Where to configure the server for https and port listening?

[coldspark29]

I have a setup with Home Assistant Supervised and a Nextcloud server on the same device. The Nextcloud server runs on port 80 is already configured with https by adding the certificates in the Apache configuration. The HA server runs on the default port 8123, but it is not secured via SSL, although I am using the same IP and domain for it. I also have the problem that I can’t access HA by typing IP:8123. I have to type IP:8123/lovelace or else be redirected to an empty index.php. . I think I also might have messed up something by tinkering around earlier, because I reinstalled HA and let the Apache of Nextcloud listen on port 8123 earlier, because I did not do what I was doing.

Where can I configure all these server parameters? This is the last step for my setup to be complete

I have found this guide, which seems to be deprecated

Installing TLS/SSL using Let's Encrypt

This guide has been migrated from our website and might be outdated. Feel free to edit this guide to update it, and to remove this message after that. This guide is for users running Home Assistant Core. If you are using Home Assistant do not use this guide. Instead, use the DuckDNS add-on for Home Assistant. This guide was added on 16/03/2017 and was valid at the time of writing. This guide makes the following assumptions: You can access your Home Assistant instance ac…

I am also not sure if this step is necessary, since I have already certified the domain during the Nextcloud installation.

[nickrout]

Apache’s ssl config will not carry to ha. BUT if you are using the same hostname for apache and home assistant you can put the apache certificate in the ssl folder under /usr/share/hassio/homeassistant and then configure the http integration per here HTTP - Home Assistant

[coldspark29]

I tried adding

http:
  server_port: 8123
  ssl_certificate: /etc/letsencrypt/live/hass.example.com/fullchain.pem
  ssl_key: /etc/letsencrypt/live/hass.example.com/privkey.pem
  cors_allowed_origins:
    - https://google.com
    - https://www.home-assistant.io
  use_x_forwarded_for: true
  trusted_proxies:
  ip_ban_enabled: true
  login_attempts_threshold: 5

to my /usr/share/hassio/homeassistant/configuration.yaml, as well as using the Letsencrypt addon and adding the symlinked files, which I put to /usr/share/hassio/ssl. Both don’t work unfortunately. I can still only reach HA via an unsecured http session.

HA also started in safe mode. I guess my configuration was faulty. I guess I will also have an issue with port forwarding. In the docs it says

and this is already done for port 80, which is my Nextcloud. Ah sorry, I guess I have to do this in my router. Bit confused here.

[nickrout]

@coldspark29

ssl_certificate: /etc/letsencrypt/live/hass.example.com/fullchain.pem
`

ssl_certificate: /ssl/fullchain.pem

[coldspark29]

Ah because of the user privileges I guess? No, it is the same root user. Guess it is a relative path then. Trying it out…

[coldspark29]

@nickrout

ssl_certificate: /ssl/fullchain.pem

That also doesn’t work unfortunately.

In the documentation it says that my previous configuration should be valid too

[koying (Chris B)]

@coldspark29

adding the symlinked files,

Not sure what you exactly mean by that, but a symlink to host files won’t be accessible in docker, unless it’s relative links to a path also accessible from the docker container

[coldspark29]

I created symlinks in /usr/share/hassio/ssl to /etc/letsencrypt/live/mydomain/privkey.pem etc. via ln -s . Else I would have copy them manually everytime the certificate is renewed.

@koying

Not sure what you exactly mean by that, but a symlink to host files won’t be accessible in docker, unless it’s relative links to a path also accessible from the docker container

I tried copying the .pem files instead. Same error.

[koying (Chris B)]

@coldspark29

I created symlinks in /usr/share/hassio/ssl to /etc/letsencrypt/live/mydomain/privkey.pem

That won’t work. A symlink is like an http link. From inside the docker, HA will try to access /etc/letsencrypt/live/mydomain/… which will very likely fail.

@coldspark29

Same error

Sorry if I missed it, but what is the actual error/symptoms?
I’m a bit surprised that you can access HA at all if its ssl configuration is faulty. I would expect that you couldn’t reach the GUI at all.

[coldspark29]

I get this error message when trying to restart the server. After rebooting HA starts in safe mode because of faulty configuration.

The system cannot restart because the configuration is not valid: Invalid config for [http]: not a file for dictionary value @ data['http']['ssl_certificate']. Got '/usr/share/hassio/ssl/fullchain.pem'
not a file for dictionary value @ data['http']['ssl_key']. Got '/usr/share/hassio/ssl/privkey.pem'. (See /config/configuration.yaml, line 13).

[koying (Chris B)]

As nickrout said, the path should be /ssl. That path is mounted inside the container and points to /usr/share/hassio/ssl (I think; a docker inspect would tell)

A docker container has no access to the host filesystem.

[coldspark29]

Ah it works now. @koying was right that symlinks don’t work. I copied the files to /usr/share/hassio/ssl/ now and removed all other configuration than

ssl_certificate: ...
ssl_key: ...

Only thing missing is a redirection from http now, but that is not so important.