termalYour Home Assistant is on http://homeassistant.local:8123, your Grafana on :3000, and both are stuck on your home network. You want them in a browser from the office, from your phone, or shared with someone — without turning your router into an attack surface. Here are five ways to do it, what each one really costs you, and a step-by-step for the invite-only route.
Why not just forward 8123 or 3000
Forwarding the port on your router puts a login page — sometimes an open dashboard — in front of every bot on the internet. Home Assistant and Grafana both get probed constantly once they’re found, and a reused password or an unpatched CVE is all it takes. Carrier-grade NAT (common on home fibre and 4G/5G) often makes forwarding impossible anyway. Every option below exists to avoid that single open port.
The five options
| Option | Public URL? | On the viewer’s device | Works beyond HA? | Cost |
|---|---|---|---|---|
| Nabu Casa (HA Cloud) | Yes, your own subdomain | Nothing | No — Home Assistant only | Subscription |
| Cloudflare Tunnel | Public, or gated by Access | Nothing, or an Access login | Yes | Free tier; needs a domain |
| Tailscale / WireGuard | No — private mesh | A VPN client, everywhere | Yes | Free tier |
| Reverse proxy + port forward | Yes — on the internet | Nothing | Yes | Your time + the exposure |
| Termalin internal site | No — invite by email | Just a browser | Yes | Pro plan |
Nabu Casa is the official Home Assistant Cloud. It’s the smoothest path for Home Assistant — remote UI, a stable URL, and it funds the project — but it only covers Home Assistant, not your Grafana or Portainer.
Cloudflare Tunnel (cloudflared) dials out from a daemon on your LAN, so no port opens. It’s powerful and has a free tier, but to keep a dashboard private you need to own a domain and put a Cloudflare Access policy in front of it; left bare, the hostname is a public URL anyone can hit.
Tailscale or WireGuard builds a private mesh — nothing is exposed, and it’s excellent for your own devices. The catch: everyone who connects installs and signs into the VPN client, which is a hard sell for a family member or a one-off guest.
A reverse proxy with a forwarded port (nginx, Caddy, Traefik) gives you clean HTTPS, but you’re still publishing the service to the internet and owning every patch and auth decision yourself.
A Termalin internal site sits in a different spot: no public URL at all, and no client on the viewer’s side. A Connector on your LAN dials out, and the dashboard opens at a private address like https://<10 chars>.termal.ink — for you, and for people you invite by email. It’s the quickest way to share one dashboard with a specific person. The trade-offs are honest: it needs a Pro plan, there’s a 5 GB-per-day soft cap per link, and there is no permanent public link — a feature if you want privacy, a limit if you want a public status page.
Step by step with a Connector
This works for Home Assistant, Grafana, Portainer, Proxmox — anything with a web UI on your network, because WebSockets pass through, so HA’s live updates and Grafana’s live panels behave as they do on the LAN.
- Install a Connector on the Home Assistant box, or on any always-on machine on the same network — a Raspberry Pi, a NAS, a small VPS on the LAN. One line from the cabinet’s Get install command; it dials out and never listens.
- Add the site. In the web cabinet, open the Internal sites card (next to Backups) → Add a site. Pick the Connector and enter the address as that machine sees it —
http://localhost:8123if the Connector is on the HA host, orhttp://10.0.0.5:8123from another box. Tick “The internal site uses https” if your dashboard serves TLS (a self-signed certificate is fine). - Add and open. The dashboard opens in a new tab at its
termal.inkaddress. You’re signed in to it for 12 hours; the address alone gets nobody else in.
Only private addresses are allowed — localhost, 10.x, 172.16–31.x, 192.168.x, link-local, Tailscale’s 100.64/10, IPv6 ULA — and a public address is refused by design.
Sharing with a family member for 7 days
From the cabinet, share the site with one email address, for 24 hours or 7 days (up to 25 people on a link at once; sharing again extends it). They get an invitation email and sign in with a 6-digit code — no Termalin account to create. They see only that one dashboard, and when the share expires their session ends. You can Remove one person or Turn off the link entirely, and every open shows up in the site’s activity log. Sharing needs a paid plan; the trial can open sites but not share them.
When to pick something else
- Only Home Assistant, want it frictionless → Nabu Casa, and you support the project.
- You own a domain and want a durable, possibly public URL → Cloudflare Tunnel with an Access policy.
- Everyone connecting is you, across your own devices → Tailscale or WireGuard.
- One or two dashboards, shared with named people, nothing exposed → a Termalin internal site.
For the SSH side of a homelab behind NAT, see SSH behind NAT without port forwarding and SSH into a home NAS or server.