Access your internal websites! Nginx Reverse Proxy in Home Assistant.

[@Denizenn]

Thank you very much for this! Hours spent yesterday trying to achieve this and got it done in 30 minutes thanks to your video, really appreciate it!

[@mostlychris]

You're welcome. Glad it helped!

[@Percy500]

Thank you for this tutorial. I spent over 10 hours now on this problem, becuase I didn't enable Websocket Support, so thanks for this nice video.

[@mostlychris]

You're welcome!

[@borishruby7131]

Hi Chris, wonderful video. Probably the best regarding reverse proxy. Everything is now clear to me. Many thanks. Really love your videos. Keep up the good work! But I have found out that the Access List doesn't work for me as it should. If I set some authorization to some host it won't let me in even when putting in the correct credentials. The small window keeps popping up regardless of what credentials I key in. Btw. if you made some changes in authorizations you have to always update the host as well otherwise it won't be applied. That's a bit annoying but it is like that. I've found it somewhere in youtube by chance.

[@miguelgarcia-vg1fh]

I liked and subscribed to keep on watching your videos on HA so keep em coming.

[@mostlychris]

Awesome, thank you!

[@btrigaux]

Hi Chris, I'm trying to setup this NGINX addon on top of my HA. I took NGINX Home Assistant SSL proxy, which is a bit (or more ?) different from the one you're covering here. Please do you have some recommendation about the one to be used ? My config : Home Assistant 2022.8.4 / Supervisor 2022.08.3 / Operating System 8.4 / Frontend 20220802.0 - latest. With NGINX installed and configured, only the local http ways is operational. The HTTPS way (with duckdns) doesn't work. The strange thing for me is the lack of error message in any log file. Thanks for helping, Bernard.

[@craigw4644]

Nice presentation, thanks. Since I already have HA running, might as well use it to access some other servers in the house.

[@mostlychris]

Yep and this makes it nice.

[@giolovin]

I have one big question. When should one use 'NGINX Home Assistant SSL proxy' and when 'Nginx proxy manager'? Does the first one only allow one domain and the second one several different domains? What's the difference between those two addons?

[@towers3372]

I am facing the same thing right now. You're correct, the 'NGINX Home Assistant SSL proxy' is automatic setup for https to HA from the internet. However, I have other services on my local network I wish to access which in HA which are running http, so I am using this video to figure out how to migrate to 'Nginx proxy manager'. It looks like I cannot have both at the same time, since they bind to the same port 443.

[@NerdCyclist]

I have managed to get nginx up and running and I also have a spare domain that I can use but (only used for email) what I don't understand is how to point the domain towards the nginx server. I plan to use different sub domains to access different servers on my network, how do I get this to work? Do I have to create A records on the sub domains? As a home ISP doesn't provide static IP I use a DDNS service. Any help would be appreciated

[@rlillard]

I followed this guide and I am receiving error 400: Bad Request when accessing this on an external network. Internal works file.

[@tariq4846]

Same here

[@hamadal-rakeb9655]

Great presentation . Thanks a lot

[@mostlychris]

Most welcome!

[@khalidelgazzar]

Great video and explaination.. thank you

[@mostlychris]

You're welcome. Thanks for watching!

[@antoniodecrisci2369]

Another great video. What if you used force SSL with let's encrypt instead of challenge dns? I tried the former but kept getting "internal error" with nginx....so I'm just using DuckDNS with SSL. Not sure why I can't get nginx to work with force SSL.

[@mostlychris]

Those are two different things. Force SSL tells the connection to force SSL in the browser. Challenge DNS is a method for you to authorize your SSL certificate with Let's Encrypt. There is a method that will talk directly to your HA instance on port 80 but that has to a port that is open publicly and forwarded to your HA instance. I wouldn't do that. As for the error, not sure what is going on there.

[@antoniodecrisci2369]

@@mostlychris I agree, I couldn't get it to work (with force SSL) so I unistalled DuckDNS, NGINX, SSL etc. closed all my ports on the router and joined the Nabu Cada subscriptoin plan. Much simpler, and safer now!

[@murrayzhong3968]

At 12:25, you said paste in Credential file, but you did nothing.

[@mostlychris]

I edited out the actual pasting of the file because it contains my credentials. You would put your own credentials in there based on your DNS provider and how they format it.

[@murrayzhong3968]

@@mostlychris use mask to cover your credential

[@jmaviles]

Thank you @mostlychris, I am a little stuck, I am trying throught Force SSL and always same error message like your in min 5, how to resolve it will be great !! I am using duckdns and is not in DNS challenge list options.....any comments?

