[GUIDE] Reverse proxy Home Assistant VM with Traefik

[dboris]

You want to access your Home Assistant VM remotely ? eg : with your phone companion app

So simple, but couldn't find guide anywhere 😔 ! So here we are !

It's basically Home Assistant Cloud for free.

You will "simply" need to reverse proxy home assistant virtual machine with Traefik on Unraid ! 🥸

You must already :

• configure Home Assistant with a Fixed IP.
• have a domain or a DDNS setup
• have attributed a subdomain to point to home assistant
• have successfully reverse proxied a service/docker (so you don't start with HA's VM)
• MUST ABSOLUTELY have set up a double auth middleware (so you don't expose your HA VM to the rest of the world).

 

I won't provide support for these steps. Ibracorp videos are a good starting point.

I personally use ddns-updater, Cloudflare and Authelia.

 

On Home Assistant, edit your configuration.yaml (with the file editor HA plugin) :

 

homeassistant:
    external_url: "https://subdomain.domain.com" # provide your subdomain and domain, with no port
    internal_url: "http://homeassistant.local:8123" # local address with port

    
http:
    use_x_forwarded_for: true
    ip_ban_enabled: false
    trusted_proxies:
        - 192.168.X.X/24 # replace X to fit your local devices

 

On Traefik, edit fileConfig.yml, to include under "http:", and edit the following :

• subdomain
• domain
• localip
• localport
• auth (if not already named auth, must be replaced with the identifier of your middleware)

 

  ## EXTERNAL ROUTING - Only use if you want to proxy something manually ##
  routers:
     HomeAssistantRouter:
       entryPoints: https
       rule: "Host(`subdomain.domain.com`)"
       service: HomeAssistantService
       middlewares:
         - auth

  ## SERVICES ##
  services:
     HomeAssistantService:
       loadBalancer:
         servers:
           - url: http://localip:localport

 

 

Then go check on Traefik's UI to see if there's any error being reported. It should be all green.

You'll just need to log on your Auth service before logging in Home Assistant. I tried from the Companion's app and it worked perfectly with Authelia.

 

You are now set, enjoy the automations ! 👏

 

Edited October 28, 2023 by dboris
update pictures

[GollyJer]

Hi @dboris. Thanks for this guide.
I'm having a strange issue.

 

Traefik is set up and working pointing at other docker images, and other standalone servers on my network. So I know it's working properly.

 

The problem is, whenever I enable the homeassistant and http settings in configuration.yaml on the HA side I'm unable to get the UI to load at all. It doesn't work from the normal local url or ip address url.  I end up having to SSH in and edit the yaml file to remove those settings.

 

When I look at HA in the VNC console there are no errors and none in the logs.

Did you run into anything like this? 

 

[KevinE]

Setup a cloudflare tunnel and install the cloudflare addon in HA. I just tried setting up a tunnel into my unraid with a redirect to ha instance and I couldn't get it to work. There was some issue with HA not responding to reverse proxy requests. I don't know enough about it so went with direct tunnel into my ha instance and using the addon inside ha. So in cloudflare I have a tunnel to my unraid server (for radarr and sonarr) and a separate one for ha. On thing I am trying to setup is 2 factor authentication but haven't been able to get that running with the android app yet. I have it running on my unraid tunnel so that cloudflare asks for an email to send an authentication code before you can get to the logon screen for the app. 

[dboris]

On 1/27/2024 at 12:29 AM, GollyJer said:

Hi @dboris. Thanks for this guide.
I'm having a strange issue.

 

Traefik is set up and working pointing at other docker images, and other standalone servers on my network. So I know it's working properly.

 

The problem is, whenever I enable the homeassistant and http settings in configuration.yaml on the HA side I'm unable to get the UI to load at all. It doesn't work from the normal local url or ip address url.  I end up having to SSH in and edit the yaml file to remove those settings.

 

When I look at HA in the VNC console there are no errors and none in the logs.

Did you run into anything like this? 

 

No I don't face this issue.

 

2 factor authentication worked for me on my mobile : had to log in manually on authelia. Once done, still working today.