i have ZERO desire to open a port on my router for the web GUI to be exposed to the whole world.
however, i already have OpenVPN setup and regularly VPN into my home network. so i created a user and setup the OpenVPN app and i can connect and all that from the iPhone.
so my concern is, that the iOS app will only be able to connect to my HA when the VPN on my iPhone is enabled. will this affect my location tracking?
i suppose i could leave my VPN connected all the time, but that seems like it would kill my data usage when not on wi-fi.
If you do not expose HA to the internet and can only access via VPN, then it will affect your ability to use the app as designed. The app must be able to “phone home” with the location data and if VPN connection is required to do so, it must be enabled when the app tries to make the request.
I don’t see how simply having the VPN enabled at all times would increase your data usage, but I’ve never used VPN on my phone.
I have everything behind my VPN but am running into issues because iOS shuts off the VPN to save battery or whatever. I have recently setup my own Certificate Authority[0] (so I can sign my own SSL certs and load my public root CA key into my boxes so those certs can be trusted) and went through the process of configuring nginx to only respond with my app if the client submits a key that has been signed by my CA [1]. The result is nginx only responding with hass only if the client supplies the correct certificate[2].
I was able to implement the openvpn server part and the profile on my ios devices. Every time I open the home-assistant app on my ios device and my ios device is not in the home network it connects via openvpn to my home network.
What are the pros/cons of this approach vs using nginx or traefik with certbot/letsencrypt?
If using a letsencrypt certificate can you still use the client side cert checks?
What are the pros/cons of this approach vs using nginx or traefik with certbot/letsencrypt?
This is only the server side cert generation. and none for client, and the security depends on having the root certificate so that each client cert can be checked against the root cert
If using a letsencrypt certificate can you still use the client side cert checks?
Yes but that is just for the server side checks. You will still need to become your own CA and issue client certs signed by that.
I am using VPN all the time to access home assistant. I just configured my VPN connection to be used on demand whenever iOS tries to connect to my HASS instance in my local network. I need to do some testing tomorrow with the app but for the web frontend it works just fine.
I used this guide (it’s in german and with a AVM fritz!box in mind) to do it. It was pretty straight forward. Basically you have to build a profile for VPN and add some code to provide that on-demand feature along with rules when to use the VPN connection. In my case it is everything ending with .fritz.box or .local. So whenever I navigate to hass.local or use the new iOS app my iPhone initiates the VPN connection and everythings works as expected.
Ah gotcha - yeah, if they don’t have my root CA then they will see the site as insecure. But the sites I plan on exposing (hass for instance) are too personal for me to trust the common root CA, so I rolled my own (with the added benefit of client-auth!). Even if someone finds my site and accepts the security warning, they won’t have the keys needed to auth against nginx.
I thought about implementing just the same but as I’m not expert with certificate matters I went with the vpn solution. I’d love to hear more on that client-authentication solution.
I wanted to briefly update this and say that due to (what I believe to be) a bug in iOS/Mac OS, Safari does not send the certificate along for websocket connections. Both Safari MacOS and iOS fail trying to initiate a wss:// connection to hass. Up until Sunday, all my testing was in Chrome MacOS which worked.
I have submitted this issue to Apple (and they have since reached out to me for more info) so I hope they will fix this (though I am not sure they will)
Yep, i dont like to open any ports. What I cant find out is how to have several vpn on-demand. As of now, this needs to be chosen in the vpn-list to be activated.
Next step is to have multiple vpn ondemand, with automatically changes.
Edit: Doesn’t seem to be possible, here’s what I did. I have two servers with two different public IPs. Both have openvpn server. One server has HA and the other has plex etc.
I connected the HA server throught VPN to the plex server. In the settings for both im only routing the local IPs for both systems throught the vpn.
The VPN is on all the time on my phone and since the servers are now connected following happens:
Generic internet browsing eg. google.com -> no route throught vpn
