Access your internal websites! Nginx Reverse Proxy in Home Assistant.

Sdílet
Vložit

Komentáře • 109

  • @Denizenn
    @Denizenn Před 3 lety +2

    Thank you very much for this! Hours spent yesterday trying to achieve this and got it done in 30 minutes thanks to your video, really appreciate it!

  • @Percy500
    @Percy500 Před 2 lety

    Thank you for this tutorial. I spent over 10 hours now on this problem, becuase I didn't enable Websocket Support, so thanks for this nice video.

  • @miguelgarcia-vg1fh
    @miguelgarcia-vg1fh Před 3 lety +1

    I liked and subscribed to keep on watching your videos on HA so keep em coming.

  • @borishruby7131
    @borishruby7131 Před 9 měsíci

    Hi Chris, wonderful video. Probably the best regarding reverse proxy. Everything is now clear to me. Many thanks. Really love your videos. Keep up the good work!
    But I have found out that the Access List doesn't work for me as it should. If I set some authorization to some host it won't let me in even when putting in the correct credentials. The small window keeps popping up regardless of what credentials I key in. Btw. if you made some changes in authorizations you have to always update the host as well otherwise it won't be applied. That's a bit annoying but it is like that. I've found it somewhere in youtube by chance.

  • @craigw4644
    @craigw4644 Před 3 lety

    Nice presentation, thanks. Since I already have HA running, might as well use it to access some other servers in the house.

  • @hamadal-rakeb9655
    @hamadal-rakeb9655 Před 3 lety

    Great presentation . Thanks a lot

  • @giolovin
    @giolovin Před 2 měsíci

    I have one big question. When should one use 'NGINX Home Assistant SSL proxy' and when 'Nginx proxy manager'? Does the first one only allow one domain and the second one several different domains? What's the difference between those two addons?

  • @khalidelgazzar
    @khalidelgazzar Před 2 lety

    Great video and explaination.. thank you

  • @ThijmenCodes
    @ThijmenCodes Před rokem

    Hi Chris, great video. I Initially setup my HA installation using the other proxy add-on, though I'm currently in the process of building a mediaserver using Jellyfin that I'd like to have remote access to which means that plugin is not sufficient. Was looking for a solution and stumbled across your video... Really convenient!

    • @mostlychris
      @mostlychris  Před rokem +1

      Excellent! Good luck!

    • @gambler3k
      @gambler3k Před rokem

      Do u just have jellyfin as publicly accessible or with username and password? if i use username and password i cant connect to jellyfin through the phone app, or is it a way to combine the username and password in the url?

    • @ThijmenCodes
      @ThijmenCodes Před rokem +1

      ​@@gambler3k I use Jellyfin's built-in authentication! Though I use NGINX to make the instance available to the web, and not Jellyfin's built-in method.

  • @btrigaux
    @btrigaux Před 2 lety +1

    Hi Chris,
    I'm trying to setup this NGINX addon on top of my HA. I took NGINX Home Assistant SSL proxy, which is a bit (or more ?) different from the one you're covering here.
    Please do you have some recommendation about the one to be used ? My config : Home Assistant 2022.8.4 / Supervisor 2022.08.3 / Operating System 8.4 / Frontend 20220802.0 - latest.
    With NGINX installed and configured, only the local http ways is operational. The HTTPS way (with duckdns) doesn't work.
    The strange thing for me is the lack of error message in any log file.
    Thanks for helping, Bernard.

  • @yosypkava8909
    @yosypkava8909 Před 3 lety

    Thank you!

  • @rlillard
    @rlillard Před 2 lety +1

    I followed this guide and I am receiving error 400: Bad Request when accessing this on an external network. Internal works file.

  • @jmaviles
    @jmaviles Před 3 lety +1

    Thank you @mostlychris, I am a little stuck, I am trying throught Force SSL and always same error message like your in min 5, how to resolve it will be great !! I am using duckdns and is not in DNS challenge list options.....any comments?

    • @mostlychris
      @mostlychris  Před 3 lety

      I had used Let's Encrypt add-on before using the Nginx proxy. When I installed the proxy add-on it complained about the existing certs and that there was no auth method. Are you running any other certificate manager on the same device?

