Secure Remote Access - Best Method? What Am I Not Understanding?

[Florian]

@ARea

Is there an up-to-date community page regarding the complete (and detailed) process for getting this to work using DuckDNS & LetsEncrypt? Is this the community standard?

On hass.io it’s easy and all you should need to accomplish that task is to install that add-on:
addons/duckdns/README.md at master · home-assistant/addons · GitHub

Alter the add-on options to use your DuckDNS token and domain:

{
  "lets_encrypt": {
    "accept_terms": true
  },
  "token": "sdfj-2131023-dslfjsd-12321",
  "domains": ["my-domain.duckdns.org"]
}

Configure your configuration.yaml to include the lines ssl_certificate, ssl_key and api_password. Choose a strong api_password and include it in your secrets.yaml:

http:
  api_password: !secret http_api_password
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

Do not open any ports for this add-on because it does not need any to work properly.

@ARea

Is this even necessary to incorporate secure remote access?

Of course!

@ARea

Are there other methods to try that are just as good or better?

There are, but it’s more complicated in the beginning. If you are thinking about incorporating other add-ons like Node-RED or the like that run in their own containers but need access to hass.io it may easier to use a reverse proxy like Caddy or nginx.

Start small and when you feel more used to the concepts you can begin exploring other options.

@ARea

My router control panel has a built in Dynamic DNS setup with a different DNS site (dnsdynamic.com). Could I potentially use this instead of DuckDNS?

You could use that, but you should only if your router also handles the let’s encrypt part. You shouldn’t connect to hass.io without using SSL.

@ARea

I imagine I would still need to setup the port forwarding correctly anyway.

Of course. 8123 needs to be forwarded to your pi regardless of the used dyndns.

@ARea

Would a VPN setup be a more secure setup ultimately for remote access? What is the pros & cons of a VPN setup versus DuckDNS/LetsEncrypt and vice versa?

The main factor that influences to use VPN or not is what you want to do with exposing hass.io to the internet.

• Is it only for having access to it trough your browser? VPN could be an option.
• Is it to use services like Google Assistant, Amazon Alexa or some types of notifications? VPN isn’t an option as the services need to communicate with hass.io directly.