> One might suggest using a VPN to secure the connection. However, this approach is impractical for several reasons: > Complexity: Routing general internet

> One might suggest using a VPN to secure the connection. However, this approach is impractical for several reasons: > Complexity: Routing general internet traffic through a VPN introduces unnecessary complexity. I don't believe that it's that bad if your pefered option is a reverse proxy. Frankly, wireguard isn't that complex on its own merits. > Bandwidth Limitations: A VPN could bottleneck the performance for some devices. Nonsense; this is a VPN for a specific purpose that uses virtually no bandwidth. Obviously don't run all traffic over it, but with that done it should be fine. > Device Compatibility: Not all devices can reliably connect to a VPN. True... but I thought this was just for cell phones? Because wireguard at least works on (at least) iOS, Android, and postmarketos. (And I'm pretty sure most other popular VPNs do as well.) --- > No Basic Authentication Support: Home Assistant's mobile apps cannot handle URLs with embedded credentials (e.g., https://user:pass@hostname https://user:pass@hostname). > Path Limitations: Home Assistant must be hosted at the root path (/), preventing the use of an obscure web host path to deter scanners. That is a shortcoming, but not necessarily fatal; can it sit behind a reverse proxy that handles (http basic) authentication but doesn't use another path? That should be secure enough.