Build Home Assistant Cloud

KINDAreplaces $6.5/mosaves $78/yrback to the verdict

0%0 of 20 items done

Saved on this device only. Tick prerequisites first, then work the phases in order · do not start one until the checks above it pass.

Home Assistant reachable from anywhere through an outbound tunnel or a private network, with certificates, an authentication layer in front, two factor authentication enabled, and backups that go somewhere other than the machine in your cupboard.

estimated effort weekendthe files for this build are in the project pack

PlatformHome Assistant, self-hostedRemote accessAn outbound tunnel, or a private mesh networkCertificatesAutomatic certificates through the tunnel or a reverse proxyAuthenticationHome Assistant's own accounts with two factor, plus a layer in front for the public pathBackupsAutomated snapshots copied off the machine

Before step 1

Everything below is assumed from the first step. Tick each one when you actually have it, not when you plan to.

installfree software; the hardware is usually a small computer costing under 100 USD
Why This build is about reaching it, not creating it. If it is not already working locally, that is a different project.
Get it Follow the official installation for your hardware. Note which method you used, because it determines backup and update procedures. open ↗
Verify It is reachable on your local network and controls a real device
decideboth have usable free tiers for a household
Why They have different tradeoffs for guests, for complexity and for what is exposed. Choosing after building means redoing the work.
Get it A tunnel gives a public hostname that anyone can reach, so it needs the front layer in Phase 4. A mesh network is private to your enrolled devices and simpler to secure, but a guest cannot use it without being enrolled.
Verify The decision and its reasoning are written down before Phase 3
have readyroughly 10 to 15 USD a year
Why Certificates need a hostname, and a memorable one matters when household members type it.
Get it Any registrar, then follow your tunnel provider's instructions for pointing it.
Verify The hostname resolves and serves a valid certificate
have readyfree with a spare drive; a few USD a month for object storage
Why The machine is usually a small computer with a memory card, and memory cards fail. Months of configuration live on it.
Get it Another machine on the network plus an offsite copy, or object storage. Two destinations rather than one.
Verify A backup has been restored onto different hardware
have readyfree if you have anything spare
Why Phase 1 restores onto different hardware, and that drill is what makes everything after it recoverable.
Get it Any spare machine, or a virtual machine. It only needs to run long enough to prove the restore.
Verify A restored instance controls a device

Data model

Create these before the first phase that stores anything. Changing a table later is the expensive kind of change.

- This is infrastructure, so the state worth recording is operational.
- instance · the Home Assistant host, its version, and what it controls
- access paths · the tunnel or mesh, the hostname, and who can reach it
- accounts · household members, their permissions, and which have two factor enabled
- backups · schedule, destination, retention, and the date of the last restore
- The rule that shapes everything: nothing inbound. Every path is either an outbound tunnel or a private network.

Environment variables

These go in a .env file the app reads at startup. The pack's .env.example is this table as a file · copy it, never commit the filled-in version.

Variable	Needed	Example	Where the value comes from
`HA_LOCAL_URL`	required	`http://homeassistant.local:8123`	The local address. Used by backup scripts and monitoring on the local network.
`HA_REMOTE_HOSTNAME`	optional	`home.example.com`	Only if you chose a tunnel. The public hostname.
`TUNNEL_TOKEN`secret	optional	`replace-with-provider-token`	Your tunnel provider's credential. Lives on the Home Assistant machine only.
`BACKUP_DEST`	required	`s3://your-bucket/homeassistant`	Where snapshots are copied. Not the Home Assistant machine.
`BACKUP_RETAIN`	required	`14`	How many snapshots to keep. Enough to go back past a bad update.
`UPTIME_CHECK_URL`	required	`https://home.example.com/manifest.json`	What the external monitor requests. A real endpoint, not the login page, so a broken application is detected.

