission WRITE_SECURE_SETTINGS, which can only be granted from a computer over USB with adb. Setup shows the command and copies it for you.

On phones of some makers, among them Xiaomi, Samsung, Oppo and Huawei, the system stops background apps more readily. Setup shows a hint then: besides lifting the battery restriction, switch off the maker's own app killer for MyActiveTask.

The service starts again by itself after the phone restarts and after an update of the app, and the app checks every 15 minutes that it is still running.

Troubleshooting

• An automation does not fire. Open its Live status or the simulator to see which condition is false. Check the Master switch, and on the Status screen that the service is running.
• Wi-Fi conditions never match, and Live status says "SSID hidden". The text names the cause: set Location to "Allow all the time", or switch Location on. With "only while using the app", the name is readable while the app is open and hidden once it is closed. The app also posts a notification "Wi-Fi name hidden" when an automation depends on it.
• A Bluetooth condition never matches. Grant the Bluetooth permission in Setup, connect the device and copy its exact name from the "Bluetooth:" line of the Status log.
• Something changed and you do not know why. On the Status screen, the chip "Status changes" lists each change with its time and cause.
• The VPN does not connect. Run Diagnose connection to see which stage fails. OpenVPN for Android must be installed and authorized, and the profile name must match exactly.
• The VPN came back after a drop, but not after a stall. Stall detection needs the VPN health probe host in Setup.
• A webhook to a device at home fails. An unencrypted http:// address is allowed. A device with a self-signed HTTPS certificate needs "Trust self-signed certificates" on that step. A redirect is treated as a failure; enter the final address.
• Launch app or Open URL does nothing in the background. Grant "Display over other apps" in Setup.
• "Connected but no internet". The Wi-Fi wants you to sign in first. Automations with the Internet condition wait until you have.
• A Notify step fails with "Notifications are disabled". Allow notifications for the app in Setup, or unblock the channel "Automation events" in Android's notification settings.