Getting the following alert re the | Home Assistant | Page 1

shadow river Feb 27, 2023, 12:46 PM

#

Move SSL to a proxy server

proper phoenix Feb 27, 2023, 1:16 PM

#

shadow river Move SSL to a proxy server

Like nginx reverse proxy?

shadow river Feb 27, 2023, 1:17 PM

#

Yes

#

Or something else

#

I use Traefik, but HAProxy and Caddy also work well

proper phoenix Feb 27, 2023, 1:17 PM

#

I use Swag to expose most of my services to the internet already, should I just be using that instead?

#

I got to get some sleep but will do some reading tomorrow - I’m not sure if I can expose the VM HA is running in with Swag as it only exposes the docker containers (may be limited to that).

shadow river Feb 27, 2023, 1:19 PM

#

SWAG will work just fine for this

#

SWAG is basically NGINX

proper phoenix Feb 27, 2023, 1:20 PM

#

Yeah, i actually think HA is exposed by swag, I use the same domain across both HA and the others, just different subdomains

#

Which makes me wonder, if I’m already using SWAG, why am I using SSL?

#

😂

#

😴

shadow river Feb 27, 2023, 1:22 PM

#

https://tenor.com/view/sleep-time-gif-25989083

Tenor

proper phoenix Feb 28, 2023, 9:28 AM

#

@shadow river are you able to elaborate a bit more on this or link me to any resources to read up on? trying to get my head around it so i know where I am at and where I need to go, and how to get there too!

shadow river Feb 28, 2023, 9:28 AM

#

On what?

#

(also, I get notifications when you post in the thread, no need to tag me)

proper phoenix Feb 28, 2023, 9:29 AM

#

SSL certs being in HA versus proxy

#

ah cool, i thought you blocked me ages ago for tagging u 😛

shadow river Feb 28, 2023, 9:30 AM

#

I can do that again, and stop answering you, if you want wink

proper phoenix Feb 28, 2023, 9:30 AM

#

stop tempting me 🥺

shadow river Feb 28, 2023, 9:30 AM

#

There's no HA specific documentation on it

proper phoenix Feb 28, 2023, 9:30 AM

#

@... @,,,,,,, @!!!!!!

shadow river Feb 28, 2023, 9:30 AM

#

Certainly not from HA themselves

proper phoenix Feb 28, 2023, 9:31 AM

#

Ahh right. I did see a couple random threads on the forum but no real resolution (i.e. spoon fed version)

shadow river Feb 28, 2023, 9:31 AM

#

The proxy side of it isn't HA specific

proper phoenix Feb 28, 2023, 9:31 AM

#

you suggested moving SSL to proxy, whats the reasoning for that?

#

ah

shadow river Feb 28, 2023, 9:32 AM

#

proper phoenix you suggested moving SSL to proxy, whats the reasoning for that?

Scroll to the top of the thread

proper phoenix Feb 28, 2023, 9:33 AM

#

fk I am going to have to scrap what I have done and start from scratch, just hosting the SSL within the proxy itself?

shadow river Feb 28, 2023, 9:34 AM

#

Well, start the SSL bit from "scratch", yes

proper phoenix Feb 28, 2023, 9:34 AM

#

Yeah...

shadow river Feb 28, 2023, 9:34 AM

#

Configure NGINX to do SSL for HA, with the same hostname etc as you use currently

#

Remove SSL from HA

#

... profit?

proper phoenix Feb 28, 2023, 9:35 AM

#

Might pester the good peeps on the LSIO discord for a moment 😄

shadow river Feb 28, 2023, 9:36 AM

#

The only thing with HA is that you need to enable websockets in the proxy

#

Or just use Traefik

proper phoenix Feb 28, 2023, 9:42 AM

#

What sets Traefik apart, besides its many features, is that it automatically discovers the right configuration for your services. omg

shadow river Feb 28, 2023, 9:42 AM

#

Only if you're running stuff in Docker, but pretty much yes

proper phoenix Feb 28, 2023, 9:42 AM

#

ah, home assistant is the only thing i do not use in docker

shadow river Feb 28, 2023, 9:42 AM

#

I use it for HA with HA not in Docker, and it's not any harder there

proper phoenix Feb 28, 2023, 9:42 AM

#

ah, vm?

