Home Assistant is open source home automation that puts local control and privacy first.
Powered by a worldwide community of tinkerers and DIY enthusiasts.
Home Assistant can be self-installed on ProxMox, Raspberry Pi, or even purchased pre-installed: Home Assistant: Installation
Discussion of Home-Assistant adjacent topics is absolutely fine, within reason.
If you're not sure, DM @GreatAlbatross@feddit.uk
Your ISP will have a block of IPv4 address space. Go to any of the websites that will tell you your IP address, some might even tell you the block (otherwise other sites will tell you what the block is). Your ISP might even just tell you this.
E.g. your public IP might be 12.34.56.78 and the block might be 12.34.0.0/16.
You can give the block to your vendor saying you'll be coming from one address in that range. That way no matter what IP you get issued it'll be allowed.
They will probably never do that. Then anyone in that block can use the API.
Might be time, if you're serious about it, to reach out to your ISP and price a static public IP.
Nooo.
Get a VPS with static IP and tunnel. And cloudflare.
You don't want a residential static IP. You will get (d)DoS. Your ISP will terminate you.
I've had a static IP for years, serving all kind of stuff, and had zero problems. Home assistant, Jellyfin streaming, Bittorrent and more.
I have to agree. Had a static ip for years
Not a bad idea, I was simply keeping my explanation simple.
I dont have the knowledge or equipment for this. It would be my goal but I am anxious about exposing my home network and need to wrap my head around my options.
YAML has me in a heap as it is so that is definitely out of range
Why would I be a target for ddos?
Having a static IP is not the same as exposing your local network to the internet. It also does not automatically make you a target for DDoS attacks.
If you don't have public facing web services, its incredibly unlikely that anyone is going to DDoS you. That would be a total waste of time and resources.
Every modem connected to the internet (WAN) has an IP address. Most of then are dynamically assigned by your ISP and can change occasionally.
Static IP's are also assigned by your ISP but are assigned to your account/modem and do not change.
If the API you're trying to connect to absolutely requires a static IP, you can ask your ISP for one. If they offer them -- some ISP's don't for residential accounts -- they'll probably charge you a small monthly fee. Mine is $10/ month.
If you get a static IP, you will need to know how to configure it in your router. Its not super complicated and can be done with a little bit of research.
If you can get the API provider to forgo the static IP requirement and you aren't self hosting any public facing services, then you don't need a static IP and it would be a waste of money more than anything.
Side note: you should definitely not expose anything on your local network to the WAN unless you absolutely know what you're doing.
I'd recommend pangolin on a vps and skipping cloudflare. It makes the tunnel super simple. Just make sure to harden then VPS.
I’ll second a static IP from your ISP is probably what you need. However oven never had one and I don’t think my external IP ever changed. As long as the integration isn’t critical, given my own experience, I’d probably risk it and then decide if I needed to get a static IP.
Now you might also consider getting a n inexpensive VPS and route through that server which would likely have a static out bound block of IPs.
Smarter people than me are here though. I’m still in the “fear of opening ports to the internet” while at home phase.
There's a decent chance your public IP, even though not technically static, doesn't change all that often. Depends on your ISP, but I've only had my public IP change unexpectedly once over ~5 years of self-hosting and that was after a 24-hour power outage.
Yep, before I got a real, actual static IP I had a "sticky" IP that only changed once over 5 years, and they sent an email warning of it first. but most ISPs will offer a static IP upgrade for a reasonable price, even if they dont advertise it.
now I have a static IP and a giant IPV6 allocation to play with too.
My ISP charges a good chunk for static IP (because they consider it a business connection). However, my $10/mo VPS (which I already had for other projects) has its own static IP and I can easily proxy individual requests through it as needed. Have looked at VPS instances for $5/months before.
Depending on the service, your ISP, and how easily you can change IPs in the registration, as others have mentioned, you could just give them your public. I’ll say my own public does change at least twice a month, so if I can’t automate updating a registration, it goes through VPS or it’s a service I just skip.
This is the way!
I hadn't even considered this to proxy stuff through, can't believe it. Thats a great idea.
Definitely something I need to sort out at some point. Cheers.
If all you need is a static IP and a little traffic, there are free-tier or a couple bucks a month vps options. Use SSH to proxy a single port to connect to their service.
Definitely see how often your public IP changes. I got a few months into my new fibre connection and I realized that my address hasn't changed. Two years in I'm hosting a bunch of websites on it and my address hasn't changed once. Regular residential fibre connection.
Especially if you go ipv6. I've noticed many of my friends and I get new addresses almost never now that I've slowly migrated at least our web apps to ipv6.
First of all they’re fucking doing it wrong. Manual IP whitelisting instead of API auth is appallingly dated
why would one do either? By whitelisting you entirely prevent traffic. API auth takes processing. How wrong is it? Maybe for your home usage it’s good enough but layering measures has value…
It means you’re doing boutique instead of scalable, and/or they don’t know how to deal with the traffic and auth infrastructure
scalable has cost and you only want to engage costs when it comes with benefits. Preventing non legitimate traffic is complementary to scalability. Just don't pay for illegitimate traffic...
They want the IP that your ISP assigned to your modem. So go to https://whatismyipaddress.com/ to see the IP addresses.
However your ISP can change the IP address whenever they want. If you really need to be sure your IP address never changes then get a VPS with a static IP then run a VPN on it so you can tunnel your connection through that VPS. This way you will always have the same IP even if you change ISP or move.
Another good one ifconfig.me it can be used from a terminal to easily get your IP address
curl ifconfig.me
Super simple and clean response back too.
You could get a free dynDNS name with noip.com (you'll need to verify the domain every month by logging in) this way even if you have a dynamic ip, it automatically gets updated via the hostname if you set this in your router (most brands should be able to do this).
That wouldn't work for this...
A domain, a full fledged one or a free dyndns subdomain tells the world how to communicate with your ip, but it isn't involved when you talk to the world.
When your software is hitting the API from your network, all the API sees is your IP address, it has no knowledge of any urls that may point to it.
OP just needs to hope their IP address doesn't change regularly, and give them their public IP to whitelist.
Seems to be working fine for my VPN tunnel I use to get access to my home network, instead of an IP, it has the hostname + port to connect to it and technically I do have a non static IP. The hostname gets resolved via noip.com in this case to an IP address.
If you use whois ip.address it will give you a subnet mask, the "company" may accept that
Lots of good advice here, 1st thing I'd advise... speak to your ISP.
You'll probably need to do some of the other advice here, but then you'll know the options and if there's a cost... no point renting a VPS and having to set that up if a static IP is cheaper, and maybe the ISP can tell you that you're on a /29 and will only have a few IPs to give to the API team...