Homeassistant via reverse proxy

Introduction

Due to some extensions which I compelled to benefit must, I have access to my smart home installation from the internet do.
Since I do not want to open a port on my router, or the HASS installation wants to pack into a DMZ, I have deport, my home assistant via VPN tunnel and reverse proxy to make available.
In the following I show how I mean Debian server configured to enable this and what fall knits I had to consider.
In this guide, I assume that a Homeassistant installation and a functioning Apache2 Webserver are available.

Homeassistant

First we need Homeassistant to use a reverse proxy configuring since HASS otherwise connect this connection from home blocked. For this we use the following in the confiiguration.yaml:

http:
  # server_host: 127.0.0.1 - Nur möglich, wenn Proxy auf der selben Maschine wie HASS läuft... 
#Erlaubt diue Nutzuing des forward headers, dafür muss proxy auf whitelist
  use_x_forwarded_for: true 
 #ich habe nur 1 proxy, daher nur eine IP (auch Netz (z.B. /24) ist möglich)
  trusted_proxies: 192.168.100.1 
cors_allowed_origins:
    - https://hass.jr.local
    - https://open.domain.com

The proxy server IP (internal) must be adapted to the current network!

Once this has happened, you can check the configuration file under Developer Tools > YAML – and then restart it.

Debain Server

Here I have encountered some falling knits, just after registration I always had an error message (Unable to Connect to Homeassistant) I hope that this mistake will save you. In in my case I had forgotten to enter routes that the proxy and that the headers should be adjusted... In following my configuration

Under /etc/apache2/sites-availiable we create a new Config datei, with me this means
hass.rev.proxy.conf

<VirtualHost *:80> #euer Port, den ihr im Netz ansprechen wollt
        ServerName <<euer Servername>> bei mir ###.justinritter.de
        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/hassError.log
        CustomLog ${APACHE_LOG_DIR}/hassAccess.log combined

        RemoteIPInternalProxy 192.168.100.1 #eure proxy IP
        RemoteIPHeader X-Forwarded-For

        <Location "/">
                Satisfy any
        </Location>
        <Location "/api">
                Satisfy any
        </Location>


        ProxyPreserveHost On
        ProxyRequests off
#Da ich nur SSL nnutze, muss ich die SSL Engine verwenden und die Zertifikatsprüfung für intern deaktivieren
        SSLProxyEngine On
        SSLProxyVerify none
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerExpire off
        SSLProxyCheckPeerName off
#Im folgenden die unterschiedlichen "Routen", die weitergegeben werden sollen
# die urls müssen an die eigene Adresse angepasst werden
# Wenn ihr zwischen Proxy und HASS SSL nutzt, dann nutzt ebenfalls https://* und wss:// - alternativ http:// und ws://
        ProxyPass / https://hass.jr.local/
        ProxyPassReverse / https://hass.jr.local/
        ProxyPass /api/websocket wss://hass.jr.local/api/websocket
        ProxyPassReverse /api/websocket wss://hass.jr.local/api/websocket
        ProxyPass /auth/external/callback https://hass.jr.local/auth/external/callback
        ProxyPassReverse /auth/external/callback https://hass.jr.local/auth/external/callback


# AUch hier die eigene Adresse eintragen 
        RewriteEngine on
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /(.*)  wss://hass.jr.local/$1 [P,L]
        RewriteCond %{HTTP:Upgrade} !=websocket [NC]
        RewriteRule /(.*)  https://hass.jr.local/$1 [P,L]

# Wenn ihr nach aussen hin (WAN) SSL nutzt, dann hier die eigenen Zertifikate eintragen
        SSLEngine on

        SSLCertificateFile /etc/letsencrypt/live/cert/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/cert/privkey.pem
</VirtualHost>

Next, you need to activate the page with a2ensite <

und zusätzlich müsst ihr noch die folgenden Apachemodule aktivieren
- mod_proxy (a2enmod mod_proxy)
- proxy (a2enmod proxy)
- proxy_http (a2enmod proxy_http)
- proxy_wstunnel (a2enmod proxy_wstunnel)
- remoteip (a2endmod remoteip)
- rewrite (a2enmod rewrite)

After this is done, just restart apache2

sudo service apache2 restart

Finally, if necessary, your firewall must be adjusted and then it can start...
In my case, I must release the traffic through the tunnel at my Firewal (ufw).

---

Back…