Home Assistant is the leading open-source home automation platform: it connects thousands of devices and services — lights, thermostats, sensors, cameras, energy meters — and automates them locally. This guide covers running it with Docker and how a VPS fits into a Home Assistant setup.

Where should Home Assistant run?

Home Assistant talks to devices on your home network: Zigbee and Z-Wave sticks over USB, Wi-Fi devices via local discovery (mDNS), Bluetooth. A VPS in a data center can’t see any of that directly. So:

  • Main Home Assistant instance → at home (a mini PC, Raspberry Pi or NAS). This is the normal setup.
  • A VPS is useful for:
    • a secure remote-access gateway (reverse proxy or VPN hub) so you can reach your home instance from anywhere without exposing your home IP;
    • cloud-only integrations, MQTT brokers, or a monitoring/notification relay;
    • running a full instance for cloud-connected devices only (some brands work entirely via cloud APIs).

Installation types

Type What you get Add-ons
Home Assistant OS Full appliance OS Yes
Home Assistant Container Docker container No (run extras as separate containers)
Home Assistant Supervised / Core Advanced/legacy setups Varies

On a general-purpose Linux machine or VPS with Docker, use Container.

1. Run Home Assistant Container

mkdir -p ~/homeassistant && cd ~/homeassistant

compose.yaml:

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: Europe/London
    volumes:
      - ./config:/config
      - /run/dbus:/run/dbus:ro
    # devices:
    #   - /dev/serial/by-id/usb-…:/dev/ttyUSB0   # Zigbee/Z-Wave stick at home
docker compose up -d

network_mode: host lets Home Assistant discover devices on the local network — important at home. Open http://SERVER-IP:8123 and complete onboarding.

On a VPS, host networking exposes port 8123 on the public interface — firewall it immediately (sudo ufw deny 8123 or allow only from your VPN), and access it through the reverse proxy below.

2. Secure remote access

Never port-forward Home Assistant’s 8123 directly from your home router to the internet. Better options:

A. VPN (most secure). Put your home server and devices in a Tailscale tailnet or a WireGuard network. Access http://homeassistant:8123 privately from anywhere. Nothing is exposed.

B. Reverse proxy on a VPS over a tunnel. The home server connects out to your VPS (WireGuard), and Nginx on the VPS serves https://ha.example.com, forwarding to the home instance’s VPN IP. Your home IP stays hidden, and you get a proper HTTPS URL for the mobile app.

Nginx on the VPS:

server {
    listen 80;
    server_name ha.example.com;

    location / {
        proxy_pass http://10.8.0.2:8123;      # home instance's VPN address
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Then sudo certbot --nginx -d ha.example.com.

Home Assistant must trust the proxy, in configuration.yaml:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 10.8.0.1        # the VPS's VPN address

Restart Home Assistant. Without this, it rejects proxied requests with a 400 error.

C. Cloudflare Tunnel — similar idea without your own VPS; see Cloudflare Tunnel. Home Assistant Cloud (Nabu Casa) is the paid, official option and funds the project.

3. Harden the instance

  • Enable multi-factor authentication for each user (Profile → Security).
  • Use strong passwords; consider IP bans for failed logins:
http:
  ip_ban_enabled: true
  login_attempts_threshold: 5
  • Keep Home Assistant updated — releases come monthly.

4. MQTT broker on the VPS (optional)

Devices and services in different places can meet at a central MQTT broker. See Mosquitto MQTT — always with TLS and passwords if it’s reachable from the internet.

5. Backups

Home Assistant Container stores everything in ./config. Use the built-in backup feature (Settings → System → Backups), and copy backups off the machine. Database files (home-assistant_v2.db) can grow large; tune recorder: retention (purge_keep_days) to keep them in check.

6. Updates

docker compose pull && docker compose up -d

Read the release notes for breaking changes in integrations you use.

A small VPS makes an excellent, always-on gateway for Home Assistant — reachable from anywhere while your home network stays closed. Our KVM VPS plans support WireGuard and Docker out of the box.

  • Home Assistant
  • Docker
  • Self-Hosting