Customer preparation

Prepare Home Assistant for remote access

Create a Cloudflare account and Tunnel so the house Home Assistant is reachable at a stable https:// URL — without opening router ports — before installing Patrimony Collection. This is step 01 of the path for the next house.

Audience

Estate managers and integrators

Time

About 30–60 minutes for the tunnel (DNS can take longer). The house sitting after this is about 25 minutes.

Cost

Cloudflare Free plan is enough

Note

You do not need the Patrimony add-on for this guide

Contents

Seven quiet steps.

  1. 01Create a Cloudflare account
  2. 02Add your domain to Cloudflare
  3. 03Enable WebSockets
  4. 04Trust the tunnel proxy in Home Assistant
  5. 05Install the Cloudflared add-on
  6. 06Verify from outside the house
  7. 07What to send Patrimony Collection
Why a tunnel

No open ports. Outbound only.

Do not expose Home Assistant by opening port 8123 on the router. A Cloudflare Tunnel creates an outbound encrypted connection from the house to Cloudflare. Traffic reaches HA only through the hostname you publish.

01

Account

Create a Cloudflare account

  1. Open dash.cloudflare.com/sign-up
  2. Sign up with email, or continue with Google / Apple
  3. Verify your email if prompted
  4. The Free plan is sufficient for a single Home Assistant hostname
Cloudflare sign-up
Cloudflare sign-up
Cloudflare Free plan
Cloudflare Free plan
Cloudflare log in
Cloudflare log in

02

Domain

Add your domain to Cloudflare

  1. In the Cloudflare dashboard, choose Add a domain / Onboard a domain
  2. Enter your apex domain (for example example.com) and continue
  3. Select the Free plan
  4. Review DNS records Cloudflare found (you can refine later)
  5. Copy the two nameservers Cloudflare shows. At your registrar, replace existing nameservers with those. Save
  6. Wait until the domain status is Active (minutes to 24 hours)
Domains overview / add a domain
Domains overview / add a domain
Choose Free plan while onboarding
Choose Free plan while onboarding
Cloudflare nameservers to set at your registrar
Cloudflare nameservers to set at your registrar
Active domain overview
Active domain overview

03

Network

Enable WebSockets

Home Assistant needs WebSockets through Cloudflare.

  1. Open your domain in the Cloudflare dashboard
  2. Go to Network
  3. Ensure WebSockets is On
Network → WebSockets On
Network → WebSockets On

04

Home Assistant

Trust the tunnel proxy

Do this before starting Cloudflared so the first remote request is accepted.

Depending on your Home Assistant version, reverse-proxy settings may appear under Settings → System → Network, or only via configuration.yaml. If you do not see the toggles, use the YAML block.

UI (when available)

  1. Settings → System → Network
  2. Turn on Trust X-Forwarded-For and add trusted proxy 172.30.33.0/24
  3. Save, then restart Home Assistant
Home Assistant → Settings → System → Network
Home Assistant → Settings → System → Network

Or in configuration.yaml (always works):

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24

Restart Home Assistant after saving.

05

Tunnel

Install the Cloudflared add-on

On Home Assistant OS, the Cloudflared add-on can create and manage the tunnel for you.

  1. Open Settings → Add-ons (sometimes labeled Apps)
  2. Open the Add-on store. Three-dot menu → Repositories, add https://github.com/homeassistant-apps/app-cloudflared
  3. Refresh and install Cloudflared. Do not start it yet
  4. Configuration: set External hostname to the public name you want, e.g. ha.example.com
  5. Start the add-on. Enable Start on boot and Watchdog
  6. Open Log, copy the one-time Cloudflare login URL, open it while signed into the Cloudflare account that owns the domain, and approve
  7. In Cloudflare → Networking → Tunnels, confirm the tunnel appears and is healthy
Home Assistant Add-ons / Apps
Home Assistant Add-ons / Apps
Cloudflared configuration
Cloudflared configuration
Cloudflare Tunnels — healthy connector
Cloudflare Tunnels — healthy connector
Advanced alternative: create a tunnel yourself under Networking → Tunnels, copy only the --token value into the add-on’s tunnel_token field, and publish a hostname pointing at http://homeassistant:8123. Treat the tunnel token like a password.
Create a Cloudflare Tunnel (advanced)
Create a Cloudflare Tunnel (advanced)
Published application route to Home Assistant (advanced)
Published application route to Home Assistant (advanced)

06

Verify

Check from outside the house

  1. On a phone not on house Wi‑Fi (cellular), open https://ha.example.com
  2. You should see the Home Assistant login page over HTTPS
  3. Log in with a normal HA user to confirm
Home Assistant login over the public HTTPS hostname
Home Assistant login over the public HTTPS hostname

07

Handoff

What to send Patrimony

Keep the tunnel token private. Only the public HTTPS URL is needed for onboarding. Use a neutral name such as https://ha.example.com — not a town or property hostname. Install Patrimony Collection afterward.

ItemExample
Home Assistant URLhttps://ha.example.com
NotesTunnel via Cloudflare; HA OS + Cloudflared add-on

Next sitting: install the custom component, mint a pairing QR, claim in iOS. Repeat on the Add another home checklist.

Integrator guide Add another home

Troubleshooting

SymptomCheck
Domain stuck PendingRegistrar nameservers must match Cloudflare; wait up to 24h; disable DNSSEC at the registrar before switching if needed
Tunnel Inactive / DownCloudflared add-on running? Auth / token completed? Host online?
400 Bad Request / reverse proxy errorsTrusted proxies 172.30.33.0/24 and trust X-Forwarded-For
DNS works but connection failsPublished service URL / external hostname wrong