shadow river Feb 28, 2023, 9:44 AM

#

Nah, Core

proper phoenix Feb 28, 2023, 9:44 AM

#

whats that running on? I am running OS in a VM

shadow river Feb 28, 2023, 9:45 AM

#

I'm running it bare metal on a Mini PC

#

(AMD Ryzen)

proper phoenix Feb 28, 2023, 9:46 AM

#

ah righto

#

so looking thru my SWAG config files, like ssl.conf, it already has SSL certs and keys referenced, so am I just doubling up by having them in HA as well?

shadow river Feb 28, 2023, 9:49 AM

#

Well, yes, but no

#

Are you using SWAG for HA?

#

If so then you can simply remove SSL from HA and tell NGINX to use http:// for the proxy_pass

proper phoenix Feb 28, 2023, 10:12 AM

#

shadow river If so then you can simply remove SSL from HA and tell NGINX to use `http://` for...

I’ll give it a shot. Can I just get rid of the http.yaml file?

shadow river Feb 28, 2023, 10:13 AM

#

Well, probably not, because ... you know ... proxy 😉

#

https://www.home-assistant.io/integrations/http#reverse-proxies

proper phoenix Feb 28, 2023, 10:14 AM

#

😂

proper phoenix Feb 28, 2023, 10:38 AM

#

so got rid of the SSL cert lines, but that did not work... now to figure out how to make the SWAG side work I guess

shadow river Feb 28, 2023, 10:41 AM

#

https://community.home-assistant.io/t/reverse-proxy-using-nginx/196954

#

First Google hit, but it looks right

proper phoenix Feb 28, 2023, 10:48 AM

#

https://community.home-assistant.io/t/reverse-proxy-using-nginx/196954/74?u=beasthouse

ok this is interesting...

#

tried that and getting a 502 to the domain, and ERR_CONNECTION_REFUSED to the IP addy

shadow river Feb 28, 2023, 11:04 AM

#

Well, you should be able to hit HA directly on the IP, with http:

proper phoenix Feb 28, 2023, 11:05 AM

#

Nah, just get ERR_CONNECTION_REFUSED

This site can’t be reached10.0.0.245 refused to connect.
Try:

Checking the connection
Checking the proxy and the firewall

#

wonder if its one of my proxy settings

#

likely

shadow river Feb 28, 2023, 11:05 AM

#

Well, can you reach HA directly?

proper phoenix Feb 28, 2023, 11:17 AM

#

nope. I am thinking maybe it is cloudflare or my port forward now

shadow river Feb 28, 2023, 11:18 AM

#

Stop

#

Are you trying to reach HA on the LAN IP and port?

#

http://192.168.0.42:8123/

#

?

proper phoenix Feb 28, 2023, 11:18 AM

#

yes

shadow river Feb 28, 2023, 11:19 AM

#

Right, well, then Cloudflare and port forwarding have FUCK ALL to do with it

proper phoenix Feb 28, 2023, 11:19 AM

#

10.0.0.245:8123 and 10.0.0.245:2096

#

I think my port is set to 2096

shadow river Feb 28, 2023, 11:19 AM

#

What?

#

Why the fuck...

proper phoenix Feb 28, 2023, 11:19 AM

#

that is what is popping up in the CLI

#

lol

shadow river Feb 28, 2023, 11:19 AM

#

You changed https://www.home-assistant.io/integrations/http#server_port?