  • @antoniodecrisci2369
    @antoniodecrisci2369 Před 2 lety +1

    Another great video. What if you used force SSL with let's encrypt instead of challenge dns? I tried the former but kept getting "internal error" with nginx....so I'm just using DuckDNS with SSL. Not sure why I can't get nginx to work with force SSL.

    • @mostlychris
      @mostlychris  Před 2 lety

      Those are two different things. Force SSL tells the connection to force SSL in the browser. Challenge DNS is a method for you to authorize your SSL certificate with Let's Encrypt. There is a method that will talk directly to your HA instance on port 80 but that has to a port that is open publicly and forwarded to your HA instance. I wouldn't do that. As for the error, not sure what is going on there.

    • @antoniodecrisci2369
      @antoniodecrisci2369 Před 2 lety

      @@mostlychris I agree, I couldn't get it to work (with force SSL) so I unistalled DuckDNS, NGINX, SSL etc. closed all my ports on the router and joined the Nabu Cada subscriptoin plan. Much simpler, and safer now!

  • @G8YTZ
    @G8YTZ Před 2 lety

    Chris, great video! One question; can I use a single domain to connect to different ports on different servers, or do I have to create more domains or perhaps sub domains?

    • @mostlychris
      @mostlychris  Před 2 lety +1

      You need to be able differentiate the request coming into the proxy. You can have one domain but would need to use subdomains to make things go to different ports at the proxy level. sub1.domain.com; sub2.domain.com; etc.

    • @G8YTZ
      @G8YTZ Před 2 lety

      @@mostlychris Thanks Chris, one thing I discovered was that you must refresh the domain entry if you (say) create an access list or add another user. That one has me scratching my head for a while!

  • @Shaq2k
    @Shaq2k Před 3 lety

    Excellent video. Question: If i use the Home Assistant Cloud I don't need to setup this, right?
    Thanks.

    • @mostlychris
      @mostlychris  Před 3 lety

      Correct. If you are using Nabu Casa, you don't need this. However, if you have other things internal to your network then this provides a way to get to them without having to port forward. I have quite a few other internal sites (some noted in the video) that this is great for.

  • @patricklang7201
    @patricklang7201 Před rokem

    I have an external nginx proxy manager, but I always get 403 forbidden, does anyone know why?

  • @michaellim7542
    @michaellim7542 Před 3 lety

    Very informative video. That is what I am looking for to setup nginx. Just one question can i add pi-hole to my network after setting up the Nignx reverse proxy and how to do it?

    • @mostlychris
      @mostlychris  Před 3 lety

      You can use pi-hole internally. It doesn't interfere with this installation. Pi-hole used to be an add-on in Home Assistant but I don't see it now. I personally use AdGuard, which is an add-on and provides similar features. I use "split DNS" so that my local devices resolve to the local IPs and then with the proxy from outside, they are sent to the appropriate device. If you are running Home Assistant, I'd recommend using AdGuard.

    • @loxlie
      @loxlie Před 2 lety

      @@mostlychris One caveat there - AdGuard uses port 80, so that will interfere with LetsEncrypt's HTML-based authentication, and must be disabled while generating/renewing a certificate.

  • @NinaMariePhoto
    @NinaMariePhoto Před 2 lety

    Im having trouble where I dont see any errors with maria or nginx, but when I try to load the nginx UI, it just doesnt load. eventually it times out, what am I doing wrong?

    • @mostlychris
      @mostlychris  Před 2 lety

      We're chatting in Discord about this.

  • @NerdCyclist
    @NerdCyclist Před rokem

    I have managed to get nginx up and running and I also have a spare domain that I can use but (only used for email) what I don't understand is how to point the domain towards the nginx server. I plan to use different sub domains to access different servers on my network, how do I get this to work? Do I have to create A records on the sub domains? As a home ISP doesn't provide static IP I use a DDNS service. Any help would be appreciated

  • @dhtguru6233
    @dhtguru6233 Před 2 lety

    Hi Chris, love your work. Always check with you here before I look anywhere else with new projects. I used this video to setup my remote access. Now its time to renew my Lets Encrypt certificate (6 days left) and I am getting an "Internal Error" msg from the Nginx Proxy Manager page when I select "Renew Now". The forum at Lets Encrypt weren't really knowledgeable about HA and could only offer guesses. Any clue on how I can renew? Thanks in advance.

    • @mostlychris
      @mostlychris  Před 2 lety +1

      I have this issue when it can't use the same auth method as when I set up my initial certificate. I just delete the cert, go into the host and re-add the cert using the verification method I originally used. Your site using that cert will be down for the few minutes that you take to provision a new cert.

  • @kevinstack3305
    @kevinstack3305 Před 3 lety

    Great Video--very informative. This is where I get stuck: What do I type into the Credentials File Content box? I have the JSON file with the API token from Google which is currently downloaded to my PC, but it is not on my Pi.

    • @mostlychris
      @mostlychris  Před 3 lety

      If you are using Google, you should have the JSON file with your credentials. Each DNS provider will have their own auth method and/or credentials format. If Google, you should be able to paste the raw JSON credentials file directly into the box.

    • @ansomeBob
      @ansomeBob Před 2 lety

      I fell over here as well.
      I use duckdns, it's not in the list so it's not clear how to get a credentials file :-(
      Back to researching for me...

  • @cemaranetfeedback6295
    @cemaranetfeedback6295 Před 2 lety

    So... CMIIW the advantages of this method compared to using free ddns such as duckdns / freeddns is that we can access locally and externally from phone, and secondly it's secured right? Other than that Is there any latency improvement ?

    • @mostlychris
      @mostlychris  Před 2 lety +1

      I don't think latency plays into this. DuckDNS in the context of HA is having a single duckdns owned domain point to your HA instance. With the reverse proxy, you can run stuff inside your network that is then accessed via a single port through your router. The proxy picks up the domain name and then forwards it to your internal resource. Access is remote from any web enabled device (phone, PC, etc). I have remote monitoring enabled for some of my internal applications.

  • @dogo7705
    @dogo7705 Před 2 lety

    Was the NGINX proxy manager removed? I don't see it in the add-on store and am unable to add the git through HACS

    • @mostlychris
      @mostlychris  Před 2 lety

      It's in the "Home Assistant Community Add-ons" section. You might have to add that as a repository in the main add-ons section.

  • @Nrodrigues90
    @Nrodrigues90 Před 2 lety

    Did you test the home assistant android app with an access list? When I try to configure my url Im always receiving a bad request because I'm not able to fill the credentials of my access list.

    • @mostlychris
      @mostlychris  Před 2 lety

      I have not tried that. I'll give it a look.

  • @error53ish
    @error53ish Před 2 lety

    Would this still work if your ISP uses CGNAT?
    I'm trying to setup a way to expose my Home Assistant VM to the internet and most methods don't work with CGNAT.

    • @mostlychris
      @mostlychris  Před 2 lety +1

      I don't think so. However, there are options such as Twingate (just released a video on that czcams.com/video/KLb-iY6hcNg/video.html) or VPN such as Tailscale (czcams.com/video/3QEZRpxfZp4/video.html) that I think works behind CGNAT.

  • @Sebastian-xf8je
    @Sebastian-xf8je Před 2 lety

    Anything need to be added for this to function with AdGuard home addon?

    • @mostlychris
      @mostlychris  Před 2 lety

      Are you asking if you can use the AdGuard add-on via the reverse proxy? If so, you could, but not sure what the use case would be.

  • @87vortex87
    @87vortex87 Před 2 lety

    I already connect to HA through VPN, but i need https to connect internally to bitwarden. Bitwarden doesn't accept http traffic, can i just use the HA http ip with port for bitwarden and redirect over https with same HA ip and bitwarden port?

    • @mostlychris
      @mostlychris  Před 2 lety

      I have a reverse proxy set up for bitwarden (now vaultwarden). SSL requires a certificate so I created a domain that I use on the reverse proxy in order to point to my vaultwarden port on the HA server internally. I also use AdGuard to do a DNS rewrite so my vaultwarden secure domain can be reached both internally and externally at the same URL.

  • @Fukaka2343
    @Fukaka2343 Před 3 lety

    Hi, thanks for the great tutorial,
    i have Jboss application with a Ip:port/xyz/abc type of url, which i want to shorten using a reverse proxy,
    would it be possible to acheive?
    i have tried to setup the "custom location" with path but cant get it to get to the (/xyz/abc )
    can you make a tutorial for such., thanks.

