Ecosystem: HACS, add-ons, and remote access
These three topics are not essential to getting Home Assistant up and running, but almost every HA enthusiast encounters them eventually. Use this appendix as a map and skip to the sections you need.
Official App store
Apps (called add-ons in older versions) are stand-alone containerized services that run on Home Assistant OS. Think of each one as a small server that your HA host runs for you. The App store is available only on Home Assistant OS and Home Assistant Supervised; Home Assistant Container and Home Assistant Core do not include it.
Path: Settings → Apps → Install app.
Use an app when you need to:
- Run a local service such as Zigbee2MQTT or ESPHome.
- Connect to the host over SSH for troubleshooting.
- Use a visual flow tool such as Node-RED.
Some of the most commonly installed official apps are:
- File editor—Edit YAML files directly in your browser; ideal for light editing.
- Studio Code Server—A full browser-based version of VS Code and the best choice for extensive YAML or template work.
- Samba share—Share HA’s
/configdirectory over the local network so that you can manage it with your computer’s file manager. - Terminal & SSH—Connect to HA OS over SSH for advanced troubleshooting.
- Node-RED—Build automations with a drag-and-drop visual editor; complex flows can be easier to maintain here than in the HA UI.
- ESPHome—Build and flash firmware for ESP32 and ESP8266 devices; essential for DIY sensors.
- Zigbee2MQTT—Supports more Zigbee devices than ZHA and benefits from rapid community updates.
- Mosquitto broker—An MQTT message broker that provides the communications layer for Zigbee2MQTT and many DIY devices.
HACS (Home Assistant Community Store)
HACS is a community-maintained store for third-party packages. It is not the same as the official App store:
- Official App store: Provides stand-alone containerized services that run on Home Assistant OS and are reviewed by the official project.
- HACS: Provides packages that run within or extend Home Assistant itself—custom integrations, custom dashboard cards (Lovelace cards), themes, python_script packages, and AppDaemon apps. Home Assistant does not officially review them, so quality is the author’s responsibility.
When should you install HACS? Consider it when no official integration supports your device, or when the built-in cards are not capable or attractive enough for your needs. There is no need to rush: check for official support before turning to HACS.
Installation overview (see the official documentation for full instructions):
- To install HACS itself, use SSH or Studio Code Server to run an installation script in HA. Recent versions also support a one-click installation through the HACS Bootstrap app.
- Next, add the HACS integration in HA. It displays a GitHub device code and URL. Open the URL in a browser, sign in to GitHub, and enter the device code to authorize HACS; you no longer need to create a personal access token manually.
- When setup is complete, a HACS icon appears in the sidebar. Open it to browse the community package catalog.
Official installation documentation: https://hacs.xyz. The procedure changes over time, so always follow the current official instructions.
Popular package categories include:
- Custom dashboard cards:
mushroom-cards(clean, modern design),button-card(extensive customization),mini-graph-card(attractive history graphs), andswipe-card(swipe navigation on mobile devices). - Community integrations: Local integrations for Xiaomi/Aqara and Tuya that avoid the international cloud, the SwitchBot API, Taiwan Power electricity rates, and Taiwan weather forecasts.
- Themes: Community themes such as Google Home, Graphite, and Noctis.
Four ways to connect remotely
At home, you can connect to HA over its local IP address. To view cameras, turn off lights, or receive notifications while away, however, you need remote access. There are four common options:
| Option | Cost | Security | Difficulty | Best for |
|---|---|---|---|---|
| Nabu Casa | USD $6.5/month | High | Very low | Most people; your subscription also supports Home Assistant |
| DuckDNS + Let's Encrypt | Free | Medium (internet-facing) | Medium | People who want a free option, have a public IP address, and are willing to configure their router |
| Tailscale / ZeroTier | Free (personal use) | Highest | Low | Technical users who value privacy and do not need to share access beyond the household |
| Cloudflare Tunnel | Free | Medium to high | Medium | Connections without a public IP address, including carrier-grade NAT (CGNAT) |
1. Nabu Casa (Home Assistant Cloud)—Home Assistant’s official paid cloud service. It is the simplest option: subscribe, enable the integration, and connect. The subscription also includes Google Assistant and Alexa integration plus cloud text-to-speech (TTS). It is the best choice if you do not want to tinker, and the only option that also directly funds Home Assistant development.
