-
Notifications
You must be signed in to change notification settings - Fork 90
Troubleshooting
In this page you can find the most common problems users reported and respecting solutions for them.
Make sure to add the trusted proxy setting correctly. Make sure to copy and paste the code snippet without adapting anything. There is no need to adapt IP ranges as the app is working as proxy.
Check that the value of the apps's configuration property External Home Assistant Hostname matches the fully qualified domain name (FQDN) registered in Cloudflare DNS for Home Assistant.
For example, if the app has registered the DNS CNAME record homeassistant in the zone mydomain.tld, than External Home Assistant Hostname must be set to homeassistant.mydomain.tld. Otherwise the app won't be able to correctly forward requests to a Home Assistant and you'll get HTTP 404: Not found when accessing homeassistant.mydomain.tld.
Cloudflare use heuritstic-based rules to reject bots and web-site attacts. Sometimes this results in false positives, rejects legitimate Companion App traffic breaking some app features.
In this particular case a fresh Cloudflare account without any configured firewall rules (which means - allow all) has rejected some requests, while allowing most of them to pass through. Cloudflare Security / Events section in that case is empty.
In Companion App / Event Log following messages were observed:
Network Request: Webhook failed with the status code 503
Device tracking and automation rules like iPhone left home zone were disfunctional, because device updates were blocked by Cloudflare.
If you download logs over Companion App / Debugging you will see the following failed requests:
2023-01-06 14:39:37.478 [Info] [main] [ClientEventStore.swift:8] ClientEventStore > networkRequest: Webhook failed with status code 503 [:]
2023-01-06 14:39:37.482 [Error] [main] [WebhookManager.swift:633] urlSession(_:task:didCompleteWithError:) > failed request to 6BEA5895-63A8-42B1-9FFC-5801A86BB1DB for WebhookResponseLocation: unacceptableStatusCode(503)
To mitigate this problem you can create an explicit firewall pass rule for traffic related to your HA sub-domain. For that, navigate to Cloudflare / Security / WAF / Create firewall rule and create the rule:
(http.host eq "ha.example.com")
There ha.example.com is your domain where you expose your HA installation. Set action to this rule to skip and check All remaining custom rules under WAF components to skip.
Once you saved, the rule will be applied immediately. You can now force app updating location by clicking the link Settings / Location / Update location.
In Settings / Debugging / Event Log you should see notifications about successful update:
Location Update: Location update triggered by user
To further troubleshoot error caused by Cloudflare blocking your traffic you can create a default capture all rule e.g. with expression:
(ip.src in {0.0.0.0/0})
Place this rule as the last in your WAF ruleset.
You can check know Security / Events log for possible rejections for traffic not matched by the first explicit Allow rule and fine-tune it as needed to include all traffic direct to HA appliance from the app.
Root cause
The problem is apparently caused by Cloudflare falsely detect app location update traffic as a malicious bot attacking the web-site. The app may use unusual header, which are not typical for human browser-based behaviour.
You may noticed that after a while you can remove the rule and the traffic is still accepted. This is probably because Cloudflare algorithms learned that the traffic is legitimate.
Other methods to try
If you still see that some sporadic 503 errors here and there, when working over Cloudflare tunnel, you may try:
- Disabling Bot Fight Mode in Security / Bot.
- Disabling Browser Integrity Check in Security Setting.
- Set Security Level to Low to reduce risk of showing Challenge page to the Companion App.
If you want to remove the option additional_hosts from your app configuration, you have to add an empty array, not simply remove it. So looking in YAML this would look like this:
additional_hosts: []
After activating Cloudflare app, the authentication can fail, if the Companion App sends old refresh tokens to the new HomeAssistant URL.
To mitigate the issue you can remove old Refresh Tokens by navigating to user Profile page on https://<homeassistant>/profile.
Click on the trash bin icon to remove the old refresh token and re-login to HomeAssistant.
If you are having problems connecting to HA from different devices / browsers / the companion App and receive error 1004 "NSURLErrorDomain", it might be due to Cloudflare not detecting your encryption mode properly. To solve this, manually select the encryption mode "Full (Strict)" following this documentation.
If you get this issue when connecting via https via Cloudflare, a potential solution is to force a redirect from HTTP to HTTPS. Go to your Cloudfare dashboard, then click on your domain, SSL/TLS -> Edge Certificates. In the new window, scroll down and check "always use HTTPS".
Another issue leading to this error might be that your SSL certificate is not issued yet. On that same screen (Edge Certificates) at the top you can see the Status of the certificate. If the status is Pending and not Active, you have to wait for up to 24h for it to be activated.