[@mostlychris]

I had used Let's Encrypt add-on before using the Nginx proxy. When I installed the proxy add-on it complained about the existing certs and that there was no auth method. Are you running any other certificate manager on the same device?

[@NinaMariePhoto]

Im having trouble where I dont see any errors with maria or nginx, but when I try to load the nginx UI, it just doesnt load. eventually it times out, what am I doing wrong?

[@mostlychris]

We're chatting in Discord about this.

[@patricklang7201]

I have an external nginx proxy manager, but I always get 403 forbidden, does anyone know why?

[@Nrodrigues90]

Did you test the home assistant android app with an access list? When I try to configure my url Im always receiving a bad request because I'm not able to fill the credentials of my access list.

[@mostlychris]

I have not tried that. I'll give it a look.

[@cemaranetfeedback6295]

So... CMIIW the advantages of this method compared to using free ddns such as duckdns / freeddns is that we can access locally and externally from phone, and secondly it's secured right? Other than that Is there any latency improvement ?

[@mostlychris]

I don't think latency plays into this. DuckDNS in the context of HA is having a single duckdns owned domain point to your HA instance. With the reverse proxy, you can run stuff inside your network that is then accessed via a single port through your router. The proxy picks up the domain name and then forwards it to your internal resource. Access is remote from any web enabled device (phone, PC, etc). I have remote monitoring enabled for some of my internal applications.

[@ThijmenCodes]

Hi Chris, great video. I Initially setup my HA installation using the other proxy add-on, though I'm currently in the process of building a mediaserver using Jellyfin that I'd like to have remote access to which means that plugin is not sufficient. Was looking for a solution and stumbled across your video... Really convenient!

[@mostlychris]

Excellent! Good luck!

[@gambler3k]

Do u just have jellyfin as publicly accessible or with username and password? if i use username and password i cant connect to jellyfin through the phone app, or is it a way to combine the username and password in the url?

[@ThijmenCodes]

​@@gambler3k I use Jellyfin's built-in authentication! Though I use NGINX to make the instance available to the web, and not Jellyfin's built-in method.

[@error53ish]

Would this still work if your ISP uses CGNAT? I'm trying to setup a way to expose my Home Assistant VM to the internet and most methods don't work with CGNAT.

[@mostlychris]

I don't think so. However, there are options such as Twingate (just released a video on that kzbin.info/www/bejne/gX3FXpyPa82WhMk) or VPN such as Tailscale (kzbin.info/www/bejne/aYKoi4WmrcuNppY) that I think works behind CGNAT.

[@G8YTZ]

Chris, great video! One question; can I use a single domain to connect to different ports on different servers, or do I have to create more domains or perhaps sub domains?

[@mostlychris]

You need to be able differentiate the request coming into the proxy. You can have one domain but would need to use subdomains to make things go to different ports at the proxy level. sub1.domain.com; sub2.domain.com; etc.

[@G8YTZ]

@@mostlychris Thanks Chris, one thing I discovered was that you must refresh the domain entry if you (say) create an access list or add another user. That one has me scratching my head for a while!

[@Shaq2k]

Excellent video. Question: If i use the Home Assistant Cloud I don't need to setup this, right? Thanks.

[@mostlychris]

Correct. If you are using Nabu Casa, you don't need this. However, if you have other things internal to your network then this provides a way to get to them without having to port forward. I have quite a few other internal sites (some noted in the video) that this is great for.

[@yosypkava8909]

Thank you!

[@mostlychris]

You're welcome!

[@Sebastian-xf8je]

Anything need to be added for this to function with AdGuard home addon?

[@mostlychris]

Are you asking if you can use the AdGuard add-on via the reverse proxy? If so, you could, but not sure what the use case would be.

[@michaellim7542]

Very informative video. That is what I am looking for to setup nginx. Just one question can i add pi-hole to my network after setting up the Nignx reverse proxy and how to do it?

[@mostlychris]

You can use pi-hole internally. It doesn't interfere with this installation. Pi-hole used to be an add-on in Home Assistant but I don't see it now. I personally use AdGuard, which is an add-on and provides similar features. I use "split DNS" so that my local devices resolve to the local IPs and then with the proxy from outside, they are sent to the appropriate device. If you are running Home Assistant, I'd recommend using AdGuard.

[@loxlie]

@@mostlychris One caveat there - AdGuard uses port 80, so that will interfere with LetsEncrypt's HTML-based authentication, and must be disabled while generating/renewing a certificate.