#

If you didn't then the port is still 8123

proper phoenix Feb 28, 2023, 11:20 AM

#

correct, but even with removing that from the http config, its still on 2096

shadow river Feb 28, 2023, 11:20 AM

#

Then you didn't restart HA

#

And you're nuts for changing it

proper phoenix Feb 28, 2023, 11:20 AM

#

shadow river Then you didn't restart HA

just rebooted the VM twice?

shadow river Feb 28, 2023, 11:20 AM

#

Then I have no idea what you fucked up

#

Check your config file again

#

And then check HA's log file

proper phoenix Feb 28, 2023, 11:21 AM

#

hehehe alright...

shadow river Feb 28, 2023, 11:22 AM

#

2021-05-16 13:49:21 INFO (MainThread) [homeassistant.components.http] Now listening on port 8123
``` from one of my old log files

proper phoenix Feb 28, 2023, 11:23 AM

#

hmmm wonder if i installed the cloudflared add on... will check that out

#

something is off

#

and whatever youtube i watched on this is what prompted me to go with 2096 😄

shadow river Feb 28, 2023, 11:24 AM

#

If you find out who that was, let me know so I can warn others to avoid them

proper phoenix Feb 28, 2023, 11:24 AM

#

EverythingSmartHome - know him? 😄

shadow river Feb 28, 2023, 11:24 AM

#

Oh... god

proper phoenix Feb 28, 2023, 11:24 AM

#

lol

#

hmmm nup no add ons...

shadow river Feb 28, 2023, 11:25 AM

#

#1079727835566055505 message

proper phoenix Feb 28, 2023, 11:25 AM

#

noted

#

again

shadow river Feb 28, 2023, 11:25 AM

#

But also... check the log file, see what port it's really listening on

#

It's going to be much easier to tackle this methodically than just bang a bunch of random rocks together

proper phoenix Feb 28, 2023, 11:28 AM

#

what log level should i set it to? at the moment its set as warning

#

trying debug

shadow river Feb 28, 2023, 11:30 AM

#

2021-05-16 13:49:21 INFO (MainThread) [homeassistant.components.http] Now listening on port 8123
                    ^^^^

proper phoenix Feb 28, 2023, 11:30 AM

#

ahh

#

2023-02-28 22:30:56.366 INFO (MainThread) [homeassistant.components.http] Now listening on port 2096

#

removing the entire http config should fix that, but it hasn't been

#

2023-02-28 22:33:25.722 INFO (MainThread) [homeassistant.components.http] Now listening on port 8123

#

or maybe it has been 😄

#

alright now we are in business

#

so. i can now access via 10.0.0.245:8123

#

Just have to figure out the SWAG side of things now

#

time to sleep on it and worry about the rest tomorrow

#

thanks for putting up with me Tink

proper phoenix Mar 1, 2023, 9:44 AM

#

ok so for swag it says make sure that your dns has a cname set for homeassistant and that your homeassistant container is not using a base url - how do I do the latter?

#

hmm looks like its a deprecated thing from a few years ago

proper phoenix Mar 1, 2023, 12:24 PM

#

figured it out, turns out with SWAG, HA does needs its own cname record regardless that the rest of the containers do not!

solar hollow Apr 7, 2023, 3:04 PM

#

proper phoenix EverythingSmartHome - know him? 😄

@shadow river Uhhhh I've literally never advised anyone to change your port to this

#

Sorry for the old tag but someone mentioned me and I couldn't find it then I saw this message saying I did this and was like uh what 😂

shadow river Apr 7, 2023, 3:08 PM

#

And ... where in there did I say you'd said anything? @solar hollow

#

And yes, some rando pinged you in #general-archived ... then deleted it

solar hollow Apr 7, 2023, 3:08 PM

#

You didn't, the OP did. I was just clearing my name was all 😄

#

Ah got it, thanks

shadow river Apr 7, 2023, 3:09 PM

#

Ah... well... I'm not responsible for somebody else... particularly them

#

#general-archived message was the message immediately before the one they deleted

proper phoenix Apr 14, 2023, 11:02 AM

#

solar hollow You didn't, the OP did. I was just clearing my name was all 😄

Sorry! I figured it must have been something you suggested as I had followed one of your videos on this but maybe I threw some input in from some other guide. Didn’t mean to throw you under a bus or anything, love your content, your server and everything you do for the community 🙏

#

https://hodgkins.io/securing-home-assitant-with-cloudflare

#Getting the following alert re the