August 2026 – LearningThings

In this guide, we will configure secure remote access to a Home Assistant installation running as a Docker container on a Raspberry Pi.

When finished, Home Assistant will be available through an address such as:

https://homeassistant.example-tailnet.ts.net

This setup requires:

no router port forwarding,
no public IPv4 address,
no dynamic DNS service,
no publicly accessible reverse proxy.

Access remains restricted to devices that are connected to your private Tailscale network. Tailscale Serve provides the HTTPS connection within your private tailnet.

Important: Do not confuse Tailscale Serve with Tailscale Funnel. Serve makes a service available only within your private tailnet. Funnel would expose the service publicly on the internet.

The account names, IP addresses, and tailnet names used in this guide have been anonymized.

System Used for This Guide

This guide was created using the following environment:

Raspberry Pi
Debian GNU/Linux 13 “Trixie”
Docker
Home Assistant Container
iPhone with the Home Assistant and Tailscale apps

Once configured, the connection works like this:

Home Assistant app on the iPhone
                  │
             HTTPS + Tailscale
                  │
https://homeassistant.example-tailnet.ts.net
                  │
           Tailscale Serve
                  │
       http://127.0.0.1:8123
                  │
      Home Assistant container

1. Check the Home Assistant Installation Type

In Home Assistant, open:

Settings → About

The installation type is shown on this page.

In this case, it is:

Home Assistant Container

This is important because Home Assistant Container does not include the Supervisor or an app/add-on store. Additional services such as Tailscale must therefore be installed directly on the Raspberry Pi operating system rather than inside Home Assistant.

2. Connect to the Raspberry Pi

Example SSH command:

ssh pi@192.168.178.50

Replace the IP address with the local IP address of your own Raspberry Pi.

Check the installed operating system:

cat /etc/os-release

A possible output is:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
VERSION_ID="13"
VERSION_CODENAME=trixie

Next, check whether Home Assistant is running:

docker ps

The Home Assistant container should appear in the output, for example:

IMAGE                                          NAMES
ghcr.io/home-assistant/home-assistant:stable   homeassistant

You can also check the installed Docker Compose version:

docker compose version

3. Install Tailscale on the Raspberry Pi

Tailscale provides an official installation script for Linux:

curl -fsSL https://tailscale.com/install.sh | sh

If curl is not installed, install it first:

sudo apt update
sudo apt install curl -y

Then run the Tailscale installation command again:

curl -fsSL https://tailscale.com/install.sh | sh

4. Connect the Raspberry Pi to Tailscale

After installing Tailscale, start the authentication process:

sudo tailscale up

The terminal will display a one-time authentication link:

To authenticate, visit:

https://login.tailscale.com/a/...

Open this link in a browser and sign in with the Tailscale account you want to use.

Security note: Do not publish or share one-time Tailscale authentication links.

After authentication has completed successfully, check the connection status:

tailscale status

The output should look similar to this:

100.64.67.98  homeassistant  user@example.com  linux  -

Display the Raspberry Pi’s Tailscale IPv4 address:

tailscale ip -4

Example:

100.64.67.98

This Tailscale IP address is separate from the Raspberry Pi’s normal local network address.

5. Configure Tailscale on the iPhone

Install the official Tailscale app from the Apple App Store.

When starting the app for the first time:

Select “Get Started”.
Allow Tailscale to add a VPN configuration.
Sign in using the same Tailscale account that was used for the Raspberry Pi.
Enable the Tailscale connection.

The Raspberry Pi should now appear in the Tailscale app, for example:

homeassistant
100.64.67.98

An exit node is not required for this setup.

6. Test Access Using the Tailscale IP Address

Before configuring HTTPS, first confirm that Home Assistant is reachable through Tailscale.

Disable Wi-Fi on the iPhone.
Leave mobile data enabled.
Confirm that Tailscale still shows a connected status.
Open Safari.
Open the Raspberry Pi’s Tailscale IP address with the Home Assistant port.

http://100.64.67.98:8123

Replace the example IP address with your own Raspberry Pi’s Tailscale address.

If the Home Assistant login page appears, the Tailscale connection is working correctly.

The traffic is already protected by the encrypted Tailscale tunnel. However, the URL itself still begins with http://. The Home Assistant app may therefore warn that an HTTPS connection should be used.