  • @naronaroyan323
    @naronaroyan323 Před 2 lety

    What if we don't want to use MariaDB so we don't harm our FlashDrive that HA is installed on?

    • @mostlychris
      @mostlychris  Před 2 lety

      I don't know that you can use anything else other than MariaDB. It mentions this as a requirement. What were you planning on using?

    • @naronaroyan323
      @naronaroyan323 Před 2 lety

      @@mostlychris I don’t think HA’s default is MariaDB. Isn’t it SQL?

  • @groto27
    @groto27 Před 3 lety

    I am also using Google Domains... but I can't seem to find the instructions on how to get this Credentials File Content anywhere on the Google Domains page. Can you point me in the right direction? Thanks!

    • @mostlychris
      @mostlychris  Před 3 lety

      I was using Google Domains but in order to use credentials, you have to use Google Cloud DNS. console.cloud.google.com/net-services/dns. You would use Google Domains as the registrar and Google Cloud DNS to handle the zone files. Sounds strange to use Google to use Google (not a typo) but that is how it works. Of course, you can use any DNS provider that has an automated credential type setup that is compatible with this add-on.

    • @groto27
      @groto27 Před 3 lety +1

      @@mostlychris thank you! I will look into it.

  • @kevinnadjarian3328
    @kevinnadjarian3328 Před 3 lety

    was challenging with CloudFlare but managed to do it, the host is showing "online" but when I open the URL the page is not resolved

    • @mostlychris
      @mostlychris  Před 3 lety

      Is this an external URL that can't be resolved?

    • @kevinnadjarian3328
      @kevinnadjarian3328 Před 3 lety

      ​@@mostlychris When I'm port forwarding 80/443 to my Home Assistant OS (Nginx) my external IP won't resolve, I'm getting a error 522 from Cloudflare, sometime my external IP is redirected to LocalHAIP:8443/hassio/addon/a0d7b954_nginxproxymanager/info and back to my external IP and again error 522 from Cloudflare. when I'm only forwarding HA_Port to HA_Port everything is working fine (this bypass Nginx and just use home assistant default web server). thinking about it now, my gateway (UDM Pro / Ubiquiti) might already use port 443 for remote management.

    • @mostlychris
      @mostlychris  Před 3 lety

      It sounds like you have some routing issues. I use split DNS with AdGuard on my internal network so that it points to the correct place. If you are trying to reach the external URL from inside your local network it might be looping.

  • @jayargent4156
    @jayargent4156 Před 3 lety

    Hi I'm getting an error that port 80 is already in use when I start NginX, I have DuckDNS installed for external access but this does not allow for access on my internal network, My install is in a Virtual machine on Windows10 if this makes any difference? do I do away with DuckDNS and then use this instead? will this then allow me to load my Node red dashboard into HA? because as I'm secure I can only load secure sites in to a Web Card, and my node red is installed within HA, - If I make this secure then I can't use some Alexa integrations - going around in circles, I have already tried the other NginX add-on and almost locked myself out of everything...

    • @mostlychris
      @mostlychris  Před 3 lety

      You are doing a non-standard install so there could be anything using that port. You need to look through all your add-ons and figure out what is using port 80. With my installs, I can use portainer to tell visually tell me what ports I have mapped to what containers. I can tell you how to do this in Linux and unix variants but no so much in windows. Not sure what a web card is so I'm not going to be much help there.

  • @jocelynlagarenne882
    @jocelynlagarenne882 Před 3 lety

    something that is bothering me : once you put everything in place, do you access these internal url directly with a public url (not what i want) OR do you access them Through home assistant interface (requiring to be authenticated into home assistant interface) ?
    i'm looking to this second option to access my grafana, NAS(web interface) etc through my home assistant when i'm outside but with the authentication of Home assistant, without giving a direct access to these web interfaces

    • @jocelynlagarenne882
      @jocelynlagarenne882 Před 3 lety

      in my current setting, it's working while i'm on my LAN network : i can embed my synology web interface into a panel, but when i'm accessing my home assistant from outside, the panel doesnt load ... i cant figure out what is happening.
      do you have any tips ? i would very much appreciate it :)

    • @mostlychris
      @mostlychris  Před 3 lety

      I think this is something best suited for a VPN type setup. It sounds like you are attempting to connect to other devices inside your network that are not on HA itself. This might help: czcams.com/video/biU5l0T4e8w/video.html

  • @murrayzhong3968
    @murrayzhong3968 Před 3 lety

    At 12:25, you said paste in Credential file, but you did nothing.