[@87vortex87]

I already connect to HA through VPN, but i need https to connect internally to bitwarden. Bitwarden doesn't accept http traffic, can i just use the HA http ip with port for bitwarden and redirect over https with same HA ip and bitwarden port?

[@mostlychris]

I have a reverse proxy set up for bitwarden (now vaultwarden). SSL requires a certificate so I created a domain that I use on the reverse proxy in order to point to my vaultwarden port on the HA server internally. I also use AdGuard to do a DNS rewrite so my vaultwarden secure domain can be reached both internally and externally at the same URL.

[@groto27]

I am also using Google Domains... but I can't seem to find the instructions on how to get this Credentials File Content anywhere on the Google Domains page. Can you point me in the right direction? Thanks!

[@mostlychris]

I was using Google Domains but in order to use credentials, you have to use Google Cloud DNS. console.cloud.google.com/net-services/dns. You would use Google Domains as the registrar and Google Cloud DNS to handle the zone files. Sounds strange to use Google to use Google (not a typo) but that is how it works. Of course, you can use any DNS provider that has an automated credential type setup that is compatible with this add-on.

[@groto27]

@@mostlychris thank you! I will look into it.

[@dhtguru6233]

Hi Chris, love your work. Always check with you here before I look anywhere else with new projects. I used this video to setup my remote access. Now its time to renew my Lets Encrypt certificate (6 days left) and I am getting an "Internal Error" msg from the Nginx Proxy Manager page when I select "Renew Now". The forum at Lets Encrypt weren't really knowledgeable about HA and could only offer guesses. Any clue on how I can renew? Thanks in advance.

[@mostlychris]

I have this issue when it can't use the same auth method as when I set up my initial certificate. I just delete the cert, go into the host and re-add the cert using the verification method I originally used. Your site using that cert will be down for the few minutes that you take to provision a new cert.

[@naronaroyan323]

What if we don't want to use MariaDB so we don't harm our FlashDrive that HA is installed on?

[@mostlychris]

I don't know that you can use anything else other than MariaDB. It mentions this as a requirement. What were you planning on using?

[@naronaroyan323]

@@mostlychris I don’t think HA’s default is MariaDB. Isn’t it SQL?

[@kevinstack3305]

Great Video--very informative. This is where I get stuck: What do I type into the Credentials File Content box? I have the JSON file with the API token from Google which is currently downloaded to my PC, but it is not on my Pi.

[@mostlychris]

If you are using Google, you should have the JSON file with your credentials. Each DNS provider will have their own auth method and/or credentials format. If Google, you should be able to paste the raw JSON credentials file directly into the box.

[@ansomeBob]

I fell over here as well. I use duckdns, it's not in the list so it's not clear how to get a credentials file :-( Back to researching for me...

[@jayargent4156]

Hi I'm getting an error that port 80 is already in use when I start NginX, I have DuckDNS installed for external access but this does not allow for access on my internal network, My install is in a Virtual machine on Windows10 if this makes any difference? do I do away with DuckDNS and then use this instead? will this then allow me to load my Node red dashboard into HA? because as I'm secure I can only load secure sites in to a Web Card, and my node red is installed within HA, - If I make this secure then I can't use some Alexa integrations - going around in circles, I have already tried the other NginX add-on and almost locked myself out of everything...

[@mostlychris]

You are doing a non-standard install so there could be anything using that port. You need to look through all your add-ons and figure out what is using port 80. With my installs, I can use portainer to tell visually tell me what ports I have mapped to what containers. I can tell you how to do this in Linux and unix variants but no so much in windows. Not sure what a web card is so I'm not going to be much help there.

[@kevinnadjarian3328]

was challenging with CloudFlare but managed to do it, the host is showing "online" but when I open the URL the page is not resolved

[@mostlychris]

Is this an external URL that can't be resolved?

[@kevinnadjarian3328]

​@@mostlychris When I'm port forwarding 80/443 to my Home Assistant OS (Nginx) my external IP won't resolve, I'm getting a error 522 from Cloudflare, sometime my external IP is redirected to LocalHAIP:8443/hassio/addon/a0d7b954_nginxproxymanager/info and back to my external IP and again error 522 from Cloudflare. when I'm only forwarding HA_Port to HA_Port everything is working fine (this bypass Nginx and just use home assistant default web server). thinking about it now, my gateway (UDM Pro / Ubiquiti) might already use port 443 for remote management.

