HomeAssistant NGINX SSL proxy setup

Configuration
41

Not sure specifically, but a quick google search indicates that some people have solved by killing Chrome (closing browser and killing background processes) and then retrying:

42

Searching a bit more and I found this: http://stackoverflow.com/a/11770124

I plan to try this tonight after work. Will report back

43

Didn’t work - still got the same error. I think I am going to use dnsmasq to redirect the URL to the internal IP when on the same network.

44

I’m having trouble getting nginx reverse proxy to work with Hass when the location is anything but /. I have multiple apps I’d like to reach from outside my network, and each works fine when I do domain.com/appname1, domain.com/appname2, etc… However Hass won’t connect when it’s domain.com/hass. Has anyone successfully implemented this? Any pointers?

45

I have a Synology DS running a reverse proxy. It actually uses NGINX in the background but wraps a nice UI around it. I have about 10 services each on their own sub domain running off my main domain and can access them no problems. Tried with HA and all I get is the login screen. I enter a pass and it spins and spins and comes back with password error.

Tried setting up NGINX on a spare computer. All services work except for HA. I have a strange feeling it’s HA. I know people say they’ve going it going. I have read all those threads but it just doesn’t work.

Any suggestions? Does anyone have it working correctly with the current ver of HA and if so how. Too many people are complaining with the same symptoms.

EDIT: It half works. It seems the iOS app accepts the subdomain of https://hass.xxxx.xxxx.xx and has logged into HA no problems. Notifications as well as location reporting back to HA work fine. In the iOS app though I have the standard HA login screen and can’t go past that. Something is def wrong with HA not what people are setting up.

46

I am not having any problems. I am running the newest version of HA with the config I linked above as well has the connection upgrade settings that @kylerw mentioned. Have you tried more than one browser? Cleared cache? I know several people using hass.something.com without any problems using this config.

47

I def cannot get past the login screen using either Safari or Firefox. As I said, iOS app logs in fine, just no UI is displaying and instead I get a login screen in the app. Don’t know enough about the backend of HA (Polymer) to understand what is going on. Don’t you love inconsistencies :smiley:

48

Is it possible it has something to do with the Version of Nginx you are using or how it is setup using inside of the Synology? Would it be possible to setup a separate Nginx on another box and see what happens?

49

I did setup a separate Nginx a couple of days ago. I thought the same. Still couldn’t get it to work but have to admit didn’t put too much time into it. I am going to delve into Nginx on the Synology. It doesn’t use the /sites-available or /sites-enabled dir and configures servers differently but again i haven’t spent much time poking around. I find it strange that all my different services and servers work fine except for HA. The fact that the HA iOS app half works in intriguing as well. I don’t want to setup another box just for Nginx. I have 2 NAS’s for that :smiley: Thanks anyway.

50

I am not sure what services you are running, but I would think HA might be the only one using websockets? So it could have something to do with that? I am not sure about the iOS app, but I know it is polling the API initially which isn’t using websockets so that kinda makes sense that that would work.

Also I am not suggesting you setup another box for Nginx long term, it would just be interesting to see what results you have.

51

I had the same issue until I added some lines to the config and proxy setup that were web socket related. You may already have them in your setup, but once I added them, it started working for me:

In nginx.conf (http section):

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

In the site config (specifically the location for the proxy):

	location / {
	proxy_pass http://127.0.0.1:8123;
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
	}

Hope this helps.

2 Likes
52

Thanks. I think the post below yours might be something to work with. I just have to delve into Synology version of Nginx. As I said they have wrapped a GUI around it but it leaves for very little configuration apart from standard stuff. I need to look around some of the files and see what I can find. Thanks for your info.

Thanks for that. I will start experimenting.

53

Good luck. The Synology aspect probably adds a layer of obfuscation, but if it would be helpful for me to post my whole config, let me know.

1 Like
55

For anyone who has a Synology DS and is using the reverse proxy feature under the application portal (nginx), there is a small patch you can apply to allow Websockets for all servers proxied and HASS works perfectly.

Check this and enjoy.

Kman

5 Likes
56

Thanks =) This helped me!

57

I know this is an old thread, sorry for resurrecting it
I’m going to give this a try this weekend probably, but I want to make sure about a couple of things before I dedicate another RPI :).

  1. My internal network is running off of a dual homed linksys router.
  2. The backup path, goes to my verizon wireless modem.
  3. The primary path, goes to an AT&T router, which connects to AT&T through DSL (I know, I live in the country, it sucks).

So my HA environment is behind two routers 99% of the time, and the other 1% of the time, not getting to HA is the least of my worries. So lets focus on the path out through the AT&T router. Where should I install NGINX? Should it be between the AT&T router and the Linksys Router, or on the main network with all the rest of my servers behind the Linksys router?
I understand internal networking, but when it comes to proxy’s and reverse proxy’s my knowledge falls off quickly.

What I want to be able to do is this.

  1. Access HA remotely via web browser
  2. SSH into my HA server and hopefully my other servers without having to go through the HA server to get to them.
  3. Open a VNC session on any of my servers.
  4. Basically I want to be on my home network without opening every port up on the routers.
  5. I’m not sure if a VPN is a viable solution because of the two router situation.

Thanks

58

Thanks Kman, this old post saved my day!

59

I would suggest, you try the following: http://www.pivpn.io

I took my less than 30 mins to get my VPN up and running (including securing my pi a little bit better). Together with EntryDNS (or DuckDNS, or …) it works like a charme and I don’t have to worry about changing public IP addresses.

After you connect to your home VPN you have FULL access to everything: SSH, VNC, RDP or whatever you need :slight_smile:

Bye,
Daniel

60

same for me, did you solve?

61

Yes. You should of kept reading this thread. You only have to look 5 posts above this one and the answer is there :slight_smile: