HArvest - securely share and control your devices on any HTML or WordPress page

Share your Projects! Custom Integrations
, ,
1

After a couple months of intensive real-world testing, I'm thrilled to announce HArvest v1.0 !

HArvest puts live, controllable Home Assistant cards right inside the webpages you already run. You create a widget token in the HArvest panel, pick the entities you want to expose, and paste a card into your page. Visitors see live entity states updated in real time, and when you allow it, they can control things too - toggle lights, adjust temperature, play media, and more.

A notable feature is the security model. Your visitors never log into Home Assistant, and your HA instance is never exposed. Every card is backed by a scoped token with its own access rules, origin restrictions, expiry, rate limiting, and full activity log. You decide exactly what each token can see and do, and you can revoke it any time.

HArvest is a free, open source (MIT) custom integration that works with all variants of Home Assistant. No additional software, no third-party servers, no cloud, no relays. The widget itself has zero dependencies and runs in any modern browser.

To demonstrate just how lightweight it is - you can save a static .html file on your desktop and HArvest will connect to it just fine. Got old or under-powered devices lying around? HArvest lets you build a responsive dashboard to bring them back to life.

Rather than forcing a fixed appearance, HArvest lets you decide how it feels. You can mix any HTML elements right alongside HArvest cards, so there are practically no limits to what you can build. It ships with multiple themes, imports user-contributed themes, and you can customize the fonts, swap the icons, or build your own themes from scratch. Already have Lovelace dashboards? You can import those as a starting point too.

Running WordPress? There's a bundled plugin, so you can drop a live HArvest card into any post or page with a simple shortcode.

And it's genuinely easy to get started. Install it through HACS, and a wizard walks you through the steps, and you can have your first dashboard up and running in just a few minutes. Full documentation is here: HArvest - Documentation

Full disclosure: I used AI to help develop HArvest, and I also used Photoshop to help with some of the graphics. I know these can be red flags for some folks, so here's my response: HArvest is fully open source, it has an extensive test suite, and it's had a couple months of public testing. Every line is on GitHub - read it, audit the token and auth code, break it, tell me what you find. If you have issues with GitHub's cloud distribution, and you'd still prefer it on a floppy disc, send me a self-addressed stamped envelope (allow 6 to 8 weeks for delivery).

2

Hi Steven, heads up that your WordPress plugin breaks media uploads. Every image upload fails with 'The server cannot process the image' as soon as the plugin is activated, even when it's not being used on any page. Deactivating it immediately fixes the problem.

I wasted a significant amount of time troubleshooting this (checking PHP versions, server limits, Cloudflare WAF rules, file permissions) before isolating it to your plugin. A WordPress plugin that interferes with core functionality just by being activated is a serious bug.

Setup: WordPress 6.x, Twenty Twenty-Three, PHP 8.2, Namecheap shared hosting, Cloudflare.

3

That's a pretty solid one! I was able to reproduce it here just now, you are 100% correct. Thanks for catching that!!

I have already repaired and tested it fully. You can find in the v1.0.2 update on Github now, you can re-import HArvest via HACS as usual.

Thanks again for using HArvest and offering useful feedback! Much appreciated!!!

4

Thank you so much, I will give it a shot!

5

Hi Steven, following up on my earlier report -- glad to see you've been active on the repo!

I've run into another issue worth flagging. The WordPress plugin is injecting a Content-Security-Policy header that restricts scripts to 'self' and the Nabu Casa URL only. This blocks all third-party scripts on the page, including lightbox plugins and other legitimate JavaScript. The CSP is essentially breaking the rest of the page for any site that uses external scripts.

The error in the browser console looks like this:

"Executing inline script violates the following Content Security Policy directive 'script-src 'self' https://[nabu-casa-url].ui.nabu.casa'."

The fix on my end was to remove the CSP header via .htaccess, but ideally the plugin either shouldn't set a CSP at all, or should set it in a way that doesn't interfere with the rest of the page.

Keep up the good work on the project.

6

That's clearly not helpful behavior, so sorry about that!

I've reworked the WP plugin to simply no longer add the CSP header automatically. But I added the CSP suggestions for your config within the WP plugin settings panel, which you can optionally add to your page header.

Redownload HArvest inside HACS, and you can find this labeled as 'v1.0.3b1 pre-release'

If you find more issues please submit an issue on github or report back here.