Using a homeassistant supervised with external nginx reverse proxy results in no connection from internet

I am using the homeassistant supervised container set, and I can access it from my LAN without any issue: I just point my browser to http://raspberrypi:8123 ans everything works.

My setup is the following:
I have my router forwarding port 444 to 443 (so, from the internet, I am accessing

I have an nginx server already running for other purposes, and I want to use that as a SSL termination point for the connections comming from the internet. In this case, the configuration of nginx is

server {
    listen 443 ssl default_server http2;

    # enable TLS
    ssl on;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Enable HSTS (HTTP Strict Transport Security) for half a year
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";

    # set the certificates
    ssl_certificate /etc/letsencrypt/live/;
    ssl_certificate_key /etc/letsencrypt/live/;

    # enable OCSP stapling to speed up first connect
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam /etc/nginx/tls/private/dhparam.pem;

    # Enable session resumption
    ssl_session_cache shared:SSL:30m;
    ssl_session_timeout 1d;

    # Set several headers
    proxy_hide_header X-Powered-By;
    proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;

    location / {

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_buffering off;

Finally, in /usr/share/hassio/homeassistant/configuration.yaml, I have added the following section:

  internal_url: http://raspberrypi:8123

Can somebody give me a hand?

See the first breaking change in the release notes for 2021.7.

@potato_tester, in addition to tom_l’s answer, you can have a look at my similar problem and solution: “Unable to connect to Home Assistant” from WAN (Duck DNS + NGINX)

add the following to your Configuration.yaml

  use_x_forwarded_for: true
    -  # Add the IP address of the proxy server

you can find the proxy ip by locking the homeassistant log

@RaA11 if you are going to recommend config please format it correctly so that the required indention is preserved.

1 Like

fixed, sorry that was my my first post :slight_smile:

You’ve been lurking too long. Join in!

@tom_l Thank you for your answer! Indeed, I had not checked the changelog for this version. I have updated my configuration to look like:

  internal_url: http://raspberrypi:8123

  use_x_forwarded_for: true
  trusted_proxies: []

(The reason for using the is because my docker interface is sitting in I have also changed the configuration in nginx, just in case, so that the line

proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;

now looks like

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

After that I have reloaded nginx and restart homeassistant through the Configuration → General → Server controls window… but still no luck.

Why do you have square brackets around the IP address?

That is not what is shown in the documentation.

Pretty sure you will need your local address too.

Hi! Because in yaml these two statements are equivalent, but I like more the second because is more compact:

  - item1
  - item2
array: [item1, item2]

Still, after adding the localhost, still does not work… or by local address you meant the LAN IP address?

why redirect from 444 to 443? why not just 443 and then proxy to 8123? hahahaha

The only way peopel do 80 to 443 just because you dont need to add port on your http or https

Because I have another server already listening to the 443, and I want to keep both servers separated.

if you go that route, you have to use proper json. What you have is not proper json. An IP is not a number, therefore it needs to be wrapped in quotes.

Right, I corrected that :slight_smile: thank you! I am still getting this issue, but I think I have made some progress:

  • if on a laptop on the local network, I set an entry in /etc/hosts file to resolve to the ip of the raspberrypi, I can connect from the laptop to homeassistant using https… everything works.
  • if I connect using that same laptop, without any modification to /etc/hosts, to it does not work.

Then, seems that the problem is caused by my router forwarding external 444 port to 443 in the nginx server. Does this make any sense?

Please, disregard my previous message. Seems that a reset of my router solved the issue :man_facepalming: