Two Home Assistant Instances on same network over HTTPS and DuckDNS

[NilsK89]

How can I use my second HA instance with https?
The first instance has https, but how can I add a second, because I can only set port 80 and 443 one time in my router.

[NathanCu (Nathan Curtis)]

If you aren’t into advanced networking, tread lightly. This should be technically possible following a similar path as this post…

Help understanding how to host this with SSL?

I have a public domain, let’s call it “domain dot com” and it has an SSL certificate. I am installing HassOs on a raspberry pi 4. I have a subdomain for that domain pointed to all my self-hosted things, let’s call it “home dot domain dot com” and I have a paid for SSL certificate for that domain. I have a BUNCH of services hosted there, with reverse proxies in subdirectories to various ports. For example, “home dot domain dot com/airsonic/” or “home dot domain dot com/shinobi/” or “home dot …

But.

Very non standard, you need an above average knowledge of networking and unless you Absolutely need access to the second configuration out of the firewalli wouldn’t do it…

(is it dev/test, VPN in and hit it from its real name behind the firewall)

[tmjpugh]

@NilsK89

because I can only set port 80 and 443 one time in my router.

Why do you have 2 HA instances? Can you just combine both using mqtt or api and display both using in one of the 2 UI?

I would use a reverse proxy like Nginx if both needed to be exposed.

[francisp (Francis)]

Indeed, a reverse proxy is needed.

@tmjpugh

Why do you have 2 HA instances?

Eg. In my case, today is the last Wednesday of the month, so tomorrow I’m going to install 2023.11.0b0 on my test-HA (the beta always arrives late, so I do it the day after)

[Tinkerer (aka DubhAd on GitHub)]

@NilsK89

because I can only set port 80 and 443 one time in my router.

So forward other ports, you’ve got 65,535 to pick from. For instance, if you forward 12345 to the second HA then you’d connect with https://other-ha.example.com:12345/

The only problem comes if you’re not yet using DNS-01 validation for LetsEncrypt, but DuckDNS supports that so you should be using it.

[Tinkerer (aka DubhAd on GitHub)]

Oh, and I should have said that you can always use just one port if you’re using reverse proxy server.

With Traefik, or NGINX, or Caddy, or … just about anything, you can forward 443 to the proxy, and have it forward the connection based on the hostname. That’s how I expose many services at home. The only potentially fiddly bit is SSL certificates (unless you use Traefik where that’ll handle it all for you), but again that would be handled on the proxy host.