Home Assistant - Revision history

KN6DWI: Added category use cases

2026-08-26T22:39:41Z

Added category use cases

← Older revision		Revision as of 22:39, 26 August 2026
Line 93:		Line 93:
	* Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.		* Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.
	* If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.		* If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.

			[[Category:Use Cases]]

KN6DWI: Added image of TLS configuration

2026-08-19T22:47:42Z

Added image of TLS configuration

← Older revision		Revision as of 22:47, 19 August 2026
Line 52:		Line 52:

	=== Configure SSL in Home Assistant ===		=== Configure SSL in Home Assistant ===
	Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.		Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.

			[[File:Home_Assistant_TLS_Settings.png\|500px]]

			Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

	== Optional: Set up TLS with a domain ==		== Optional: Set up TLS with a domain ==

KN6DWI: Added image of TLS configuration

2026-08-19T22:46:51Z

Added image of TLS configuration

← Older revision		Revision as of 22:46, 19 August 2026
Line 71:		Line 71:

	=== Configure SSL in Home Assistant ===		=== Configure SSL in Home Assistant ===
	Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.		Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key.

			[[File:Home_Assistant_TLS_Settings.png\|500px]]

			Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

	== Troubleshooting ==		== Troubleshooting ==

KN6DWI: Formatting fix

2026-08-19T18:45:09Z

Formatting fix

← Older revision		Revision as of 18:45, 19 August 2026
Line 75:		Line 75:
	== Troubleshooting ==		== Troubleshooting ==
	=== Home Assistant is not accessible from the 44Net IP ===		=== Home Assistant is not accessible from the 44Net IP ===
	- Ensure you are accessing the correct port for Home Assistant. If you don't specify a port in your web browser, it will attempt to use port 80 (HTTP) or port 443 (HTTPS) by default, but the default Home Assistant port is 8123.		* Ensure you are accessing the correct port for Home Assistant. If you don't specify a port in your web browser, it will attempt to use port 80 (HTTP) or port 443 (HTTPS) by default, but the default Home Assistant port is 8123.
	- Verify that your firewall configuration has port 8123 (or whatever alternate port you're using) open.		* Verify that your firewall configuration has port 8123 (or whatever alternate port you're using) open.
	- Verify that your 44Net Connect tunnel is up using the [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page].		* Verify that your 44Net Connect tunnel is up using the [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page].

	=== Certificate authority fails to download challenge from the Certbot temporary web server ===		=== Certificate authority fails to download challenge from the Certbot temporary web server ===

KN6DWI: Added troubleshooting section for not being able to access Home Assistant

2026-08-19T18:44:46Z

Added troubleshooting section for not being able to access Home Assistant

← Older revision		Revision as of 18:44, 19 August 2026
Line 74:		Line 74:

	== Troubleshooting ==		== Troubleshooting ==
			=== Home Assistant is not accessible from the 44Net IP ===
			- Ensure you are accessing the correct port for Home Assistant. If you don't specify a port in your web browser, it will attempt to use port 80 (HTTP) or port 443 (HTTPS) by default, but the default Home Assistant port is 8123.
			- Verify that your firewall configuration has port 8123 (or whatever alternate port you're using) open.
			- Verify that your 44Net Connect tunnel is up using the [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page].

	=== Certificate authority fails to download challenge from the Certbot temporary web server ===		=== Certificate authority fails to download challenge from the Certbot temporary web server ===
	This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps		This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps

KN6DWI: Added inline Term reference for cron job

2026-08-19T18:41:08Z

Added inline Term reference for cron job

← Older revision		Revision as of 18:41, 19 August 2026
Line 68:		Line 68:
	<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>		<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>

	This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.		This will add a {{Term\|cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

	=== Configure SSL in Home Assistant ===		=== Configure SSL in Home Assistant ===

KN6DWI: Formatting fix for inline term usage

2026-08-19T18:40:31Z

Formatting fix for inline term usage

← Older revision		Revision as of 18:40, 19 August 2026
Line 46:		Line 46:
	<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>		<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>