7. Sign In to Home Assistant

Use the credentials of your existing Home Assistant user account.

Do not use:

the Linux or Raspberry Pi password,
the Tailscale account password,
the Apple ID password.

Home Assistant uses its own user authentication system.

Optional: Reset a Forgotten Home Assistant Password

With a Home Assistant Container installation, the password can be changed from inside the container.

First, open a shell inside the Home Assistant container:

docker exec -it homeassistant bash

List the existing Home Assistant users:

hass --script auth --config /config list

Change the password for the required user:

hass --script auth --config /config change_password USERNAME 'NEW_PASSWORD'

Example:

hass --script auth --config /config change_password johannes 'A-Secure-New-Password'

Exit the container:

exit

Restart Home Assistant:

docker restart homeassistant

After approximately one minute, sign in using the new password.

8. Configure HTTPS with Tailscale Serve

To provide Home Assistant through a valid HTTPS address, use Tailscale Serve.

Run the following command on the Raspberry Pi:

sudo tailscale serve --bg http://127.0.0.1:8123

The resulting connection works like this:

HTTPS request from the tailnet
           ↓
Tailscale Serve on port 443
           ↓
Local forwarding to Home Assistant
           ↓
http://127.0.0.1:8123

The --bg option runs Tailscale Serve in the background.

Enable Tailscale Serve for the Tailnet

The first attempt may display the following message:

Serve is not enabled on your tailnet.
To enable, visit:

https://login.tailscale.com/f/serve?node=...

Open the displayed link and enable Tailscale Serve.

If prompted, also enable:

MagicDNS
HTTPS Certificates

Then run the Serve command again:

sudo tailscale serve --bg http://127.0.0.1:8123

A successful result should look similar to this:

Available within your tailnet:

https://homeassistant.example-tailnet.ts.net/
|-- proxy http://127.0.0.1:8123

Serve started and running in the background.

Check the current Tailscale Serve configuration:

tailscale serve status

Example:

https://homeassistant.example-tailnet.ts.net (tailnet only)
|-- / proxy http://127.0.0.1:8123

The text tailnet only confirms that the service is accessible only from devices inside your own Tailscale network.

9. Fix the “400: Bad Request” Error

When opening the new HTTPS address for the first time, Home Assistant may return:

400: Bad Request

This normally happens because Tailscale Serve acts as a reverse proxy, but Home Assistant has not yet been configured to trust that proxy.

Find the Proxy Address in the Home Assistant Log

Open the HTTPS address again and then immediately check the Home Assistant logs:

docker logs homeassistant 2>&1 | grep -i -E "reverse proxy|forwarded"

Alternatively, display all log entries from the last five minutes:

docker logs --since 5m homeassistant

The log may contain a message such as:

A request from a reverse proxy was received from 127.0.0.1,
but your HTTP integration is not set-up for reverse proxies

The important part is the IP address shown in the log message.

Find the Home Assistant Configuration Directory

Inside the container, Home Assistant uses /config. This path is mapped to a directory on the Raspberry Pi.

Display the Docker mounts:

docker inspect homeassistant \
  --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'

Example:

/home/pi/homeassistant/config -> /config

In this example, the Home Assistant configuration file is located at:

/home/pi/homeassistant/config/configuration.yaml

Edit configuration.yaml

Open the configuration file:

nano /home/pi/homeassistant/config/configuration.yaml

Add the following configuration:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1

If the Home Assistant log shows a different proxy IP address, enter that exact address instead:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - THE_IP_ADDRESS_FROM_THE_LOG

Important: If the configuration.yaml file already contains an http: section, do not create a second one. Add the new options to the existing http: section.

Do not add unnecessarily broad networks such as 0.0.0.0/0 to trusted_proxies. Only trust the proxy address that is actually being used.

Validate the Configuration

Before restarting Home Assistant, check the configuration:

docker exec homeassistant \
  python -m homeassistant \
  --script check_config \
  --config /config

If no error message appears, restart the Home Assistant container:

docker restart homeassistant

After approximately one minute, open the Tailscale HTTPS address again:

https://homeassistant.example-tailnet.ts.net

The Home Assistant login page should now appear without the 400: Bad Request error.

10. Add the HTTPS Address to the Home Assistant App

Open the Home Assistant app on the iPhone.

