diff --git a/tailscale/DOCS.md b/tailscale/DOCS.md index 71b81d3ee..c690cac8c 100644 --- a/tailscale/DOCS.md +++ b/tailscale/DOCS.md @@ -287,8 +287,13 @@ instead. 1. Configure Home Assistant to be accessible through an HTTP connection (this is the default). See [HTTP integration documentation][http_integration] for more - information. If you still want to use another HTTPS connection to access Home - Assistant, please use a reverse proxy app. + information. + + **Note:** If you want to use another HTTPS connection to access Home + Assistant, though Tailscale can access Home Assistant even if Home Assistant + is using SSL and is accessible through an HTTPS connection, please use a + reverse proxy app for that HTTPS connection instead of configuring Home + Assistant to use SSL. 1. Home Assistant, by default, blocks requests from reverse proxies, like the Tailscale Serve. To enable it, add the following lines to your diff --git a/tailscale/rootfs/etc/s6-overlay/s6-rc.d/share-homeassistant/run b/tailscale/rootfs/etc/s6-overlay/s6-rc.d/share-homeassistant/run index 3a61fd98f..532604058 100755 --- a/tailscale/rootfs/etc/s6-overlay/s6-rc.d/share-homeassistant/run +++ b/tailscale/rootfs/etc/s6-overlay/s6-rc.d/share-homeassistant/run @@ -11,7 +11,10 @@ readonly WAIT_COUNT=18 # 18*5s = 90s = 1.5m declare wait_counter=0 declare curl_result -declare -a options +declare curl_protocol +declare tailscale_protocol +declare -a curl_options +declare -a tailscale_options # Validate share_homeassistant value if ! bashio::config.equals 'share_homeassistant' 'serve' && \ @@ -27,13 +30,41 @@ then bashio::exit.nok "Tailscale's HTTPS support is disabled" fi +# Check if Funnel is available +if bashio::config.equals 'share_homeassistant' 'funnel'; then + if ! /opt/tailscale status --self=true --peers=false --json \ + | jq -rce '.Self.CapMap | has("funnel")' > /dev/null; + then + bashio::exit.nok "Tailscale's Funnel support is disabled" + fi +fi + +curl_options+=(-s) +curl_options+=(-o/dev/null) +curl_options+=(-w"%{http_code}") + +tailscale_options+=("$(bashio::config 'share_homeassistant')") +tailscale_options+=(--bg=false) +tailscale_options+=(--https="$(bashio::config 'share_on_port')") +tailscale_options+=(--set-path=/) + # Checking if SSL is used if bashio::var.true "$(bashio::core.ssl)"; then - bashio::exit.nok "Tailscale's HTTPS support is enabled, but Home Assistant is not accessible through plain HTTP connection" + bashio::log.notice \ + "Home Assistant is using SSL, Tailscale will connect to Home Assistant locally through HTTPS," \ + "that unnecessarily uses resources and slows down the communication." + curl_protocol="https" + curl_options+=(-k) + tailscale_protocol="https+insecure" +else + curl_protocol="http" + tailscale_protocol="http" fi +curl_options+=("${curl_protocol}://127.0.0.1:$(bashio::core.port)") +tailscale_options+=("${tailscale_protocol}://127.0.0.1:$(bashio::core.port)") # Wait a bit for HA to be available during startup -while (( 200 != (curl_result=$(curl -s -o /dev/null -w "%{http_code}" "http://127.0.0.1:$(bashio::core.port)")) )); do +while (( 200 != (curl_result=$(curl "${curl_options[@]}")) )); do if (( wait_counter++ == WAIT_COUNT )); then break fi @@ -45,37 +76,23 @@ if (( wait_counter != 0 && curl_result == 200)); then fi if (( 200 != curl_result )); then - # Warn that we can't test Home Assistant's HTTP reverse proxy configuration + # Warn that we can't test Home Assistant's HTTP/HTTPS reverse proxy configuration # We emit only a warning to let the app start, maybe this is the only connection to access the device, better to start than not # Though starting tailscale serve without HA won't fail, but will fill the logs with messages forever in each ~10s bashio::log.warning "Home Assistant is not accessible currently, unable to test the connection to Home Assistant as reverse proxy" else - # Test Home Assistant's HTTP reverse proxy configuration - if (( 200 != $(curl -s -o /dev/null -w "%{http_code}" "http://127.0.0.1:$(bashio::core.port)" -H "X-Forwarded-For: 127.0.0.1") )); then + # Test Home Assistant's HTTP/HTTPS reverse proxy configuration + curl_options+=(-H "X-Forwarded-For: 127.0.0.1") + if (( 200 != $(curl "${curl_options[@]}") )); then bashio::exit.nok \ "Unable to connect to Home Assistant as reverse proxy." \ "Please check your configuration based on the app's documentation under \"Option: share_homeassistant\"." fi fi -# Check if Funnel is available -if bashio::config.equals 'share_homeassistant' 'funnel'; then - if ! /opt/tailscale status --self=true --peers=false --json \ - | jq -rce '.Self.CapMap | has("funnel")' > /dev/null; - then - bashio::exit.nok "Tailscale's Funnel support is disabled" - fi -fi - -options+=("$(bashio::config 'share_homeassistant')") -options+=(--bg=false) -options+=(--https="$(bashio::config 'share_on_port')") -options+=(--set-path=/) -options+=(http://127.0.0.1:"$(bashio::core.port)") - # This service can wait for HA for minutes, let notify S6 when we are really starting echo "" >&3 exec 3>&- # Set up serve or funnel -exec /opt/tailscale "${options[@]}" +exec /opt/tailscale "${tailscale_options[@]}"