Unable to Access HA over Local IP after installing NGINX/DuckDNS

Configuration
1

Hello

Basically what the title says. I just installed NGINX and DuckDNS (Following this awesome guide).

The post mentioned above says that:

However, that’s not exactly what happens with my instance:

  • If I access domain.duckdns.com, I get the default NGINX 502 page
  • If I access domain.duckdns.com:8123, it works fine, albeit a bit slow
  • Accessing 192.168.x.xx:8123 provides the HTTP response ERR_EMPTY_RESPONSE
  • Accessing the external IP:8123 provides the HTTP response NET::ERR_CERT_COMMON_NAME_INVALID. Bypassing the page results in the response ERR_CONNECTION_TIMED_OUT

I want to be able to access the page over HTTPS (Which is working), but also really want access to the local IP as well. I don’t need the external IP to work, but it would be nice if it did.

Configuration:
configuration.yaml

# Loads default set of integrations. Do not remove.
default_config:

python_script:

# Text to speech
tts:
  - platform: google_translate
  - platform: edge_tts

automation: !include automations.yaml
script: !include scripts.yaml
scene: !include scenes.yaml


frontend:
    themes: !include_dir_merge_named themes
    
sensor:
  - platform: time_date
    display_options:
      - 'time'
      - 'date'
      - 'date_time'
      - 'date_time_utc'
      - 'date_time_iso'
      - 'time_date'
      - 'time_utc'
      - 'beat'

http:
    ssl_certificate: /ssl/fullchain.pem
    ssl_key: /ssl/privkey.pem


.......

DuckDNS Add-On Configuration:

domains:
  - domain.duckdns.org
token: token-auth-0
aliases: []
lets_encrypt:
  accept_terms: true
  algo: secp384r1
  certfile: fullchain.pem
  keyfile: privkey.pem
seconds: 300

NGINX Add-On Configuration:

domain: domain.duckdns.org
hsts: max-age=31536000; includeSubDomains
certfile: fullchain.pem
keyfile: privkey.pem
cloudflare: false
customize:
  active: false
  default: nginx_proxy_default*.conf
  servers: nginx_proxy/*.conf

Also, off-topic question:
Is there any way to get a backups slug via the UI? The few times I had to run backups via the CLI I had to get the slug via the backups list --raw-json command, but it put the backups in a random order and it took forever to find the one I wanted.

–

Thanks in advance for any assistance!

EDIT: It is taking forever to load the instance over the DuckDNS domain, and once it does load, as soon as I click a button it stops working and returns to the loading circle again. The app also won’t connect either, just displays an endless spinner.

2

OK so the first thing I can see here -
You have the SSL certs in the Home Assistant config. You SHOULD NOT.

The idea is to have Home Assistant accessible over HTTP on port 8123 so it can be accessed by it’s IP address. Nginx is the magic part, it does the proxying to Home Assistant, so it receives the https requests and then proxies them to Home Assistant.

Home Assistant will need both
use_x_forwarded_for: true and also the trusted_proxies: setting so that it can receive requests from Nginx - without this setting, it will refuse the connection from Nginx.

4

Thanks for the quick reply!

Just to make sure I understand you correctly, I should modify the configuration.yaml file as follows:

  • Comment out http: and the items below it
  • Add the following to the file:
trusted_proxies:

use_x_forwarded_for: true

Thank you!

5

Just had a quick look at the Nginx docs:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24

Thats what your http section should look like.

Edit:

1 Like
6

Thanks!

Since the web UI is not loading at all, and SSH is refusing the connection, is there a way I can use nano or vim to edit the file in the CLI that appears when I plug an HDMI cable into the pi?

7

Yes.
When you see the screen with the Home Assistant text and the IP addresses etc it will say ha>

Type login and press enter to get a Linux shell.

1 Like
8

To answer your next question you might have - because I had to go looking on my own system.

/mnt/data/supervisor/homeassistant/ is where the files are when you are in that shell.

1 Like
10

Hello

Tried that, then ran “core restart”. However, that command returns “Error: No Home Assistant Core responce, assuming a fatal startup error”. Don’t know what went wrong.

But the same things as for assessing the install are still occurring as described in my first post. (I can still access the spinny-wheel via the duckdns uri).

Here is the vi editor for the configuration file:

IMG_3571
IMG_35712268×3076 1.19 MB

(Please ignore the horrible quality and dusty screen)

Thanks for your help!

11

I can’t fully tell - but it LOOKS to me, like that x in use_x_forwaded_for: true is a big X and not a small x…

Check that and then instead of running core restart run core check and let it do a full check of all the config and spit out the relevant errors.

The spiny thing is expected - because Home Assistant uses a service worker like all modern web apps. So the service worker is installed in the browser and is running, even though Home Assistant is not accessible

12

Yup, that could be it. The reason I must have put the big X is because I’m used to headers like this one: X-Forwarded-For - HTTP | MDN

I think it’s still broken:

Post “http://supervisor/core/check”: context deadline exceeded (Client.Timeout exceeded while awaiting headers)

EDIT: Forgot to mention that I also removed a space from before the “- 172” line. It looked like it might have been indented too much.

EDIT #2: I tried to run restart again, it returned

Error: another job is running for job group container_homeassistant

Did the “check” command get it stuck in some sort of endless loop?

13

Yeah… I kinda wasn’t sure how it is working to be honest, when I saw the spacing in the file. It looks like TAB has been used rather than spaces.

it should be:

http:
  use_x_forwarded_for: true

not

http:
    use_x_forwarded_for: true

ie - each subsection should be 2 more spaces than the previous section.

The check command might still be running behind the scenes for sure, because it usually takes about 5 minutes to run, I think it builds a temporary virtual environment and then loads the config into the new homeassistant behind the scenes.

14

Gotcha. I thought it was 4 (Thinking TAB), so that’s what I used. Went back in and changed it to 2 spaces for indent instead.

Exited that and it says

Get “http://supervisor/network/info”: dial tcp 172.xx.xx.x:80 connect: connection refused

For the record, I don’t have port 80 forwarded.

Trying to “core restart”, I get

Post “http://supervisor/core/restart”: dial tcp 172.xx.xx.x:80 connect: connection refused

The IP in both messages is the same.