2. DuckDNS + Let's Encrypt—Use a free dynamic DNS service to assign a domain name, such as myhome.duckdns.org, to your home’s changing IP address, then obtain a free SSL certificate from Let's Encrypt. This requires port forwarding on your router. Its main drawback is that it exposes HA to the public internet, giving it the largest attack surface of these options.
3. Tailscale / ZeroTier—This approach creates a VPN into your home. Install the Tailscale app on your phone and HA at home, and the two devices form a private network. You can then connect to HA through its private IP address while away, just as you would at home. It is the most secure option because HA is never exposed directly to the public internet. The trade-off is that every family member needs the app, and you cannot share access with an outsider as easily as sending a link to a contractor.
4. Cloudflare Tunnel—Cloudflare creates an encrypted tunnel between HA and its CDN. You do not need a public IP address or an open router port; Cloudflare provides a URL through which you connect. This works well when your internet provider uses CGNAT and does not give you a public IP address. You can also add Cloudflare’s web application firewall (WAF) protection.
Security warning
If those terms are unfamiliar, use Nabu Casa or Tailscale instead of opening a port yourself. The money you save is not worth the risk of exposing your entire smart home—including cameras and door-lock controls—to the internet.
Frequently asked questions
Will HACS packages slow down Home Assistant?
They can, but the impact depends on what you install. HACS offers two very different types of package:
| Type | Where it runs | Impact |
|---|---|---|
| Custom integration | On the HA host’s back end, sharing the same CPU and memory as built-in integrations | Can slow startup; poorly written code can block the entire startup process, and some integrations poll external APIs frequently |
| Custom card or theme (Lovelace card or theme) | In your browser or mobile app | Almost no impact on the host; the dashboard simply downloads a few more files the first time it loads |
Installing 20 attractive cards is therefore usually fine, while installing 8 custom integrations that all poll cloud services can have a noticeable impact. HACS itself also checks GitHub for updates periodically, but this uses very little background traffic.
If you suspect a package is causing a slowdown, the cleanest test is to start HA once in safe mode (see the next question). Safe mode loads no custom integrations, custom cards, or custom themes. If HA runs like new in safe mode, you have found the category of the problem.
A HACS package broke or will not start after I updated Home Assistant. What should I do?
This is part of using HACS. Do not panic; work through these steps in order:
-
Recover HA in safe mode
Go to Settings → System → Restart Home Assistant in the upper-right corner → Restart Home Assistant in safe mode. This loads Home Assistant Core without any custom integrations, cards, or themes, allowing you to access the interface.
-
Check the logs to identify the culprit
Go to Settings → System → Logs. A broken custom integration usually leaves a long error message whose first line identifies the affected
custom_componentspackage. -
Check the package’s GitHub issues
HA releases a new version every month, and someone has often opened an issue in the author’s repository by the day of a major release. In most cases, you can wait for the author to publish a compatible version and then update it through HACS.
-
If you cannot wait, remove the package temporarily
Remove the package in HACS, restart HA to restore normal operation, and reinstall it later. Losing one feature is better than having the entire system fail to start.
-
If nothing else works, restore a backup
Follow the backup restoration process in Chapter 9 to return to the version you used before the update. This is why you should always have a backup before upgrading.
When should I look for an app (formerly an add-on), and when should I look in HACS?
Ask whether the feature needs to run as a separate program:
| What you need | Where to look |
|---|---|
| A stand-alone server program: an MQTT broker, Zigbee2MQTT, ESPHome, Node-RED, a database, or SSH | Apps (formerly add-ons) |
| A way for HA to recognize a device or service that has no official support | A custom integration in HACS |
| A more attractive dashboard, a specialized card, or a different theme | Cards or themes in HACS |
Zigbee2MQTT is the easiest example to confuse because it involves both. The program itself is an app—or a container that you run yourself. Its devices appear in HA through automatic discovery by the MQTT integration. Its attractive network-map card, meanwhile, comes from HACS. These are 3 separate components in 3 separate places.
I use Docker (Home Assistant Container), so I do not have the App store. Does that mean I cannot use these tools?
