How to deal with non-SSL Panel iframe pages inside SSL Hass.io environment?

Configuration
52

Hi, I also migrated my installation to docker standalone installation. Can you please share you config, ie. docker-compose file for nginx or give some additional info how you set this up.
Edit: Got it, it does work great. Maybe I latter wrote some my config just for people to find it.

This my docker-compose.yml file for nginx

  nginx:
    container_name: nginx_proxy
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - /opt/nginx/data:/data
      - /opt/letsencrypt:/etc/letsencrypt

I use dynu for my domain. Set up for ssl is really easy. Just grab ssl key from site and and replace token in a line

dns_dynu_auth_token = YOUR_DYNU_AUTH_TOKEN

I tried to open z2m over nabu casa using iframe and it does work. This is great, this is the thing I wanted to do for a few weeks. Some setups are more complex that others but this setup mention by @Remko is easy and this work great.
Thank you for sharing.

53

Hi. I applied your code and it is working with esphome and portainer but for frigate container it is not. Could you please help me to solve it? Thank you.

I used this code in Advanced tab

location /frigate/ {
    rewrite /frigate/(.*) /$1  break;
    proxy_pass  http://10.20.30.105:5000;
}

And this in HA configuration.yaml

  #frigate iframe
  frigate:
    title: frigate
    icon: mdi:webcam
    url: https://hass.local/frigate
    require_admin: true
54

Hi. I did managed to solve it using this help

This is working code in advanced tab for frigate container
!!!
USE IT ONLY ON YOUR LOCAL SERVER.
IT OPENS FRIGATE WITHOUT LOGIN TO HA
!!!

location /frigate/ {
    rewrite /frigate/(.*) /$1 break;
    proxy_set_header Host $host;
    proxy_set_header X-Ingress-Path "/frigate";
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_pass  http://10.20.30.105:5000;
}

HA configuration remains the same (see previous post)

55

This totally works- BUT anyone on the planet can go to

https://yourhomeassistantname.duckdns.org/panelname

and have full access because you’ve served it. Yes, it’s https: so nobody in the middle can interpret it, but whoever is attached can control whatever was served. Try it by opening a browser that isn’t logged into your instance of HA- put that in the browser. Which you may not care if it’s just your holiday lights or something.

Also, for anyone trying to do this with Logitech Media Server, it won’t work (something about local files).

56

They still need to login to Home Assistant

57

True, and I only serve some pages which require a separate login so could be fine.

@DavidFW1960 : no this is not true. The pages are served separate from Homeassistant and can be opened without even accessing homeassistant.

58

Yeah @fmon is damn correct. I found out it today also. I may browse my frigate instance even without login into HA. Thats really bad. USE IT ONLY ON YOUR LOCAL SERVER.

So @fmon and @Remko how to solve this?

59

Create authentication for the separate containers. For example Portainer or Z2MQTT are easy, they allow you to define a separate login. I don’t expose frigate to the outside, rarely need that webpage, the integration offers all I need.
Accessing that I do just in my internal network with a bookmark in my browser to the local ip:port

1 Like
60

And do you use for sth your proposed sollution?

61

sth? I don’t know what you mean here…

62

If you use your solution for something?

63

I would say name the panel a very long string of random characters similar to a client secret but I think that unless you have cutting-edge encryption running the headers are unencrypted even with https: and might be intercepted.
So I guess we try what @Remko said

64

I currently have the setup so that I can access my zigbee2mqtt page on a different location with an additional auth token. It’s working in a new tab, but not in the iframe inside home assistant. I believe it has something to do with displaying the alert popup where you have to enter the auth token but I might be wrong, I just don’t see my zigbee2mqtt page, just a plain white page.
Do you know how to manage the separate page with authentication in the iframe tab?

If you are in a HA-Core setup and use the addon, you can also access the zigbee2mqtt addon from the sidebar. So somehow they also managed to integrate this, even with HA authentication.

65

Is there anything I can do to access my docker containers from within ha remotely and not expose the containers to anyone? Didn’t find anything but maybe Ive overseen something?

66

I can access my containers using nabu casa but only if i use my local wifi.
I can’t access containers if I’m using different network. I don’t know why. My router is pointing back to my ha ip for dns resolving and I’m using adguard for dns rewrite.

67

you can try hass_ingress integration.

68

you can try hass ingress integration, it provides these features:

  • Ingress function similar to Hassio Ingress. (option: work_mode: ingress)
  • Sidebar function similar to Panel_iframe. (option: work_mode: iframe)
  • Work with nginx auth_request for backend services can’t be proxied by ingress. (option: work_mode: auth)
  • Additional http headers passed to the backend service, such as authorization and host, so that we can access the external resources without extra login. (option: work_mode: ingress header: {map})
69

I used this guide to have an iframe on wled page.

this is my config:


location /mountain/ {
    rewrite /mountain/(.*) /$1  break;
    proxy_pass  http://192.168.0.158;
}

the problem is when I click on config that is the page http://192.168.0.158/settings

my ssl port is 8126 and when I point to xxx.duckdns.org:8126/mountain/ all is good and host is reached… but when I click on other links like xxx.duckdns.org:8126/mountain/settings/

it gave me an error:
Loading of configuration script failed.
Incomplete page data!

how to solve?

70

can you give more details please? I dont understand how hass_ingress would help me

71

here Introduce two custom projects for HA ingress