| Property | Value |
|---|---|
| Site | Home |
| Hypervisor host | VE-IO-01 |
| Role | Home Assistant — household automation hub. Per user: API-only access, no direct SSH as policy. |
| OS | Home Assistant OS (HA core 2026.4.4) running on KVM |
| Primary IP | 10.100.100.95 |
| SSH alias | — (no SSH; API-only by policy) |
| vCPU | 4 vCPU (host: AMD Ryzen 9 9900X) |
| Memory | 8 GiB |
| Storage | 32 GiB on tb4 (Thunderbolt-attached pool) |
| Backup | PBS VM-image-level via VE-IO-01. HA also has its own internal "Backups" (configurable in HA UI) that snapshot the /config directory + add-on state. |
net0 on bridge Server with hypervisor-level firewall enabled (firewall=1) — only VM with that flag, intentional security perimeter.BC:24:11:7E:57:6Csmart.home.korff.wtf → http://10.100.100.95:8123 (seit 2026-05-02; vorher Apache auf vm-sl-21).| Property | Value |
|---|---|
| Notes | No SSH. Per user policy 2026-04-29. Operate via the HA REST API + WebSocket API + Lovelace UI. Long-lived API token saved as HA__TOKEN in .secrets/credentials.env (JWT, exp 2036-04). Direct LAN URL: http://10.100.100.95:8123 (open from VPN clients + LAN). Public URL via reverse-proxy: https://smart.home.korff.wtf (TLS via certbot on VM-SL-21). |
firewall=1) requires understanding that fields populate on the Proxmox VM-level firewall settings, not in the Home Assistant config. Document the rule set for completeness.HA hinter Traefik braucht in /config/configuration.yaml:
http:
use_x_forwarded_for: true
trusted_proxies:
- 10.150.100.101
Alternativ: strip-xff Middleware auf vm-hm-edge-01 (HA-Config wegen API-Limitation aber bevorzugt). Siehe migration/2026-05-02-vm-sl-21-archive.