	This will add a {{Term:cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.		This will add a {{Term\|cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

	=== Configure Docker bind mount ===		=== Configure Docker bind mount ===

KN6DWI: Create cron job term

2026-08-19T18:36:40Z

Create cron job term

← Older revision		Revision as of 18:36, 19 August 2026
Line 46:		Line 46:
	<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>		<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>

	This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.		This will add a {{Term:cron job}} that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

	=== Configure Docker bind mount ===		=== Configure Docker bind mount ===

KN6DWI: Formatting fix

2026-08-19T17:30:31Z

Formatting fix

← Older revision		Revision as of 17:30, 19 August 2026
Line 76:		Line 76:
	=== Certificate authority fails to download challenge from the Certbot temporary web server ===		=== Certificate authority fails to download challenge from the Certbot temporary web server ===
	This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps		This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps
	- Use <code>ifconfig</code> to verify that your 44Net Connect tunnel is up. You should see a WireGuard interface with your 44Net IP address.		* Use <code>ifconfig</code> to verify that your 44Net Connect tunnel is up. You should see a WireGuard interface with your 44Net IP address.
	- Visit [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page] and ensure your tunnel shows up as being connected.		* Visit [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page] and ensure your tunnel shows up as being connected.
	- Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.		* Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.
	- If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.		* If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.

KN6DWI: Wrote TLS setup with domain and troubleshooting

2026-08-19T17:29:44Z

Wrote TLS setup with domain and troubleshooting

← Older revision		Revision as of 17:29, 19 August 2026
Line 19:		Line 19:

	== Optional: Set up TLS without a domain ==		== Optional: Set up TLS without a domain ==
	By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the ~~CertBot~~ project from the Electronic Frontier Foundation.		By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.

	Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run ~~CertBot~~ on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run ~~CertBot~~ in the container or on the host system.		Let's Encrypt will issue short-lived certificates for bare IP addresses, which are valid for 6 days. Unfortunately, the Let's Encrypt app for Home Assistant OS doesn't support this, so HAOS users should either use a domain or run Certbot on another machine and find a way to automate updating the certificate in HAOS. Users running Home Assistant in a container can run Certbot in the container or on the host system.

	=== Set up ~~CertBot~~ ===		=== Set up Certbot ===
	First, [https://certbot.eff.org/instructions?ws=other&os=pip install ~~CertBot~~ according to its instructions]. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.		First, [https://certbot.eff.org/instructions?ws=other&os=pip install Certbot according to its instructions]. Stop before the "Choose how you'd like to run Certbot" step. We'll be using a slightly different command because we're request a short-lived certificate for a bare IP.

	Next, ensure your firewall has port 80 open on the machine where you installed ~~CertBot~~. When you request a certificate for an IP, ~~CertBot~~ will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.		Next, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.

	Users running ~~CertBot~~ inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.		Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.

	To run ~~CertBot~~ and acquire the certificate, run the following command:		To run Certbot and acquire the certificate, run the following command:

	<code>sudo certbot certonly --standalone --preferred-profile shortlived --ip-address <your 44Net IP></code>		<code>sudo certbot certonly --standalone --preferred-profile shortlived --ip-address <your 44Net IP></code>
Line 46:		Line 46:
	<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>		<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>

	This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring. Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.		This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

	=== Configure Docker bind mount ===		=== Configure Docker bind mount ===
	If you set up ~~CertBot~~ on your host machine rather than in your container, you'll need to set up a [https://docs.docker.com/get-started/docker-concepts/running-containers/sharing-local-files/#file-permissions-for-docker-access-to-host-files bind mount] for the certificate and private key to be accessible to Home Assistant. Keep track of the directory inside the container that the mount is mapped to, and use that path in the next step.		If you set up Certbot on your host machine rather than in your container, you'll need to set up a [https://docs.docker.com/get-started/docker-concepts/running-containers/sharing-local-files/#file-permissions-for-docker-access-to-host-files bind mount] for the certificate and private key to be accessible to Home Assistant. Keep track of the directory inside the container that the mount is mapped to, and use that path in the next step.

