GlassHomeDash
Skip to content

Updated

View MarkdownOpen in ChatGPTOpen in Claude

Remote Access

Dash runs on your hardware and is not published to the internet. To reach it from outside, you pick one of two shapes:

  1. Join your home network with a VPN. Your device gets a home address, so Dash looks exactly like it does on the couch.
  2. Publish one address through a reverse proxy or a tunnel you run yourself, and tell Dash to trust it.

Both keep GlassHome out of the path. Nothing here is a GlassHome service.

Pick one

Way You open Dash setup Plan
WireGuard your LAN address nothing Free
Tailscale, subnet routes your LAN address nothing Free
Tailscale, machine name a .ts.net address add the address Pro
Reverse proxy at home your domain, resolving home add the address Free
Cloudflare Tunnel, your account your domain, public add the address Pro

Rule of thumb: an address that lands on a home IP (192.168.x.x, 10.x.x.x) is free. A public address is remote access and needs Pro.

Option 1: VPN

Your phone joins the home network. The address never changes, so there is nothing to configure in Dash.

WireGuard

Classic VPN. Fast, tiny, and nobody but you is involved. Costs you one open UDP port.

  1. Install the WireGuard add-on (Home Assistant Community Add-ons), or run WireGuard on your router.
  2. Forward UDP 51820 on your router to the machine running the add-on. UDP, not TCP.
  3. In the add-on config, set host to a public address for your home (a DuckDNS name works), then add one peer per device and name it.
  4. Start the add-on. It writes a config and a QR code per peer; scan it in the WireGuard app.
  5. Turn the VPN on, then open http://<dash-machine-ip>:3123.

Dash needs nothing: you arrive on a home IP, which is always trusted.

Tailscale

No port forwarding, no router work. Runs over WireGuard, coordinated by Tailscale.

  1. Install the Tailscale add-on (or install Tailscale on the machine running Dash, if it is not the Home Assistant box).
  2. Start it, open the login URL from the add-on log, and approve the machine in your tailnet.
  3. Install Tailscale on your phone and sign in to the same tailnet.
  4. Choose how you reach Dash:
    • Subnet routes (free). Set advertise_routes: local_subnets in the add-on, approve the route in the Tailscale admin console, and enable subnet routes on your phone. You then open the normal http://192.168.1.100:3123, and Dash needs nothing.
    • Machine name (Pro). Open http://host.tailnet.ts.net:3123 and add that address in Dash. Tailscale addresses (100.64.0.0/10, *.ts.net) are not home addresses, so Dash counts them as remote access.

Option 2: Your own address

You run the entry point, you own the domain, and only Dash sits behind it.

Cloudflare Tunnel on your own account

No open ports: cloudflared dials out to Cloudflare and traffic comes back down that connection.

  1. Have a domain on Cloudflare, and a Cloudflare account.

  2. Install a cloudflared add-on (for example the community Cloudflared add-on) or run the cloudflared container next to Dash.

  3. Point a hostname at Dash. In the add-on that is an additional_hosts entry:

    additional_hosts:
  - hostname: dash.example.com
    service: http://192.168.1.100:3123

  4. Start it and follow the authorization link once, so the tunnel can create the DNS record on your domain.

  5. In Dash, open Settings → Remote access → Add address and enter https://dash.example.com.

Cloudflare terminates HTTPS at its edge here, so Cloudflare can see this traffic. It is your account and your zone, and GlassHome is not involved.

Reverse proxy

If you already run Caddy, nginx, or Traefik, point a hostname at port 3123. Caddy, which handles certificates and WebSockets on its own:

dash.example.com {
  reverse_proxy 192.168.1.100:3123
}

On nginx or Traefik, make sure the route forwards WebSocket upgrades (Upgrade and Connection headers). The dashboard is live over a WebSocket; without it the page loads and then stays empty.

A proxy at home is only reachable from home unless you also open a port or combine it with a VPN. Its value is the tidy HTTPS address, and it is free as long as the hostname resolves to a home IP.

What Dash needs, whatever you pick

  • Expose Dash only, port 3123. Never publish Home Assistant. Dash talks to HA locally and forwards live state, camera images, and media on its own address.
  • Declare the address. Settings → Remote access → Add address, household admins only. Without it, sign-in is refused from that address. Local addresses are trusted automatically.
  • The address must resolve. A domain that does not exist yet fails the check. localhost and 127.0.0.1 are rejected on purpose.
  • Pass X-Forwarded-Proto: https if your proxy terminates HTTPS, so Dash builds its links with the scheme your browser used.
  • Name your proxy. Set TRUSTED_PROXIES to the address your proxy connects from (for example 192.168.1.50/32), so Dash tells visitors apart. The Home Assistant addon needs nothing.
  • Set it up at home first. Run the setup wizard on the local address; add the remote one after.

Signing in while away

Use your GlassHome account or Quick connect (a code you approve from a device already signed in). Signing in with Home Assistant is a home-network flow: it redirects to your HA login page, which is not reachable from outside.

What works while you are away

Remote sessions route everything through your Dash at home, so the dashboard behaves the same as on your couch: live entity updates, controls, and media. Camera snapshots and album art work remotely too; Dash forwards them from Home Assistant itself, so no extra camera configuration is needed.

Troubleshooting

See Troubleshooting for remote-access issues.