The build, in order

1
A local installation you have backed up
Home Assistant runs, and losing the machine would not lose your configuration.
1. Note the installation method, because it determines how you back up and how you update.
  Files README.md
2. Scheduled snapshots copied to another machine or object storage. On the device is not off the device.
  Files scripts/backup.sh
3. Before exposing anything. A restore you have not done is a plan, not a backup.
  Files README.md
done when · tick each as it passes
watch out
- Home Assistant on a memory card in a small computer is the common setup and memory cards fail without warning, usually after a year or two of constant writing. Back up off the device from the first day rather than after the first failure, because the configuration represents months of work.
next phase
2
Accounts and two factor, before anything is exposed
Every account that could reach this from outside has a second factor.
1. One per person. Shared credentials cannot be revoked individually, which matters when a phone is lost.
2. On every account that will be reachable remotely. Verify each by signing in fresh.
3. Not everyone needs to control the door lock. Test the restriction rather than trusting the setting.
done when · tick each as it passes
watch out
- A shared household account with a memorable password is fine on a local network and is the weak point the moment anything is reachable from outside. Individual accounts with two factor are the prerequisite for remote access, not an improvement to make later.
next phase
3
Remote access without an open port
You can reach it from outside, and your router has no forwarded port.
1. A tunnel gives a public hostname anyone could reach, so it needs the layer in Phase 4. A mesh is private to your devices and simpler but harder for guests.
  Files docs/access.md
2. Automatic certificates through whichever you chose. A warning page is not acceptable for something your household uses daily.
3. Check the router's forwarding table and scan your home address from outside. Both, because either alone can mislead.
  terminal
  nmap -Pn YOUR_HOME_IP
done when · tick each as it passes
watch out
- Port forwarding is the approach every old guide describes and it puts a login page for your house on the public internet, where it is found by scanners within days. An outbound tunnel makes the connection from inside your network outward, so there is nothing inbound to find.
next phase
4
A layer in front of the public path
If the hostname is public, something stands in front of the application's own login.
1. Basic authentication at minimum, an identity proxy if you want more. Something before the application's login.
  Files Caddyfile
2. The proxy and Home Assistant's own failed login banning. They catch different things.
  Files configuration.yaml
3. A token or client certificate path, tested on a real phone from a mobile connection before anyone else depends on it.
done when · tick each as it passes
watch out
- An authentication layer that blocks the mobile application makes the whole setup useless for the household, and the usual response is removing the layer. Solve it properly with a token or a client certificate the application can carry, and test on a real phone before rolling it out to anyone else.
next phase
5
Notifications and the things the subscription did
You get alerts away from home, and you know which convenience features you gave up.
1. A self-hosted push service or a free tier one. Test from outside the house rather than from the sofa.
  Files configuration.yaml
2. Phone on mobile data, and the case where your home connection drops entirely, which is when you most want the alert and least likely to get it.
3. Voice integrations, managed certificates, and someone else handling security updates for the remote access path.
  Files docs/tradeoffs.md
done when · tick each as it passes
watch out
- Voice assistant integration is the part of the subscription that is hardest to replicate, because it requires a reviewed relationship with each assistant platform rather than a technical workaround. If your household relies on voice control, that may be enough reason to keep paying, and this build should say so rather than pretending otherwise.
6
Updates, monitoring and the householdproduct builder
It keeps working, and someone other than you can get in when you are away.
1. Back up, read breaking changes, update, verify a device responds. Follow it once and record how long it took.
  Files docs/updates.md
2. An external uptime check against the remote hostname, so a failure of the tunnel is caught as well as a failure of the application.
3. How to reach it, what to do if it is down, and who to contact. Somewhere findable without the system working.
  Files docs/household.md
done when · tick each as it passes
watch out
- Home Assistant updates frequently and occasionally introduces breaking changes to integrations, so an unattended automatic update can leave your heating uncontrollable while you are away. Back up before updating, read the release notes for breaking changes, and do not update remotely without a way to roll back.

what this build does not replace

Managed voice assistant integrations, which are the hardest part to replace.
Someone else patching the remote access path.
Frictionless setup for non-technical household members.
Financial support for the open source project the subscription funds.
managed remote access, voice integrations, funding for open source, and low-maintenance security
frictionless family sync
retailer and smart-home integrations
large recipe or product database
mobile polish

after v1, if you want it

A local voice pipeline, accepting that it is a substantial project of its own
A second tunnel or mesh path as a failover, since remote access failing while away is the annoying case
Automated verification that the newest backup actually restores, rather than only that it exists

Need the files? The project pack on the verdict page hands your agent the whole brief · more home.