layout: page

description: "Configure Apache to work with Home Assistant as a subdomain"

date: 2016-06-20 13:05

sidebar: true

comments: false

sharing: true

footer: true

This example demonstrates how you can configure Apache to act as a proxy for Home Assistant.

comments: false

sharing: true

footer: true

Backing up and regularly syncing your Home Assistant configuration to [GitHub](http://GitHub.com) has several benefits:

[Travis CI](https://travis-ci.org) is a continuous integration testing system that runs every time the code in your repository is updated and allows you to validate that your code works on a fresh install.

- Create the build script that travis will run to test your repo.

- Create a dummy secrets.yaml for Travis.

python:

- "3.4"

before_install:

install:

- pip3 install homeassistant

script:

Examples:

.gitignore

README.md

automation.yaml

comments: false

sharing: true

footer: true

If your Home Assistant instance is only accessible from your local network you can still protect the communication between your browsers and the frontend with SSL/TLS. You can use [Self-sign certificate](/cookbook/tls_self_signed_certificate/) but your browser will present a warning and some https-only features might not work.

* Your Home Assistant instance is not exposed to the internet. If it is - use [this guide]({{site_root}}/blog/2015/12/13/setup-encryption-using-lets-encrypt/)

* You control a public domain name. The domain doesn't have to point to a site. A domain controlled by a *trusted* friend will do. (A friend you trust not to MITM you)

* Your home router supports custom DNS entries.

$ mkdir certbot

$ cd certbot

* Deploy the value to TXT field using your domain registar.

* Go to a site that queries domain record. For example [this one](https://mxtoolbox.com/TXTLookup.aspx) and look if it sees your brand new TXT field (Don't forget to enter the full domain: `_acme-challenge.mydomain.com`)

* Press Enter at certbot prompt.

If your router uses DNSMasq (for example DDWRT) add the following line to DNSMasq options:

http:

api_password: YOUR_SECRET_PASSWORD

base_url: https://mydomain.com:8123

ssl_certificate: /etc/letsencrypt/live/mydomain.com/fullchain.pem

ssl_key: /etc/letsencrypt/live/mydomain.com/privkey.pem

comments: false

sharing: true

footer: true

If your Home Assistant instance is only accessible from your local network you can still protect the communication between your browsers and the frontend with SSL/TLS. [Let's encrypt]({{site_root}}/blog/2015/12/13/setup-encryption-using-lets-encrypt/) will only work if you have a DNS entry and remote access is allowed. The solution is to use a self-signed certificate. As you most likely don't have a certification authority (CA) your browser will conplain about the security. If you have a CA then this will not be an issue.

comments: false

sharing: true

footer: true

This is useful if you want to have:

* Want to block attackers from even being able to access/scan your port and server at all

* Want to block anyone from knowing your home IP address and seeing your traffic to your Home Assistant

This configuration is part of an effort to apply strong cryptography technologies (like Onion Routing and End-to-End Encryption) to technology we increasingly depend on in our day to day lives. Just like when WhatsApp enabled end-to-end encryption messaging for everyone, every home automation and IoT platform should do the same, because A) the technology is all there, freely licensed and open-source and B) up to this point, all the commercial manufacturers have been doing a horrific job with security.

You can learn more about how Tor can be used to secure home automation and IoT platforms through this short set of slides on the [Internet of Onion Things](https://github.com/n8fr8/talks/blob/master/onion_things/Internet%20of%20Onion%20Things.pdf)

Tor allows clients and relays to offer hidden services. That is, you can offer a web server, SSH server, etc., without revealing your IP address to its users. In fact, because you don't use any public address, you can run a hidden service from behind your firewall. Learn more about Hidden Services on the [Tor Project website](https://www.torproject.org/docs/tor-hidden-service.html.en).

Onion sites are websites that run on a Tor Hidden Service node. "dot onion" sites are an [IETF recognized special use domain name](https://datatracker.ietf.org/doc/rfc7686/).

First, install Tor. On a Debian-based system, you can install the package easily:

You are now done with the Home Assistant Tor server configuration. Make sure your Home Assistant instance is running, and now you can move to client configuration.

Using this setup, you can access your Home Assistant instance over Tor from your laptop or mobile device, using Tor Browser and other software.

On iOS, we have not fully tested this yet, but you should be able to add custom torrc entries on [Onion Browser](https://mike.tig.as/onionbrowser/), Red Onion or TOBY browsers, all available in the iTunes App Store.

With this configuration, only you can access your Home Assistant instance Onion site through Tor, and no one else. You can share the authentication cookie with multiple devices and users, or you can generate a unique one for each - up to you! If you have multiple, say for an industrial, business or corporate configuration, this would provide an easy way to revoke access to a specific user or device.

You could also use Tor as a means to connect your Home Assistant instance to a remote device, sensor or other service that you do not want to or connect provide a direct, open IP connection to. Again, Tor provides authenticated and confidential routing (aka "privacy and encryption") by default, without having to setup TLS/SSL or VPN. It is just important to secure IoT nodes within your network, as it is to secure remote access!

As mentioned, with Orbot on Android, you can enable a "full device" VPN mode, that allows any app you have to tunnel through Tor, even if it is not Tor or proxy aware. This means you should be able to enter your "dot onion" Onion site address into any app you want to access to your Home Assistant instance, and it should work.

<li>{% active_link /docs/ecosystem/appdaemon/api/ AppDaemon API Reference %}</li>

</ul>

</li>

<li>

{% active_link /docs/ecosystem/hadashboard/ HADashboard %}

<ul>

<li>{% active_link /docs/ecosystem/hadashboard/updating/ Updating HADashboard %}</li>

</ul>

</li>

<li>

{% active_link /docs/ecosystem/notebooks/ Notebooks %}

<ul>

<li>{% active_link /docs/ecosystem/ios/integration/ Integration with other apps %}</li>

</ul>

</li>

<li>{% active_link /docs/ecosystem/scenegen/ scenegen %}</li>

<li>{% active_link /docs/ecosystem/synology/ Synology %}</li>

</ul>

</ul>

</div>