Self-Host Home Assistant on a VPS (2026): Remote Access Guide

Why a VPS for Home Assistant?

Opening port 8123 on your home router sounds simple, but it puts your smart home dashboard directly on the internet. One misconfigured account or an unpatched Home Assistant release and someone else controls your lights — and possibly your locks. A VPS in the middle gives you a hardened chokepoint where you manage TLS termination, rate limiting, and authentication in one place. Your home IP stays private.

The VPS is not where Home Assistant itself runs. HA lives at home near its devices. The VPS is a thin, always-on relay: it receives your HTTPS request, checks credentials, and tunnels or proxies the connection through to your home server. Because the gateway does very little work, a cheap entry-level instance handles it without strain. See the best VPS options for self-hosting if you haven’t chosen one yet.

Two patterns (pick one)

Both patterns give you secure remote access. They differ in how the VPS connects back to your home.

Prerequisites

Before you start, check off these items:

• Small VPS: 1 vCPU / 1 GB RAM is enough for the gateway role. See the best VPS picks for self-hosting for current options.
• Domain name: You need one to get a free Let’s Encrypt TLS certificate. If you haven’t set one up yet, follow the guide on pointing a domain to a VPS.
• Docker on both the VPS and, if you’re running Home Assistant Container at home, on your home server.
• A working Home Assistant installation at home (any flavour: OS, Supervised, or Container).

Option A — WireGuard gateway

WireGuard creates an encrypted tunnel between your VPS and home network. Once it’s up, the VPS can reach Home Assistant at a private tunnel IP, and you proxy HTTPS traffic through that tunnel. Your home IP never appears in logs or headers.

Generate keypairs on each machine:

# Run on your VPS
wg genkey | tee vps-private.key | wg pubkey > vps-public.key

# Run on your home server
wg genkey | tee home-private.key | wg pubkey > home-public.key

VPS config (/etc/wireguard/wg0.conf):

[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = PASTE_VPS_PRIVATE_KEY_HERE

[Peer]
# Home server
PublicKey = PASTE_HOME_PUBLIC_KEY_HERE
AllowedIPs = 10.10.0.2/32

Home server config (/etc/wireguard/wg0.conf):

[Interface]
Address = 10.10.0.2/24
PrivateKey = PASTE_HOME_PRIVATE_KEY_HERE

[Peer]
# VPS
PublicKey = PASTE_VPS_PUBLIC_KEY_HERE
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 10.10.0.1/32
PersistentKeepalive = 25

Bring both tunnels up and enable them on boot:

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

With the tunnel live, your VPS can reach Home Assistant at 10.10.0.2:8123. Add Nginx or Nginx Proxy Manager on the VPS, point your domain at it, get a Let’s Encrypt certificate, and proxy to 10.10.0.2:8123. The Nginx Proxy Manager setup guide walks through that step in detail.

Option B — Reverse proxy

If your home router supports port-forwarding and you’re comfortable forwarding one port, you can skip WireGuard. Forward port 8123 from your router to your Home Assistant host, then configure Nginx on the VPS to proxy your domain to your home IP on that port.

For reference, here is a minimal Docker Compose for running Home Assistant Container — either at home or on the VPS for cloud-only use:

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    restart: unless-stopped
    privileged: true
    network_mode: host
    volumes:
      - ./config:/config
    environment:
      - TZ=Europe/Berlin

Start it with docker compose up -d. Home Assistant listens on port 8123. Put Nginx in front for TLS — the Nginx Proxy Manager guide has a step-by-step walkthrough.

Before you go live, confirm DNS propagation after pointing your domain to the VPS.

Security notes

Never expose Home Assistant on a raw port-forward without TLS. Beyond that, a few things to do before going live:

• Enable multi-factor authentication in HA under Settings → People → your account.
• Add trusted_proxies and use_x_forwarded_for to configuration.yaml so HA trusts the proxy’s IP and logs real client addresses. Without this, HA may reject requests or log the proxy IP instead of yours.
• Set trusted_networks for the WireGuard IP range if you want to skip MFA prompts from the tunnel.
• Keep Home Assistant updated — security patches ship regularly.
• On the VPS: allow only ports 80, 443, and 51820 (WireGuard UDP) through the firewall. The VPS security hardening guide covers UFW rules, fail2ban, and SSH key-only auth as the baseline.

Troubleshooting

Can’t reach HA through the proxy — 400 or “request from an invalid IP” error. Home Assistant rejects requests it doesn’t trust. Add these lines to configuration.yaml and restart HA:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 10.10.0.1  # WireGuard VPS IP, or your Nginx container IP

WebSocket disconnects — automations and live states stop updating. Your proxy needs to forward the Upgrade and Connection headers. In a raw Nginx config, add proxy_http_version 1.1;, proxy_set_header Upgrade $http_upgrade;, and proxy_set_header Connection "upgrade"; inside the location block. Nginx Proxy Manager handles this automatically when you enable WebSocket support in the proxy host settings.

WireGuard handshake fails — no traffic through the tunnel. Check that UDP port 51820 is open on the VPS firewall (sudo ufw allow 51820/udp). Confirm the public keys in each peer block match the opposite machine’s actual public key. Run sudo wg show on both sides to see the handshake timestamp.

Login loop — HA redirects back to the login page after entering credentials. This usually means the base_url or external URL is misconfigured. In HA, go to Settings → System → Network and set the External URL to exactly the HTTPS domain you use (for example https://ha.example.com). The scheme and domain must match what the browser sends, or the session cookie will not be accepted.

Which VPS to run it on

The gateway role is tiny — a WireGuard endpoint or Nginx proxy uses well under 200 MB of RAM even under load. Entry-level instances from Hetzner or Vultr are more than sufficient. See the full comparison of VPS providers for self-hosting for current pricing and availability by region.

Once the gateway is running, your Home Assistant dashboard loads over HTTPS from anywhere, your home devices stay on the local network where they belong, and nothing unnecessary is exposed to the internet.