    • @mostlychris
      @mostlychris  Před 3 lety

      I edited out the actual pasting of the file because it contains my credentials. You would put your own credentials in there based on your DNS provider and how they format it.

    • @murrayzhong3968
      @murrayzhong3968 Před 3 lety

      @@mostlychris use mask to cover your credential

  • @encostablanca
    @encostablanca Před 3 lety

    Since core 2021.7.0 this is not working no more, seems to be a breaking change.. Can't figure out how to allow it in HA..

    • @mostlychris
      @mostlychris  Před 3 lety +1

      Uh oh. What part is not working?

    • @encostablanca
      @encostablanca Před 3 lety

      @@mostlychris remote access due to reverse proxy

    • @mostlychris
      @mostlychris  Před 3 lety +1

      @@encostablanca Yes. There is a breaking change noted. I have not yet upgraded to 2021.7 because I haven't gone through all the breaking changes. I'm not sure what might be misconfigured but make sure you have the configuration settings in the http section as noted below (from their breaking changes section on the website).
      Home Assistant will now block HTTP requests when a misconfigured reverse proxy, or misconfigured Home Assistant instance when using a reverse proxy, has been detected.
      If you are using a reverse proxy, please make sure you have configured use_x_forwarded_for and trusted_proxies in your HTTP integration configuration.
      For more information, see the HTTP integration documentation.
      Additionally, access to Home Assistant from the same IP address as a trusted proxy will be rejected if the request is marked as forwarded.

  • @okanerdem
    @okanerdem Před 2 lety

    If we added access list (password) how can we access from mobile HA app?

    • @mostlychris
      @mostlychris  Před 2 lety +1

      That's a great question. I don't think there is an option for the companion app to authenticate at a proxy level. You might just have to rely on HA's auth for that.

    • @okanerdem
      @okanerdem Před 2 lety +1

      ​@@mostlychris Yeah, I am also use 2FA. Also there is some of firewall rules on cloudflare for now. Other option, just use it with vpn

  • @huhcom
    @huhcom Před 2 lety

    When I click the Web UI link I get a blank page until the connection times out. What should I do?

    • @mostlychris
      @mostlychris  Před 2 lety

      I need more detail on what you are clicking and what you are trying to reach for the URL. Maybe something to post in my discord server.

    • @huhcom
      @huhcom Před 2 lety

      @@mostlychris Just the link to port 81.

    • @mostlychris
      @mostlychris  Před 2 lety

      Are you proxying a specific URL (don't post it here)?

    • @huhcom
      @huhcom Před 2 lety

      @@mostlychris The same URL I use to get to Home Assistant but using port 81 instead port 80.

    • @mostlychris
      @mostlychris  Před 2 lety

      @@huhcom If you get a chance, maybe jump into my discord for a more detailed discussion.

  • @workhard2belazy
    @workhard2belazy Před 3 lety

    HOLY CRAP THIS IS SO EASY assuming you are willing to shell out 12 bucks a year for a domain

    • @mostlychris
      @mostlychris  Před 3 lety

      Yes. I've had domain names for so long now that it's just part of my yearly budge.

  • @mossanaismael134
    @mossanaismael134 Před 3 lety

    Hello I want to make a small company for make proxy server then sell proxies what are requirements ?? Thanks for your help 🤠

  • @crevard203
    @crevard203 Před 2 lety +1

    You had me going there until the creating a domain part :(

    • @mostlychris
      @mostlychris  Před 2 lety

      Domains are not hard to manage. There are a ton of providers out there that you can register a domain with and most of them provide DNS services as well. Were you planning on doing something with the reverse proxy?

    • @irtibatkisileri222
      @irtibatkisileri222 Před 2 lety

      @@mostlychris Thanks for awesome tutorials. In fact I am too lost after sub domain part. It is difficult. Kindly consider doing a follow up tutorial regarding creating a sub domain record and getting that data from domain providers or VPS providers. Thanks.

    • @mostlychris
      @mostlychris  Před 2 lety

      @@irtibatkisileri222 I added that to my list of vid requests.