2020-11-15 21:42:02 +00:00
---
title: Home-Assistant
---
2020-10-26 21:03:37 +00:00
2022-06-15 19:31:34 +00:00
< span class = "badge badge--secondary" > Support level: Community< / span >
2020-10-26 21:03:37 +00:00
## What is Home-Assistant
2023-07-31 10:16:58 +00:00
> Open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts. Perfect to run on a Raspberry Pi or a local server.
>
> -- https://www.home-assistant.io/
2020-10-26 21:03:37 +00:00
2023-01-13 15:22:03 +00:00
:::caution
2022-05-12 19:40:58 +00:00
You might run into CSRF errors, this is caused by a technology Home-assistant uses and not authentik, see [this GitHub issue ](https://github.com/goauthentik/authentik/issues/884#issuecomment-851542477 ).
2021-05-31 15:08:39 +00:00
:::
2020-10-26 21:03:37 +00:00
## Preparation
The following placeholders will be used:
2022-05-09 19:22:41 +00:00
- `hass.company` is the FQDN of the Home-Assistant install.
- `authentik.company` is the FQDN of the authentik install.
2020-10-26 21:03:37 +00:00
## Home-Assistant
This guide requires https://github.com/BeryJu/hass-auth-header, which can be installed as described in the Readme.
2020-12-05 21:08:42 +00:00
Afterwards, make sure the `trusted_proxies` setting contains the IP(s) of the Host(s) authentik is running on.
2020-10-26 21:03:37 +00:00
2022-01-07 08:55:19 +00:00
Use this configuration to match on the user's authentik username.
```yaml
auth_header:
username_header: X-authentik-username
```
2020-10-29 21:12:13 +00:00
If this is not the case, you can simply add an additional header for your user, which contains the Home-Assistant Name and authenticate based on that.
2020-12-05 21:08:42 +00:00
For example add this to your user's properties and set the Header to `X-ak-hass-user` .
2020-10-29 21:12:13 +00:00
```yaml
additionalHeaders:
2020-12-05 21:08:42 +00:00
X-ak-hass-user: some other name
2020-10-29 21:12:13 +00:00
```
2020-12-05 21:08:42 +00:00
## authentik
2020-10-26 21:03:37 +00:00
Create a Proxy Provider with the following values
2022-05-09 19:22:41 +00:00
- Internal host
2020-10-26 21:03:37 +00:00
2020-12-05 21:08:42 +00:00
If Home-Assistant is running in docker, and you're deploying the authentik proxy on the same host, set the value to `http://homeassistant:8123` , where Home-Assistant is the name of your container.
2020-10-26 21:03:37 +00:00
2020-12-05 21:08:42 +00:00
If Home-Assistant is running on a different server than where you are deploying the authentik proxy, set the value to `http://hass.company:8123` .
2020-10-26 21:03:37 +00:00
2022-05-09 19:22:41 +00:00
- External host
2020-10-26 21:03:37 +00:00
Set this to the external URL you will be accessing Home-Assistant from.
2020-12-05 21:08:42 +00:00
Create an application in authentik and select the provider you've created above.
2020-10-26 21:03:37 +00:00
## Deployment
2021-12-13 10:56:26 +00:00
Create an outpost deployment for the provider you've created above, as described [here ](../../../docs/outposts/ ). Deploy this Outpost either on the same host or a different host that can access Home-Assistant.
2020-10-26 21:03:37 +00:00
2020-12-05 21:08:42 +00:00
The outpost will connect to authentik and configure itself.