No. You simply need to do some of the work yourself. There are 2 separate considerations:
- HACS still works. HACS supports Home Assistant OS/Supervised, Container, and Core. Container and Core use the same official download script: open a terminal in the container (or on the host) and run
wget -O - https://get.hacs.xyz | bash -. Restart HA, then add HACS on the Integrations page and complete the GitHub authorization. On OS/Supervised, add the HACS app repository and install it from there. The procedure changes over time, so follow the current instructions at hacs.xyz. - You must run app functionality in your own containers. An app is essentially a Docker container managed for you by Supervisor. Zigbee2MQTT, ESPHome, Mosquitto, and Node-RED all provide official Docker images; add each service to your
docker composeconfiguration to get the same functionality. The difference is that you are responsible for updates, backups, and configuration. These services do not appear in the HA interface and are not included in HA backups.
Which of these 4 remote-access options is the most secure?
Based on security alone, they rank as follows:
-
Tailscale / ZeroTier—most secure
Your HA instance never appears on the public internet. There is no URL to scan and no port to probe, so an attacker cannot even find the target. The trade-off is that everyone who needs access must install the app and receive authorization from you.
-
Nabu Casa—secure and effortless
Home Assistant Cloud manages certificates and the connection channel, again with no need to open a router port. You need only secure your own HA account and password.
-
Cloudflare Tunnel—reasonably secure, depending on the configuration
Not opening a port is a major benefit, but by default, anyone can reach the URL; they simply stop at HA’s sign-in page. To raise its security further, put an identity-verification service such as Cloudflare Access in front of it.
-
DuckDNS + port forwarding—most dangerous
This puts HA directly on the public internet. The security warning earlier in this appendix addresses this approach.
Whichever option you choose, enable multi-factor authentication (MFA). Setup instructions are in Chapter 5. This is essential for every remote-access option.
Nabu Casa costs USD $6.5 per month. Is it worth subscribing?
Start by considering what the subscription includes. Current official pricing is USD $6.5 per month or $65 per year (€7.50 per month or €75 per year in the eurozone), and you can try it free for 1 month before deciding. You receive:
- Secure remote access without reconfiguring your router.
- Google Assistant and Amazon Alexa integration. Connecting either service yourself requires a developer account and OAuth configuration, which is genuinely complicated.
- Cloud text-to-speech (TTS) and speech-to-text (STT) for the Assist voice assistant.
- A relay (TURN) server for camera WebRTC connections when a direct connection is unavailable, which makes a difference when viewing cameras away from home.
- Direct financial support for Home Assistant development. The project has no ads and does not sell your data; subscriptions help sustain it.
Use these guidelines to decide:
| Your situation | Recommendation |
|---|---|
| You need only remote access, have no voice assistant at home, and do not mind everyone installing an app | The free Tailscale plan is sufficient |
| You need Google or Alexa integration, or someone at home does not want to install a VPN app | Nabu Casa; the time saved is worth far more than the subscription |
| You often view your home cameras while away | Nabu Casa; its relay server is difficult to replicate yourself |
| Your goal is to learn these networking technologies | Build your own solution, but follow the security guidance above |
Cloudflare Tunnel is free. Can I use it to view my home cameras while away?
Technically, yes, but this use case is particularly likely to cross the line. Cloudflare’s CDN terms have long restricted delivery of video and large files that are not hosted on Cloudflare’s own services. Later revisions state explicitly that video content must be stored on Cloudflare services such as Stream, Images, or R2 to avoid those restrictions. A live stream from your home camera clearly does not fall into that category.
Opening a feed for an occasional glance is unlikely to cause trouble. Streaming 4 dashboard cameras all day, however, means sending sustained high-volume traffic through the service. Cloudflare would be within its rights to restrict or close your account.
Better options for viewing cameras smoothly while away include:
- Nabu Casa—Remote camera streaming is one of its intended features, and its TURN relay can help establish the connection.
- Tailscale / ZeroTier—You view the cameras over your own private network, so third-party content-delivery terms are not an issue. Image quality may still suffer if the route is long or your mobile connection is slow.
Cloudflare Tunnel is better suited to homes behind carrier-grade NAT (CGNAT) that cannot obtain a public IP address and mainly need remote control and status checks—not a video transport for security cameras.