Depending on the installed app version, the connection settings can usually be found under:

Settings
→ Companion App
→ Your Home Assistant server
→ Connection

Enter the Tailscale Serve address as the external URL:

https://homeassistant.example-tailnet.ts.net

Make sure that:

the address begins with https://,
you do not add port :8123,
Tailscale is connected on the iPhone.

The port does not need to be specified because the HTTPS connection uses the standard HTTPS port 443 and is forwarded by Tailscale Serve to Home Assistant on port 8123.

Internal and External URLs

The internal URL can continue to use the local Home Assistant address:

http://192.168.178.50:8123

Alternatively, a local hostname can be used:

http://homeassistant.local:8123

The Home Assistant app can then use:

At home on Wi-Fi → local internal address
Away from home   → Tailscale HTTPS address

You can also use the Tailscale HTTPS address as both the internal and external address. In that case, Tailscale must remain enabled on the iPhone even while you are at home.

11. Final Test Using Mobile Data

To perform the final remote-access test:

Disable Wi-Fi on the iPhone.
Enable mobile data.
Open the Tailscale app.
Confirm that Tailscale is connected.
Completely close the Home Assistant app.
Open the Home Assistant app again.

Home Assistant should now be available through the following connection:

iPhone
  ↓
Tailscale
  ↓
HTTPS
  ↓
Tailscale Serve
  ↓
Home Assistant

12. Check the Setup After a Restart

After restarting the Raspberry Pi, check the Tailscale connection:

tailscale status

Check the Tailscale Serve configuration:

tailscale serve status

Check the running Docker containers:

docker ps

The Home Assistant container should appear with the status Up.

Useful Administration Commands

Display the Tailscale IP Address

tailscale ip -4

Display Devices in the Tailnet

tailscale status

Display the Tailscale Serve Configuration

tailscale serve status

Disable the HTTPS Proxy

sudo tailscale serve --https=443 off

Disconnect the Raspberry Pi from Tailscale

sudo tailscale down

Restart Home Assistant

docker restart homeassistant

Display the Home Assistant Log

docker logs --tail 100 homeassistant

Security Recommendations

This setup does not require forwarding the Home Assistant port through the router. The .ts.net address provided by Tailscale Serve is accessible only inside your own tailnet.

However, the following security practices are still recommended:

Use a strong and unique password for Home Assistant.
Protect the Tailscale account with multi-factor authentication.
Remove unused devices from the tailnet.
Never publish one-time Tailscale authentication links.
Do not accidentally use tailscale funnel instead of tailscale serve.
Add only the required proxy IP address to trusted_proxies.
Do not configure router port forwarding for port 8123.

Result

Home Assistant is now securely available while away from home:

https://homeassistant.example-tailnet.ts.net

The setup does not require port forwarding, dynamic DNS, or a publicly accessible web server.

Tailscale provides the private network connection. Tailscale Serve handles HTTPS and forwards requests internally to the Home Assistant container.

On the iPhone, the Tailscale connection only needs to be active. The Home Assistant app can then connect to your smart home both at home and while travelling.

Further Documentation

Tutorial done with ChatGPT, tested by real humans.

Month: August 2026

Learning how to secure remote access to Home Assistant Container with Tailscale and HTTPS

System Used for This Guide

1. Check the Home Assistant Installation Type

2. Connect to the Raspberry Pi

3. Install Tailscale on the Raspberry Pi

4. Connect the Raspberry Pi to Tailscale

5. Configure Tailscale on the iPhone

6. Test Access Using the Tailscale IP Address

7. Sign In to Home Assistant

Optional: Reset a Forgotten Home Assistant Password

8. Configure HTTPS with Tailscale Serve

Enable Tailscale Serve for the Tailnet

9. Fix the “400: Bad Request” Error

Find the Proxy Address in the Home Assistant Log

Find the Home Assistant Configuration Directory

Edit configuration.yaml

Validate the Configuration

10. Add the HTTPS Address to the Home Assistant App

Internal and External URLs

11. Final Test Using Mobile Data

12. Check the Setup After a Restart

Useful Administration Commands

Display the Tailscale IP Address

Display Devices in the Tailnet

Display the Tailscale Serve Configuration

Disable the HTTPS Proxy

Disconnect the Raspberry Pi from Tailscale

Restart Home Assistant

Display the Home Assistant Log

Security Recommendations

Result

Further Documentation