I’ve got it accessible from the internet through a reverse proxy… My default https drops all connections, so you need to access the right subdomain, which are not advertised on dns or certificates (I use a wildcard). Probably not perfect though but it helps a bit. I also have geo-blocking enabled on my pfSense router, so basically everything outside my country gets blocked by the firewall anyway.

It will always be a risk vs benefit consideration.

My HA instance is publicly accessible (with 2FA) through Nabu Casa’s cloud service. Happily paying the subscription price of a whole $7/mo for that feature and to support them.

I can quickly switch it to my own reverse proxy if necessary.

It’s generally fine to open it up, if your somewhat know what you’re doing. I wouldn’t do it without some protection measures like fail2ban and making sure HA is always up to date.

Nabu Casa, the manufacturer of HA, has a paid option where they take care of publicly accessing your local HA instance. I think that’s a good solution as well. It includes backups on their servers.

Why not a presence sensor of and kind? Check your router’s WiFi client list for your phone MAC or something

I’ve got mine accessible with SSL proxy. I would say make sure you use an alternative port to help reduce exposure during scans.

Tailscale is possibly a solution for you.

I don’t really see why you shouldn’t… I have mine behind a reverse proxy, which puts SSL on the public endpoint. The biggest “issue” today, is the isp rotating my ipv4 address to often.

I’m using cloudflared to give it a bit more protection over a plain reverse proxy

Mine is open to the internet, via a nginx reverse proxy. I made it ban people who try to brute-force my password. It’s been fine like that for years now:

http:  
  trusted_proxies:  
    - w.x.y.z  
  use_x_forwarded_for: true  
  ip_ban_enabled: true  
  login_attempts_threshold: 10  

Mine is on the internet. The real risk is a zero day auth bypass, password cracking won’t really work when the HA interface sends notifications on authentication failures.

What I personally do is have it accessible over WireGuard. Open TCP ports to the Internet is a bad idea. This does mean you have to launch WireGuard every time, but it’s way more secure

I have mine available as a tor hidden service.

If you are hosting other things with it, then a reverse proxy like Caddy or Traefik + crowdsec is pretty much as good as you are going to get and you can add region blocking on your router (if that feature is available) or if you use cloudflare as a proxy.

If you want to go really crazy, you can put authelia/Authentik in front of it, depending on what else you host.

So - can I just open it up, and rely on long, complex passeords? Or is that a complete no-go?

Install Fail2Ban on a free cloud VM and watch it for a couple of days. Seeing the never-ending intrusion attempts from around the world was a real eye-opener. There is no way I’d expose HA (or anything else except Wireguard) to the Internet. (Open WG ports appear closed unless they receive the correct key.)

In your situation I’d just pay for Home Assistant Cloud. It’s not expensive and will do exactly what you want to do.

For a zero cost solution I use Tasker to automatically enable a Wireguard tunnel whenever we’re not on home wifi. It allows direct access to everything on our local lan, and as a bonus prevents our wireless carrier from monitoring our Internet activities. A combination of the OpenWRT Ubus integration and a BLE integration (using inexpensive Shelly switch modules) detect when we’re home with 100% accuracy.

I just use a Cloudflare tunnel using the Cloudflared plugin and a custom domain name. So no need to open ports. I use long passwords for the users. Not sure how unsafe it is but in HA you get a notification when a failed login happened.