Note: Typically you would use Wireguard VPN for remote access. This is easier, more secure and recommended. But with VPN you cannot use Alexa actionable notifications for example. Or if you don’t want to spin up VPN everytime before you access HA remotely then you need HTTPS access to it.
There are many community sources on how to do this with the duckdns add-on and I used it too. But I found duckdns unreliable. I had issues with it lately. But Fritzbox owners have another choice: MyFritz DDNS. I wanted to give it a try and see if it’s more reliable.
I have it running now for 9 months or so and didn’t have any problem so far. So I wrote down the steps on how I configured it for the benefit of those who want to try this out as well.
Prerequisites:
You do NOT have a full blown internet connection with a DS-Lite stack. DS-Lite does not provide you with a public IPv4 address. It is often provided by Vodafone Cable and 1&1.
Your installed HA system supports add-ons. You know how to install & configure add-ons and how to edit the configuration.yaml and automations.yaml files. You also know how to add blueprints to HA. You have a myFritz account and configured your Fritzbox to use it. You know how to configure port forwarding in your router and port 80 is available for port forwarding. You enabled “Advanced Mode” in your user profile. Otherwise not all HA config options are visible.
I. DDNS:
- login to your fritzbox and take a note of your myFritz address (xxxxxxxxx.myfritz.net). You will find this under Internet → MyFritz Account.
- If you don’t need it then disable HTTPS Remote Internet Access to your router. Internet → Freigaben → Fritzbox-Dienste
- Test if you can ping your router using the myFritz address: ping xxxxxxxxx.myfritz.net
- Optional but recommended: ping your domain from outside your network (e.g. use a smartphone and an app that allows you to ping, e.g. the Fing app on Android)
- If ping succeeds then myFritz DDNS is working.
II. Certificates:
- Install the Let’s Encrypt add-on in Home Assistant
- Configure the add-on: Use http for the challenge setting. The YAML based config should look like this:
domains:
- xxxxxxxxx.myfritz.net
email: your-email@address
keyfile: myfritzprivkey.pem
certfile: myfritzfullchain.pem
challenge: http
dns: {}
- Leave the http challenge port at 80 or use a different one. I used 8001 because 80 is already used in my system.
- Important: configure port forwarding in your router so that the external port 80 points to port 80 (or whatever port you set in the previous step) on the home assistant host’s internal IP address. Note that it has to be port 80 externally!
- Start Let’s Encrypt.
- Check the log file to see if cert generation was successful. If so the certification files with your myFritz domain (xxxxxxxxx.myfritz.net) are now in your /ssl folder.
These are valid for 90 days only. Note that the add-on will stop running after the certificates are created. If you run it again it will check whether or not the certs are still valid and if not it
will generate new ones and then stop again. - Later we will add a blueprint to HA to automatically run let’s encrypt to update the certs if needed.
- Note that port 80 is open on your router but there is no service running behind it. Only if the Let’s Encrypt add-on runs it uses this port for a short period of time and then stops.
I’m not a security expert but as far as I understand an open port that is not used by any app is not a problem. Correct me if I am wrong.
Anyway, there is a way to open the port only while the add-on is running.
You can do this by installing the AVM FritzBox Tools integration which will expose one switch for every configured port forward (e.g. switch.fb7590_port_forward_letsencrypt).
This switch allows you to enable/disable port forwarding for the let’s encrypt add-on.
It can be used in an automation to turn port forwarding on, run the add-on and then turn port forwarding off again.
III. Reverse Proxy
This is not strictly required but I recommend it because when the certificates change you only need to restart the proxy and not Home Assistant itself. Big benefit.
The remaining steps assume that nginx is installed. Otherwise the HA configuration (step V) would be different and additional changes in your router would be required (DNS-Rebind).
- Install the nginx add-on. (called NGINX Home Assistant SSL proxy)
- Configure it. Use your myFritz domain and the certs we generated with the Let’s Encrypt add-on. The YAML version should look like this:
domain: xxxxxxxxx.myfritz.net
hsts: max-age=31536000; includeSubDomains
certfile: myfritzfullchain.pem
keyfile: myfritzprivkey.pem
cloudflare: false
customize:
active: false
default: nginx_proxy_default*.conf
servers: nginx_proxy/*.conf
- Use standard nginx SSL port 443 (or change it if required)
- Start the add-on
IV. Port Forwarding to Nginx (Home Assistant)
- In the fritzbox add an additional port forward for the nginx add-on. I use 8123 (external) and forward it to the nginx SSL port 443 (see III.3).
V. Configure Home Assistant
- Add the following to your configuration.yaml. Note that you need to use the IP address range excatly as shown. Thes are the IP addresses that HAOS uses for the add-ons.
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.0/24
ip_ban_enabled: true
login_attempts_threshold: 5
- Add your myFritz domain to the Home Assistant URL in Setup → System → Network
- Restart HA
VI. Optional but highly recommended: Use 2FA for your HA users !
- In HA click your user name and enable Multi-Factor-Authentication. Use TOTP and an authenticator app like Authy for example.
- Do this for every HA user
Now you should be able to connect securely to Home Assistant from the Internet using this URL: https://xxxxxxxxx.myfritz.net:8123.
You need a user name, password and an additional time-based one-time password to login (if you enabled 2FA and you should!). Note that on your internal network you can still use http://your_internal_ip:8123 (http not https!)
VII. Finally we should add an automation to update the Let’s Encrypt certs if required and restart HA and/or nginx to pick up the new certificates For that you can use this great blueprint from TJ-developer:
https://community.home-assistant.io/t/blueprint-for-automatic-renewal-of-a-lets-encrypt-certificate/300533 This blueprint only allows you to restart HA. The modified version of this blueprint done by “mdeweerd” allows you to restart HA and/or nginx. I used this one and configured it to only restart nginx.
Note that these blueprints do not enable/disable port forwarding in your router as explained in II.8. You would need to add that to the blueprint if you believe this is required.
. I was not aware that there are at least 2 add-ons. Mine does not ask for a MariaDB installation and it looks like this:
