Smart Home
Smart devices at home are always within reach.
With the development of technology, home devices are becoming increasingly smart, making people's lives more and more convenient. Deploying a smart home system for your house is not difficult; simply installing Home Assistant can make it compatible with smart home devices from various manufacturers. What truly troubles users is that after leaving home and disconnecting from the home network, they can no longer remotely control their smart devices in a safe and private manner.
Privacy and security
Viewing or controlling smart home devices carries extremely strong privacy attributes, as it is directly related to daily life. It would be a terrifying thing if smart home devices could be controlled by a third party, as it constitutes an infringement on private space. Although Xiaomi's Mijia and HomeKit on iPhone claim that they comply with security guidelines and will not control users' smart homes, they still cannot escape the role of a third party. There is no guarantee that one day their services might go down or suffer from hacker intrusions, causing harm to the vast number of users.
Capable users will choose solutions such as using a VPN, building their own cloud relay services, or purchasing them. By adopting encrypted communications, they aim to avoid the risk of third-party control and achieve privacy and security. However, VPN providers and cloud vendors remain lingering third parties—not to mention that this also brings additional financial expenses and complex maintenance costs!
DHttp solution
DHttp can perfectly solve the above problems, ensuring privacy and security even after leaving the home network. Its working principle is very simple: users use the AnySee browser to directly access Home Assistant at home, breaking through cross-network communication barriers; at the same time, end-to-end encryption ensures that the private keys of both the user and Home Assistant remain local, leaving other third parties with no way of knowing them, making communication extremely secure; finally, with the help of anonymous relay nodes, the user and Home Assistant strive to establish point-to-point communication, making communication even more secure and reliable.
While traveling, Alice opens the AnySee browser on her mobile phone and accesses her home smart home control panel via DHttp. She can view the status of doors, windows, and sensors, control devices, and grant authorization to family members. Home data and control services always remain at home. The host does not need to worry about service listening ports, and the mobile phone does not need to join the home local area network.
Alice can view and control Home Assistant while away from home
Deployment steps
This guide deploys the example on a Linux or macOS host, using Ubuntu for the Linux commands. Before starting, prepare:
- A Linux or macOS host with Docker installed, which can be kept at home long-term and remain powered on and connected to the network;
- An access device capable of installing AnySee, using an Android phone as an example in this article.
Install Home Assistant
Deploy Home Assistant Container using Docker.
In this example, Home Assistant and Pishoo are deployed on the same host, with Home Assistant exposing its service via 127.0.0.1:8123. When deploying separately, please have Home Assistant's port 8123 listen to the local area network IP, and let Pishoo reverse proxy this address.
Set TZ for the location of the home; for example, use America/Los_Angeles for Silicon Valley.
mkdir -p "$HOME/home-assistant/config"
docker run -d \
--name homeassistant \
--privileged \
--restart=unless-stopped \
-e TZ=America/Los_Angeles \
-v "$HOME/home-assistant/config:/config" \
-v /run/dbus:/run/dbus:ro \
--network=host \
ghcr.io/home-assistant/home-assistant:stable
The initial startup takes a few minutes. Once successfully started, open http://127.0.0.1:8123 in your browser and follow the on-screen prompts to create a Home Assistant account, set your home location, and complete the initialization.
After the initialization is complete, check the local entry point:
curl \
--silent \
--output /dev/null \
--write-out '%{http_code}\n' \
http://127.0.0.1:8123/
If the command returns 200, it indicates that Home Assistant is running normally.
Proxy Home Assistant with Pishoo
If you have not yet installed the DHttp components, please refer to the Quick Start to install Pishoo and gmutils, and ensure that Pishoo has started.
After installation is complete, follow Using identities to apply for a DHttp identity for this home host. This example assumes it is named home.alice.smith.
2.1 Edit the configuration file for home.alice.smith:
vim "$HOME/.dhttp/home.alice.smith/server.conf"
2.2 Add the following configuration:
server {
listen all 0;
location / {
proxy_pass http://127.0.0.1:8123;
}
}
2.3 Check configuration and reload Pishoo:
sudo pishoo -t
sudo systemctl reload pishoo
After the configuration takes effect, home.alice.smith~ is bound to this home host, and Home Assistant exposes services through it. Even if the home network address changes, there is no need to modify the access name.
Identity Authorize
Home Assistant is running, but by default, it only allows access from itself (home.alice.smith~) and denies all outside access. Devices accessing Home Assistant must possess an authorized DHttp identity.
3.1 Visitor prepares identity:
This example takes Alice's Android phone as an example: First, download and install the AnySee Browser, then apply for me.alice.smith according to Configure an access identity and set it as the current identity.
3.2 Grant authorization to the visitor identity:
Return to the home host and grant access permission to the identity me.alice.smith~:
genmeta access --id home.alice.smith "/" allow me.alice.smith~
sudo systemctl reload pishoo
3.3 Confirm authorization record:
Check the access permissions configured for the root path:
genmeta access --id home.alice.smith "/" list
At this point, you can see:
- /
#0: allow me.alice.smith~
Is re-authorization required after switching networks?
No. The permissions here are bound to me.alice.smith~, not the IP address used by the mobile phone at the time. When the network changes, Alice's identity does not change, and the original permissions remain valid.
When other family members need access permissions, the operation is exactly the same: use the allow rule of genmeta accessto add the other party's DHttp identity to the admission list, and then reload Pishoo.
3.4 Deny access:
If you want to deny access from a certain identity to Home Assistant, you can configure it as follows (if that identity was previously granted authorization, that authorization will be revoked):
genmeta access --id home.alice.smith "/" deny me.alice.smith~
sudo systemctl reload pishoo
If a device is lost
DHttp access permissions and identity certificates are independent of each other. Using deny only revokes access permissions to Home Assistant; if a device is lost or a private key is leaked, you should also promptly revoke the old certificate and apply for a new certificate for this identity. Otherwise, anyone who obtains the old certificate and private key can still impersonate me.alice.smith to access other DHttp services whose permissions have not yet been revoked. For specific operations, see Key-Loss Recovery.
Remote Access
After leaving home, as long as the home host remains online, Alice can open the AnySee browser at any time and access:
https://home.alice.smith~
Home Assistant opens immediately, with usage identical to when at home. As long as the mobile phone has internet access, no VPN permissions or other network settings are needed, making it very convenient to use.
Alice viewing Home Assistant at home via home.alice.smith~ on her mobile network.
After deployment is completed, authorized members can open the AnySee browser to use Home Assistant at home. The entire process is not limited by the members' location or time, as long as the network environment is available.
Home Agent
Today, Alice made Home Assistant accessible to herself and her family. In the future, home agents can also have independent identities and obtain only the API permissions required to complete their work: for instance, checking doors and windows, organizing energy consumption, or adjusting the indoor environment after receiving approval.
In such a network, family members, devices, and agents can all possess verifiable identities; who can view, who can control, and to what extent they can operate are all decided by Alice. When services in the home can be accurately located, verified, and authorized, the Internet of Agents will no longer exist only in the cloud, but will truly enter every home.