ESPHome OTA Publisher — remote OTA updates for ESPHome devices outside your LAN

Share your Projects! Custom Integrations
1

ESPHome’s built-in OTA only works over your LAN (mDNS/local discovery) — devices outside your home network can’t be updated that way.
This add-on publishes firmware to Home Assistant’s own /local/, so the same address you already use to reach HA remotely (Nabu Casa, a Cloudflare tunnel, your own reverse proxy) becomes the firmware download URL too — no new port, no new exposed service.

What it does

  • Publishes firmware + MD5 to HA’s /local/, either pulled straight from the ESPHome Device Builder add-on or uploaded manually
  • Generates a ready-to-include ESPHome package: a button that force-installs the latest published firmware — no version tracking, no extra config needed
  • Firmware URLs are cache-busted, so a CDN/tunnel in front of HA can’t serve stale firmware after a republish

Install

Settings → Add-ons → Repositories → add:
https://github.com/eigger/hassio-apps

Then install ESPHome OTA Publisher.

Docs: hassio-apps/esphome_ota/README.md at 9739e66cd5186d77a7cbb6081c2c0ef475b920df · eigger/hassio-apps · GitHub

2

Nice tool but OTA works fine for me on subnets other than the one to which HA is connected and even over routed WireGuard VPN between the subnets.

You need to run an mDNS mirror between the subnets such as Avahi - my routers are all OpenWrt so this is easy.

In the following /etc/avahi/avahi-daemon.conf, br-secure is the interface for the subnet for my PCs, br-dmz is where my Home Assistant server and smart home devices including ESPHome ones live and mesh is the WireGuard tunnel interface. This runs on all routers connected to each other via the WireGuard tunnel - four sites in total where each connects to all of the other three.

[server]
use-ipv4=yes
use-ipv6=yes # Optional.
check-response-ttl=no
use-iff-running=no
allow-interfaces=br-secure,br-dmz,mesh
allow-point-to-point=yes

[publish]
publish-addresses=yes
publish-hinfo=yes
publish-workstation=no
publish-domain=yes

[reflector]
enable-reflector=yes
reflect-ipv=no
3

That’s true—using WireGuard might actually be a more convenient and better approach.
I built this tool mostly out of personal preference.
I didn’t want to deal with managing DDNS or opening and managing extra ports just to access my server.

1 Like