Home Assistant
Open-source home automation: local control and privacy-first smart home
Screenshot from verification · Click to enlarge
Application tests passed; AWS environment evidence comes from the referenced platform verification.
Quick Deploy
Use the recommended configuration, or customize it below.
Recommended configuration
- Version
- 2026.9.4
- AWS Regions
- us-east-1
- Instance
- t3.medium
- Persistent data volume
- 60 GB
Customize configuration
Change the version, region or resources. Larger resources have not been verified separately.
Before creating resources
Check these prerequisites yourself. This website cannot inspect your AWS account and never asks for AWS access keys.
- Use an AWS account with permission to create CloudFormation, IAM, VPC, EC2, EBS and log resources in us-east-1. Budget for a running instance before continuing.
- Private access is the default. Install AWS CLI and the Session Manager plugin locally, sign in to the same account, and obtain permission to start SSM sessions. Port 8080 must be available.
- No domain is needed for private access. To serve users over HTTPS later, prepare a domain you control and initialize the administrator privately first.
Est. AWS cost · ≈ $39/moVerified default in us-east-1: ~$30.4 t3.medium + ~$2 for the 30 GB root and data gp3 volumes + $3.65 public IPv4 per month.An estimate, not a quote or a spending limit. Check the region, root disk, data disk and public IPv4; traffic, snapshots and logs are extra. Custom configurations need a new estimate.
Deleting the stack terminates the host, but the data volume is retained and continues billing. Snapshot it first, then delete the retained volume manually when you no longer need it.
Deployment steps and post-deploy actions
Create, connect, then initialize
These are instructions, not live deployment status. Stack creation, a working connection and administrator setup are three separate steps.
- Review stack "corenova-home-assistant-2026-9-4" in CloudFormation. Keep the private access parameters and pinned image, confirm the resource costs and IAM acknowledgement, then choose Create stack.
- Wait for CREATE_COMPLETE, usually about 10 minutes. If creation fails or rolls back, inspect Events before retrying.
- Open the stack's Outputs tab:
InstanceIdInstance ID — use it to open an SSM shell or locate the hostSSMPortForwardCommandPort-forward command — run locally and keep the session openResolvedLaunchUrlPrivate access URL — open after starting the SSM tunnel
- Copy SSMPortForwardCommand into your local terminal. Keep the session open, then visit http://localhost:8080 in your browser. The public IP is not the default app entry point.
The command forwards local port 8080 to instance port 80 over SSM; port 22 stays closed. Closing the terminal ends access. Use the same AWS account and region as the stack.
- Admin console — Open your access URL followed by this path:
/First visit opens the onboarding wizard: create the owner account, set location, then discover integrations. There are no preset credentials.
- Complete the application's first-run setup through this private connection, then sign out and sign back in. CREATE_COMPLETE alone does not mean an administrator has been created.
Optional: enable protected HTTPS
After private initialization, point your domain's DNS to the instance, allow the certificate challenge on port 80 and intended HTTPS clients on port 443, then open an SSM shell. Replace both example values before running:
sudo /opt/corenova/bin/enable-https.sh app.example.com [email protected] --confirm-initializedThis requests a trusted certificate and configures renewal. Failure must leave private access in place. HTTPS keeps an additional proxy login; retrieve it only through SSM from /opt/corenova/credentials/admin.txt. This is not an anonymous public site or webhook endpoint.
Access, HTTPS and troubleshootingIf a step fails
- Permissions, rollback or timeout: open CloudFormation Events and locate the first CREATE_FAILED resource. Do not create repeated stacks before inspecting the cause.
- Connection refused or access denied: check the SSM session, AWS account/region and local port 8080. For DNS, certificate or administrator errors, stay on the private connection; never work around them by opening public HTTP.
- Share the app/version, region, failed resource and a redacted error. Never share passwords, access keys, session tokens or unredacted logs. Clean failed stacks and inspect any remaining billable resources.
Good to know
- Verified with the default SQLite recorder. Integrations and device discovery inside a cloud VPC are limited to what the network exposes; USB/Bluetooth radios are not available.
- Config and database live on a retained volume (/config). It keeps billing after stack deletion; snapshot it, then delete the volume when no longer needed.
- Home Assistant benefits from ~1 GB+ RAM; the CFN 'medium' profile (t3.medium) is recommended once integrations grow.
Next steps
- Your data lives at /config inside the container, on an encrypted EBS volume. Find the instance by its ID in the EC2 console.
- Back up before any changes: Upgrading and backups guide
- To upgrade to a newer verified version: Version history
Deleting the stack terminates the host, but the data volume is retained and continues billing. Snapshot it first, then delete the retained volume manually when you no longer need it.
Versions
View full version history| Versions | Verified At | Verified | Status | AWS Tested |
|---|---|---|---|---|
| 2026.9.4 | Sep 27, 2026 | Verified | Bug Fix | AWS · referenced |
| 2026.9.3 | Sep 18, 2026 | Verified | Bug Fix | AWS · referenced |
| 2026.9.2 | Sep 11, 2026 | Verified | Initial | AWS · referenced |
Technical information
FAQ
How do I access Home Assistant after deployment?
After CREATE_COMPLETE, run SSMPortForwardCommand from the stack Outputs in your local terminal and keep it running. Open http://localhost:8080 to initialize the application privately. Public access stays blocked until you explicitly enable HTTPS. First visit opens the onboarding wizard: create the owner account, set location, then discover integrations. There are no preset credentials.
Where are application data and credentials stored?
Application data is mounted at /config from the encrypted EBS data volume. The volume survives stack deletion and keeps billing; retention is not a backup. Platform proxy credentials and host configuration are on the root disk and are not included in a data-volume snapshot. See the backup guide before deleting anything.