fix: guard home assistant onboarding

2026-06-12 21:50:15 +02:00
parent 6e6005aefd
commit 25a4ada891
4 changed files with 29 additions and 2 deletions
@@ -28,6 +28,10 @@ services:
      - traefik.http.routers.homeassistant.entrypoints=websecure
      - traefik.http.routers.homeassistant.tls=true
      - traefik.http.routers.homeassistant.tls.certresolver=le
+      # Temporary onboarding guard: keep HA reachable only from LAN/Tailscale
+      # until the owner account exists.
+      - traefik.http.routers.homeassistant.middlewares=homeassistant-lan-only
+      - traefik.http.middlewares.homeassistant-lan-only.ipallowlist.sourcerange=192.168.178.0/24,100.64.0.0/10
      - traefik.http.services.homeassistant.loadbalancer.server.port=8123

  mosquitto: