Basic comparison between SSL/TLS and SSH Tunnel

That will establish port forwarding from your local machine (where you run the SSH command), port 8000 to IP 192.168.0.5, port 8123 via an ssh connection to myha.somedomain.tld. If IP 192.168.0.5 is the IP of the Home Assistant host, then it will work.

If Home Assistant is running on myha.somedomain.tld itself, then the alternative command would be

ssh -L 8000:127.0.0.0:8123 [email protected]

because you connect to myha.somedomain.tld and forward port 8123 on same target machine to local post 8000.

Other options are to use TLS/SSL via the add-ons Duck DNS integrating Let’s Encrypt or Let’s Encrypt. To expose your instance to the internet, use a VPN, or an SSH tunnel.

Actually, the instructions on the referenced page are somehow … promoting the use of Home Assistant Cloud. Let’s Encrypt will not issue a certificate for an IP, so you need a public resolvable DNS name for your HA host to use it.

  • if you want to connect to the Home Assistant UI from anywhere, TLS/SSL is the only way to go (ever started an SSH tunnel on your mobile phone?). Strong, auto-generated passwords and a password-manager like Bitwarden are always a good choice. 2FA, too.
  • if you want to connect to the Home Assistant UI and host from a local, secure network and you have the possibility, I’d go for a VPN. Just address the HA host via IP on any port. There might be an appropriate option available on your router. At least I use this with the AVM Fritz!Box (quite popular in Germany).
  • if you want to connect to the Home Assistant UI and host from a local, secure network and cannot use a VPN, you could use the SSH command above to open a command line on the HA host while at the same time exposing the HA UI on port 8000 on your local machine.