Lab: Home Assistant with security best practice

Aim and what you need

The aim is a working Home Assistant hub that follows good practice from day one. Home Assistant is open-source home automation software that controls lights, sensors and cameras locally, without relying on each vendor's cloud.

• A Raspberry Pi 4 or 5 with an SSD, a small PC, or a virtual machine. Home Assistant OS is the easiest install; the container install suits people who already run Docker.
• Your devices on an IoT network, with the hub able to reach them.
• An authenticator app for MFA, and somewhere off the box to store backups.

Steps

1. Install Home Assistant OS with Raspberry Pi Imager (it is listed under other specific-purpose OS) or run the container below.
2. Browse to http://<hub-address>:8123 and create the owner account with a unique username and a long password from a password manager.
3. In your user profile, enable the authenticator app multi-factor module and scan the QR code.
4. Create separate, non-administrator accounts for family members.
5. Put passwords and API keys for integrations in secrets.yaml and reference them with !secret, rather than in the main configuration.
6. Set up automatic backups and copy them to another device or encrypted storage.
7. For remote access, use a VPN such as WireGuard on your router, or a managed tunnel service, rather than a port forward.

# container install on a Linux host
docker run -d --name homeassistant --restart unless-stopped --privileged -e TZ=Europe/London -v /opt/homeassistant:/config -v /run/dbus:/run/dbus:ro --network host ghcr.io/home-assistant/home-assistant:stable

# secrets.yaml (never commit or share)
weather_api_key: "<your-api-key>"

# configuration.yaml
weather_service:
  api_key: !secret weather_api_key

# Home Assistant OS command line (SSH add-on or console)
ha core info
ha backups new --name "before-update"
ha backups list
ha core update
ha core check

How to verify and troubleshoot

Log out and in again: you should be asked for a six-digit code. From your phone on mobile data with the VPN off, the hub must not be reachable; with the VPN on, it should be. Check Settings, System, Repairs for warnings, and the Logs page for repeated failed logins, which Home Assistant records with the source IP. Restore a backup to a spare VM or card once, so you know restores really work.

• Lost MFA device: keep the recovery codes or a second admin account somewhere safe before you need them.
• Devices not discovered: discovery uses multicast, which does not cross VLANs; add devices by IP address or allow discovery through carefully.
• Update broke an integration: read release notes before updating, and restore the backup you made just before.
• Container cannot see Bluetooth or USB: it needs the extra device and D-Bus mounts; Home Assistant OS handles this for you.

Clean-up and ongoing care

Keep the hub patched, remove integrations and add-ons you no longer use, and only install community add-ons you have checked. If you rebuild or give away the hardware, delete backups that contain tokens, revoke long-lived access tokens in your profile and wipe the storage. For the container version, docker rm -f homeassistant stops it but leaves /opt/homeassistant, which holds your secrets, so delete it deliberately.