SUPER EASY! Secure Remote Home Assistant Access with Cloudflare Argo Tunnel

[@antonnemtsev6473]

Hi. It looks like there are assumption that there are https terminator configured on HA? Because I don't have anything like this in the config.yaml. Also where did you get Cloud Flare IP? And your HA IP that you set in public host names on cloud flare? Would be really nice to clarify this. Thank you for tutorial.

[@Birukoff]

You can make it even simpler by using Home Assistant's "cloudflared" addon that will take care of the whole configuration, including SSL, IPs, docker, connectors, etc, for you.

[@mostlychris]

Good point. Always multiple ways to do things.

[@mrbenny28]

Thanks for this video! I'm using Home Assistant Docker with nginx reverse proxy and an ssl cert for remote access, but I like the idea of using a tunnel and not needing to forward any ports. I'll give this a try!

[@CrynogarTM]

Chisel and self hosting is really secure and could be used over free cloudflare zero trust tunnel

[@manukalias]

5:15 If I run this command in ssh, my tunnel works but as soon as I quit this ssh session where the command was run, my tunnel goes down. Can you point me to any docs where I can understand this. I am running HA on RPi + Omv + docker + portainer. Any help appreciated 🙏🙏

[@MarkNguyen]

Reducing the threat vector by geography is a good tip. Thanks!

[@mostlychris]

Absolutely.

[@cecastil]

Hello Chris, nice tutorial as usual! Is there a reason that you prefer not using the HA Cloudflared add-on?

[@JoeCole1]

For myself, I use Home Assistant alongside many other containers and apps that are not related to home assistant, and so I've gone with the docker install method and simply installed cloudflared as a container as well. I have more control over how things are installed and they still work seamlessly with HA after a bit of setup.

[@mostlychris]

Ignorance but also what Joe Cole said. I have a lot of things already running in HA. A Lot. I do other stuff in my network and it just makes sense to offload some of that using the Docker version. However, the addon is worth a video so I might do that.

[@cecastil]

@@mostlychris Don’t beat yourself up. You produce great content! In fact this tutorial helped me to compare the pure docker version with the HA addon route. Keep up the good work!

[@fluffden]

does this work on docker? seems like i cant reach logs or anyhthing else you pointed out in the video

[@jamesebody]

Thanks for this Chris - just what I wanted!

[@mostlychris]

You're welcome!

[@jmr]

Nice tutorial. I've been considering Cloudflare for a while and I've been playing with their services off and on for months. I had a log in attempt from another country a couple days ago that could have been filtered out. On another note I hear we don't have to check configuration before restarts anymore because HA will do that when we hit restart but I can't stop myself. It makes me feel better to hit it! 🤣

[@mostlychris]

I'll probably ALWAYS check config. As a sys admin for many years, I definitely sleep better knowing I've checked things before a restart.

[@jmr]

@@mostlychris I don't think I'll break the habit unless they remove the button! 🤣

[@milicsantiago]

Great video! Thanks

[@mostlychris]

Thanks for watching!

[@sandeepchunduru601]

Thanks fot this Chris. But it is not working for me. I already have a tunnel in Docker on my NAS. Trying to use same tunnel for HA on R Pi but gives bad gateway errror. R Pi and NAS are on different subnets if that matters, is there a solution.

[@tinkerer67]

Is your port forwarding working?

[@mikepeterson443]

How do I find the CloudFlare's trusted_proxies address to put in HA's config file?

[@mostlychris]

Take a look here www.cloudflare.com/ips/

[@manuelmatus2959]

your videos are awesome!!!

[@mostlychris]

Thanks!

[@TheTinkerDad]

Hi Chris, I wonder how/if this solution is any more secure than what comes with HA Cloud. Currently I'm using HA Cloud and paying for it to support HA's development, but the more of my house I wire up with HA the more I need to be keen on security.

[@mostlychris]

I think they are very similar. For some of us that have complex setups, I don't think there is a one stop option. It might make sense to do more than one thing. Nabu is strictly for accessing Home Assistant. Tunnels can be used to access your local network and stuff in it. I support HA via Nabu Casa but still use other methods in addition in order to work with my environment.

[@levvaisman]

Hi Chris. Thanks for this tutorial. Will google assistant work with Coudflare setup? Can I use Cloudflare HA Addon instead of a docker installation? Thanks.

[@yankee-in-london]

The addon works well and unlike Chris's video it doesn't require any setup on Cloudflare's Zero Trust dashboard. For most people I think this has only upside and would recommend the addon for most folks.

[@mostlychris]

Might need to do an additional follow up on cloudlfared. I just added the repo in Home Assistant and did a quick glance of the config page.

[@krdesigns]

at my current conditions, somehow CF cache all my images. So my problem arise when someone ring my door bell and instead of sending the current images. Its send my the cache images. Any idea on how to solve this problem? Furthermore CF did not allow you to stream CCTV?

[@yankee-in-london]

That's odd about the images. I do not see that with my setup.

[@yankee-in-london]

As for CCTV -- or any type of streaming -- I believe this is possible but you need to set it up as part of the Cloudflared configuration. I haven't done this yet but it's on the list.

[@krdesigns]

@@yankee-in-london My case: someone ring my door bell, the CCTV take a snapshot and send it via Telegram. Now using zerotrust the snapshot never being replace instead it keep sending me the same images. This only happen when I put through my HA via Cloudflared zero trust. So if anyone have a solution please let me know

[@yankee-in-london]

@@krdesigns I think this must be something else as all the Zero Trust tunnel is doing is providing a secure network path so as you don't expose your home network. If you were getting NO image you might have a case where the image is hosted somewhere which the tunnel doesn't expose but in your case you're getting an "old" image right? That really has to be something else.

[@krdesigns]

@@yankee-in-london Nope I can confirm that if I used NGINX proxy the image sent will be update. However when I'm using the Zero Trust, the image that being send are the same image since its never getting any update. Again the image did get send, however its based on cache and not realtime update

[@bat3332]

useful useful useful thank you

[@mostlychris]

You are welcome

[@B-a_s-H]

Too bad that CloudFlare needs a payment method when you want to use Zero Trust. Most people don't have creditcards where I'm from.

[@Koko-badu]

if you do it via the add-on it will be done automatically, and you don't need to setup payment method. Good luck!

[@B-a_s-H]

@@Koko-badu Thanks, but I'm using HA in docker, so no add-ons for me I'm afraid. However, I am curious now how the add-on would accomplish this (I'm guessing it uses the CF API?).

[@mostlychris]

I must have added a payment method a long time ago because I didn't have to do that. I use other services with them but thus far have all been within the free range of services.

[@mostlychris]

Getting a ton of mentions about the add-on. It's going to be a follow-up video. Has to be.

[@GiovanniWahome]

Hey Chris, Would doing this with home assistant after a while violate the 2.8 TOS if I had an instance of frigate running or any other addon that serves media as part of its function? The term non-HTML is very vague and I worry I could get banned from cloudflare.

[@mostlychris]

Interesting question. However, it's one that I can't answer as I'm not directly affiliated with Cloudflare. I would have to leave that up to their team.

[@ernestoditerribile]

If you keep it under 16 camera’s with 8MP or less, you don’t really overload their services. They will shut you down if you go over that