[@mostlychris]

It sounds like you have some routing issues. I use split DNS with AdGuard on my internal network so that it points to the correct place. If you are trying to reach the external URL from inside your local network it might be looping.

[@jocelynlagarenne882]

something that is bothering me : once you put everything in place, do you access these internal url directly with a public url (not what i want) OR do you access them Through home assistant interface (requiring to be authenticated into home assistant interface) ? i'm looking to this second option to access my grafana, NAS(web interface) etc through my home assistant when i'm outside but with the authentication of Home assistant, without giving a direct access to these web interfaces

[@jocelynlagarenne882]

in my current setting, it's working while i'm on my LAN network : i can embed my synology web interface into a panel, but when i'm accessing my home assistant from outside, the panel doesnt load ... i cant figure out what is happening. do you have any tips ? i would very much appreciate it :)

[@mostlychris]

I think this is something best suited for a VPN type setup. It sounds like you are attempting to connect to other devices inside your network that are not on HA itself. This might help: kzbin.info/www/bejne/mJq4Zp9miZmYbtk

[@encostablanca]

Since core 2021.7.0 this is not working no more, seems to be a breaking change.. Can't figure out how to allow it in HA..

[@mostlychris]

Uh oh. What part is not working?

[@encostablanca]

@@mostlychris remote access due to reverse proxy

[@mostlychris]

@@encostablanca Yes. There is a breaking change noted. I have not yet upgraded to 2021.7 because I haven't gone through all the breaking changes. I'm not sure what might be misconfigured but make sure you have the configuration settings in the http section as noted below (from their breaking changes section on the website). Home Assistant will now block HTTP requests when a misconfigured reverse proxy, or misconfigured Home Assistant instance when using a reverse proxy, has been detected. If you are using a reverse proxy, please make sure you have configured use_x_forwarded_for and trusted_proxies in your HTTP integration configuration. For more information, see the HTTP integration documentation. Additionally, access to Home Assistant from the same IP address as a trusted proxy will be rejected if the request is marked as forwarded.

[@Fukaka2343]

Hi, thanks for the great tutorial, i have Jboss application with a Ip:port/xyz/abc type of url, which i want to shorten using a reverse proxy, would it be possible to acheive? i have tried to setup the "custom location" with path but cant get it to get to the (/xyz/abc ) can you make a tutorial for such., thanks.

[@mostlychris]

Hey Abid. I'll add that to my list.

[@huhcom]

When I click the Web UI link I get a blank page until the connection times out. What should I do?

[@mostlychris]

I need more detail on what you are clicking and what you are trying to reach for the URL. Maybe something to post in my discord server.

[@huhcom]

@@mostlychris Just the link to port 81.

[@mostlychris]

Are you proxying a specific URL (don't post it here)?

[@huhcom]

@@mostlychris The same URL I use to get to Home Assistant but using port 81 instead port 80.

[@mostlychris]

@@huhcom If you get a chance, maybe jump into my discord for a more detailed discussion.

[@okanerdem]

If we added access list (password) how can we access from mobile HA app?

[@mostlychris]

That's a great question. I don't think there is an option for the companion app to authenticate at a proxy level. You might just have to rely on HA's auth for that.

[@okanerdem]

​@@mostlychris Yeah, I am also use 2FA. Also there is some of firewall rules on cloudflare for now. Other option, just use it with vpn

[@mossanaismael134]

Hello I want to make a small company for make proxy server then sell proxies what are requirements ?? Thanks for your help 🤠

[@mostlychris]

Don't think that applies here.

[@workhard2belazy]

HOLY CRAP THIS IS SO EASY assuming you are willing to shell out 12 bucks a year for a domain

[@mostlychris]

Yes. I've had domain names for so long now that it's just part of my yearly budge.

[@crevard203]

You had me going there until the creating a domain part :(

[@mostlychris]

Domains are not hard to manage. There are a ton of providers out there that you can register a domain with and most of them provide DNS services as well. Were you planning on doing something with the reverse proxy?

[@irtibatkisileri222]

@@mostlychris Thanks for awesome tutorials. In fact I am too lost after sub domain part. It is difficult. Kindly consider doing a follow up tutorial regarding creating a sub domain record and getting that data from domain providers or VPS providers. Thanks.

[@mostlychris]

@@irtibatkisileri222 I added that to my list of vid requests.

[@dogo7705]

Was the NGINX proxy manager removed? I don't see it in the add-on store and am unable to add the git through HACS

[@mostlychris]

It's in the "Home Assistant Community Add-ons" section. You might have to add that as a repository in the main add-ons section.