I use nginx proxy manager and then a cloudflare to protect my actual IP

I’ve got it accessible from the internet through a reverse proxy… My default https drops all connections, so you need to access the right subdomain, which are not advertised on dns or certificates (I use a wildcard). Probably not perfect though but it helps a bit. I also have geo-blocking enabled on my pfSense router, so basically everything outside my country gets blocked by the firewall anyway.

It will always be a risk vs benefit consideration.

Why not a presence sensor of and kind? Check your router’s WiFi client list for your phone MAC or something

I’m using cloudflared to give it a bit more protection over a plain reverse proxy

My HA instance is publicly accessible (with 2FA) through Nabu Casa’s cloud service. Happily paying the subscription price of a whole $7/mo for that feature and to support them.

I can quickly switch it to my own reverse proxy if necessary.

I’ve got mine accessible with SSL proxy. I would say make sure you use an alternative port to help reduce exposure during scans.

Layers

HA has it’s own built in IP ban function with the HTTP(S) Integration, but that might only see NAT’d addresses (ie the entire internet has the same address as far as HA is concerned), and is really only intended for protection from someone already on your network.

You should also have some other form of external facing brute-force protection with HAproxy, nginx, fail2ban, etc.

You should have a firewall somewhere, maybe a function on your router, maybe a separate box. If possible also use geographical IP ranges to only allow your region(s).

All of that can either be at home, or on a VPS if you wanted to bounce all your traffic via a fixed location, perhaps with an outbound VPN from your home to the VPS.

Also use other network presence detection (ie ICMP ping, GPS, etc) to determine if you’re at home.

Or… as others mention… support the devs with their solution.

I’ll add pangolin to the list of things to think about trying. It was relatively easy to set up and it can run locally or on a vps. If it’s on a vps you dont need a constant IP or ddns because your hone server will connect to pangolin on the vps and the vps will serve the apps. youll point the dns records to your vps.

It’s what i use for my extended family to reach my immich instance. No complaints yet whatsoever. It’s traefik+crowdsec+wireguard under the hood but all abstracted into a maintained, easy to use GUI. Youll have granular control over which users can use which services/subdomains and geoblocking etc is effortless.

I put a centralised authentication layer (pocket id) on top of it for easier enrollment across various apps im running but for homeassistant only the built in 2FA should be enough.

It’s generally fine to open it up, if your somewhat know what you’re doing. I wouldn’t do it without some protection measures like fail2ban and making sure HA is always up to date.

Nabu Casa, the manufacturer of HA, has a paid option where they take care of publicly accessing your local HA instance. I think that’s a good solution as well. It includes backups on their servers.

I don’t really see why you shouldn’t… I have mine behind a reverse proxy, which puts SSL on the public endpoint. The biggest “issue” today, is the isp rotating my ipv4 address to often.

Tailscale is possibly a solution for you.

Mine is open to the internet, via a nginx reverse proxy. I made it ban people who try to brute-force my password. It’s been fine like that for years now:

http:  
  trusted_proxies:  
    - w.x.y.z  
  use_x_forwarded_for: true  
  ip_ban_enabled: true  
  login_attempts_threshold: 10  

I have mine available as a tor hidden service.

What I personally do is have it accessible over WireGuard. Open TCP ports to the Internet is a bad idea. This does mean you have to launch WireGuard every time, but it’s way more secure

Mine is on the internet. The real risk is a zero day auth bypass, password cracking won’t really work when the HA interface sends notifications on authentication failures.