	=== Configure SSL in Home Assistant ===		=== Configure SSL in Home Assistant ===
	Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.		Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

	== Optional: Set up TLS with a domain ==		== Optional: Set up TLS with a domain ==
	By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the ~~CertBot~~ project from the Electronic Frontier Foundation.		By default, your connection to Home Assistant is unencrypted. Since it contains control traffic that affects the physical devices in your home, encrypting that connection with TLS is recommended. TLS certificates can be obtained for free through Let's Encrypt, and renewal can be automated via the Certbot project from the Electronic Frontier Foundation.

	If you have a domain name, it can be used with Let's Encrypt and ~~CertBot~~ to easily set up an automatically renewing TLS certificate. If you're running Home Assistant OS, you can use the [https://github.com/home-assistant/addons/blob/master/letsencrypt/DOCS.md instructions for the Let's Encrypt app]. If you're running Home Assistant in a docker container, apps are not supported, so you'll need to set up ~~CertBot~~ yourself.		If you have a domain name, it can be used with Let's Encrypt and Certbot to easily set up an automatically renewing TLS certificate. If you're running Home Assistant OS, you can use the [https://github.com/home-assistant/addons/blob/master/letsencrypt/DOCS.md instructions for the Let's Encrypt app]. If you're running Home Assistant in a docker container, apps are not supported, so you'll need to set up Certbot yourself.

			=== Set up Certbot ===
			First, [https://certbot.eff.org/instructions?ws=other&os=pip install Certbot according to its instructions]. Before running the <code>certbot</code> command, ensure your firewall has port 80 open on the machine where you installed Certbot. When you request a certificate for an IP, Certbot will start a temporary web server on port 80, and tell the Let's Encrypt server to contact the requested IP on that port. The connection will be through your 44Net IP, so ensure port 80 is open in the correct network zone of your firewall. See [[Firewalling Basics]] for more information.

			Users running Certbot inside the same Docker container as Home Assistant, but running their single device tunnel on the host OS, may need to [https://docs.docker.com/engine/network/port-publishing/ create a docker port mapping] in addition to opening the port on their host OS's firewall.

			Set up automatic renewal of your certificate by running the following command:

			<code>echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" \| sudo tee -a /etc/crontab > /dev/null</code>

			This will add a cron job that checks every 12 hours whether it needs to renew your certificate, and renews the certificate if it's close to expiring.

			=== Configure SSL in Home Assistant ===
			Next, go to <code>Settings > System > Network</code>, and in the HTTP server section, fill in the paths for your SSL certificate and SSL key. Then, go to the IP banning section, and set the number of login attempts before ban to something other than -1 to prevent people from brute forcing your Home Assistant password.Finally, verify that your configuration is working by restarting Home Assistant to make it use the new configuration, and then visiting your 44Net IP. Your browser should indicate that your connection to Home Assistant is now encrypted.

	== Troubleshooting ==		== Troubleshooting ==
			=== Certificate authority fails to download challenge from the Certbot temporary web server ===
			This typically happens if your 44Net tunnel is not up, or if your firewall is not configured to allow inbound connections on port 80. Try the following troubleshooting steps
			- Use <code>ifconfig</code> to verify that your 44Net Connect tunnel is up. You should see a WireGuard interface with your 44Net IP address.
			- Visit [https://connect.44net.cloud/tunnels the 44Net Connect tunnels page] and ensure your tunnel shows up as being connected.
			- Check your firewall configuration and make sure port 80 is open. If you have recently changed your firewall configuration, reload the firewall.
			- If running Certbot inside your Home Assistant docker container, make sure the docker container has its port 80 mapped to the host's port 80.