Trusted networks to authenticate clients - cannot make them work

Configuration
1

Hi there,

I try to use trusted networks to skip / bypass authentication for clients, as I only have one (administrative) user setup and share my Home Assistant with all other family members equally. It’s not exposed to public anyhow.

Thing is, I cannot make this work. Here’s the relevant configuration excerpt:

homeassistant:
  auth_providers:
    - type: trusted_networks
      trusted_networks:
        - 192.168.78.0/24
      allow_bypass_login: true
    - type: homeassistant

http:
  base_url: !secret http_base_url
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.19.0.2

192.168.78.0/24 is my actual network ip mask. I have Home Assistant running in a Docker container on a dedicated host, using Docker compose to front it with a Nginx based reverse proxy. The HA container is using host-network (otherwise discovery does not work) while nginx is running in a Docker network

Still, when accessing the HA frontend via NGinx from within my network, I am asked to authenticate, because my “Computer is not on the whitelist”. Funny thing is when accessing it using native port 8123, authentication is skipped.

How can I solve this or at least - how can I make HA log more information on the authentication process?

1 Like
2

not answering your question but asking one of my own…

If you don’t expose your HA to the outside then why have it behind a proxy in the first place? What benefit does it give you?

3

Yeah, it might sound strange, but it is a common setup. You put an application service behind a reverse proxy to introduce caching and scalability and increase security. Actually I’d like to see HA running “undercover” in Docker, but I need to connect it to the host’s network to make discovery work.

Now, back to the topic, where’s my fault, what are the options?

4

I might be running into the same issue. Are you saying the issue is a result of running behind a reverse proxy?
I tried directly accessing my HA instance (also running in docker) skipping the proxy and it still doesn’t work.
I wish the logs would output what ip it thinks the request is coming from.

5

Could be that this issue is actually related to my attempt of running HA after a reverse proxy. When accessing it directly on port 8123, the issue is gone.

Still, I’d like to have HA on port 80 …

6

then change your port number in your config file from 8123 to 80. :wink:

http:
  server_port: 80

cheers
tom

7

The problem is you haven’t defined a trusted_user