mirror of
https://github.com/home-assistant/home-assistant.io.git
synced 2025-05-10 21:18:58 +00:00
59cc1f0d18
HomeAssistant uses a 55 second interval[1] to send heartbeats to
the Lovelace UI over WebSockets. If the tunnel timeout[2] is not
set, the WebSocket connection from the browser to the server is
reset every 50 seconds. When the connection resets, it reconnects
automatically, and causes the page to reload. Any unsaved data in
forms is lost.
This commit adds a sane default of 60 seconds to the HAProxy
configuration for tunneled connections, so that the frontend
WebSocket connection doesn't time out every 50 seconds.
[1]: 9c551ae85d/homeassistant/components/websocket_api/http.py (L111)
[2]: https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4-timeout%20tunnel
Related: home-assistant/home-assistant-js-websocket#108
110 lines
3.5 KiB
Markdown
110 lines
3.5 KiB
Markdown
---
|
||
title: "HAProxy"
|
||
description: "Documentation about setting up Home Assistant with HAProxy"
|
||
---
|
||
|
||
Using HAProxy to proxy for Home Assistant allows you to serve Home Assistant securely over standard ports with HTTP to HTTPS redirection.
|
||
|
||
### Install HAProxy on your server
|
||
|
||
This will vary depending on your OS. Check out Google for this.
|
||
|
||
### Obtain an SSL certificate
|
||
|
||
There are multiple ways of obtaining an SSL certificate. Let’s Encrypt is one method.
|
||
Use Google for this, but a good example of using Certbot can be found [here](https://www.digitalocean.com/community/tutorials/how-to-secure-haproxy-with-let-s-encrypt-on-ubuntu-14-04).
|
||
|
||
### HAPRoxy Configuration
|
||
|
||
The following configuration updates HAProxy defaults for more secure ciphers for SSL and logging and connection
|
||
timeouts.
|
||
|
||
Items to update for your deployment:
|
||
|
||
* `bind`: Update the ports HAProxy listens on for forwarding.
|
||
* `subdomain.domain.com`: Your domain to use
|
||
* `ssl crt`: The path to your SSL certificate.
|
||
* `server hass 127.0.0.1:8123`: The IP and port location of your Home Assistant instance.
|
||
|
||
```text
|
||
global
|
||
log /dev/log local0
|
||
log /dev/log local1 notice
|
||
chroot /var/lib/haproxy
|
||
stats socket /run/haproxy/admin.sock mode 660 level admin
|
||
stats timeout 30s
|
||
user haproxy
|
||
group haproxy
|
||
daemon
|
||
|
||
# Default SSL material locations
|
||
ca-base /etc/ssl/certs
|
||
crt-base /etc/ssl/private
|
||
|
||
# Default ciphers to use on SSL-enabled listening sockets.
|
||
# For more information, see ciphers(1SSL). This list is from:
|
||
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
|
||
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
|
||
ssl-default-bind-options no-sslv3
|
||
maxconn 2048
|
||
tune.ssl.default-dh-param 2048
|
||
|
||
defaults
|
||
log global
|
||
mode http
|
||
option httplog
|
||
option dontlognull
|
||
timeout connect 5000
|
||
timeout client 50000
|
||
timeout server 50000
|
||
timeout tunnel 60000 # long enough for websocket pings every 55 seconds
|
||
timeout http-request 5s # protection from Slowloris attacks
|
||
|
||
frontend www-http
|
||
bind *:80
|
||
redirect scheme https
|
||
|
||
frontend www-https
|
||
log /dev/log local0 debug
|
||
bind *:443 ssl crt /etc/haproxy/certs/MYCERT.pem
|
||
acl hass-acl hdr(host) -i SUBDOMAIN.DOMAIN.COM
|
||
use_backend hass-backend if hass-acl
|
||
|
||
backend hass-backend
|
||
server hass <Home Assistant Server IP>:8123
|
||
|
||
mode http
|
||
option forwardfor
|
||
http-request add-header X-Forwarded-Proto https
|
||
http-request add-header X-Forwarded-Port 443
|
||
```
|
||
|
||
### Forward Ports
|
||
|
||
Forward ports 443 and (optionally) 80 to your server on your router.
|
||
|
||
Do not forward port 8123, HAProxy takes care of securing the connection with HTTPS on 443.
|
||
If 8123 is forwarded then it will not be secured.
|
||
|
||
Replace 443 with whatever port you chose to bind to in the config if different.
|
||
|
||
### Configure Home Assistant HTTP Component
|
||
|
||
In your `configuration.yaml` file, edit the [http component](/integrations/http/).
|
||
|
||
```text
|
||
http:
|
||
# For extra security set this to only accept connection on localhost if HAProxy is on the same machine
|
||
# server_host: 127.0.0.1
|
||
# Update this line to be your domain
|
||
base_url: https://example.com
|
||
use_x_forwarded_for: true
|
||
# You must set the trusted proxy IP address so that Home Assistant will properly accept connections
|
||
# Set this to your HAProxy machine IP, or localhost if hosted on the same machine.
|
||
trusted_proxies: <HAProxy IP address here, 127.0.0.1 if same machine>
|
||
```
|
||
|
||
### Restart or Reload HAProxy
|
||
|
||
Use your OS method of restarting or reloading HAProxy. Use Google for this.
|