Why You Should Not Port Forward Directly
Opening a port forward (e.g., port 8123 directly to Home Assistant) is high risk: it exposes the login page to bot port scanning and brute force attacks. Old Home Assistant CVE vulnerabilities can be exploited this way. Cloudflare Tunnel provides Zero-Trust Network Access (ZTNA) that is far more secure.
Cloudflare Tunnel for Home Assistant
Architecture: Home Assistant runs a Cloudflared Docker container → connects outbound to the Cloudflare network → Cloudflare acts as a reverse proxy, making the instance accessible at a URL such as https://myhome.example.com with no ports opened on the router.
Step-by-step setup: (1) sign up for Cloudflare Free plan and add your domain; (2) install cloudflared on the Home Assistant host (Docker or HA OS add-on); (3) run cloudflared tunnel create myhome-tunnel; (4) configure the tunnel to forward localhost:8123 → myhome.example.com; (5) add a CNAME DNS record in the Cloudflare dashboard; (6) set trusted_proxies in HA configuration.yaml.
Security layer: add a Cloudflare Access policy requiring Google/GitHub OTP login before the Home Assistant URL can be reached — preventing unauthorised access even if the URL is known.
Home Assistant Companion App
Supports iOS (iPhone/iPad) and Android. Key features: full dashboard for controlling every entity; WebSocket real-time updates — device state pushes instantly without polling; smartphone sensors (battery, step count, GPS location, screen state, network type) feed back into HA as sensors for use in automations; Action Shortcuts — iOS home screen widgets that toggle lights or AC with one tap.
Geofencing for Home/Away Automation
The Companion App uses GPS + Wi-Fi SSID detection to define a Home Zone (50–100m radius). On leaving home: turn off all lights, set AC to economy mode, lock doors. On arriving home: turn on the entrance lights, restore AC to comfort mode, notify family members.
Multi-person geofencing: only switch off AC when every family member has left — using a group.family + not_home condition to prevent switching off while someone is still inside.
iOS Critical Alerts for Emergencies
Standard notifications are silenced in Do Not Disturb mode. iOS Critical Alerts are a special permission that plays at full volume even in silent mode. Use them for: gas leak detector (TGS2611), carbon monoxide alarm, elderly fall detection, and flood sensor under the kitchen sink.
Home Assistant notification configuration: set push → sound → critical: 1 and volume: 1.0 in the notify.mobile_app service data.
Actionable Notifications
Send notifications with action buttons that respond directly without opening the app: tap Turn Off Lights → HA turns them off immediately; tap View Camera → opens a camera stream; tap Call Family → initiates a phone call.
WebSocket vs Polling
The HA Companion App uses a long-lived WebSocket connection — state updates in <100ms latency. Compare this to HTTP polling every 30 seconds. The result is a dashboard that shows real-time status as if you were standing in the room.