Proxy setup with DuckDNS and Nginx

Important clarification: I use my nabu-casa URL to access HA, so I hadn't configured anything regarding domains and other settings before installing the proxy.

Summary of steps:

1. Create a DuckDNS domain.
2. Install the DuckDNS addon.
3. Install the NGINX Home Assistant SSL proxy addon.
4. Install the tesla_http_proxy addon.
5. Redirect port 443 on your router.
6. Start the addons.
7. Create a Tesla developer account.
8. Configure tesla_http_proxy.
9. Configure vehicles.

Create a DuckDNS Domain

1. Go to the duckdns.org website.
2. Log in using one of the provided services.
3. Create a domain name through the interface. In the following, the domain name will be tesla.duckdns.org.
4. Ensure that the assigned IP is correct; update manually if necessary.
5. Copy the domain name and token from this page.

Install the DuckDNS Addon

Complete documentation can be found here. In summary:

1. From the Home Assistant interface, go to Supervisor -> Add-on Store.
2. Search for the DuckDNS addon and click on it.
3. Click on Install.
4. Addon Configuration:

domains:
  - tesla.duckdns.org
token: <your_token>
aliases: []
lets_encrypt:
accept_terms: true
algo: secp384r1
certfile: fullchain.pem
keyfile: privkey.pem
seconds: 300

Install the NGINX Home Assistant SSL Proxy Addon

Complete documentation can be found here. In summary:

1. Install the NGINX Home Assistant SSL proxy addon as you did for DuckDNS.
2. Add the following block to the configuration.yaml file of Home Assistant (in the /config directory):

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24

3. Addon Configuration. Note that the main domain is different from tesla.duckdns.org. I intentionally use a dummy domain because I don't use NGINX to access my HA instance externally:

domain: core-nginx-proxy
hsts: max-age=31536000; includeSubDomains
certfile: fullchain.pem
keyfile: privkey.pem
cloudflare: false
customize:
  active: true
  default: nginx_proxy_default*.conf
  servers: nginx_proxy/nginx_*.conf

Install the tesla_http_proxy Addon

Complete documentation can be found here. In summary:

1. Add the GitHub repo to the add-on store:
   • Navigate to the add-on store.
   • Click on the three dots in the top right, then on Repositories.
   • In the Manage add-on repositories window, add the GitHub repo URL: https://github.com/llamafilm/tesla-http-proxy-addon
2. Install the addon as you did for the other two.
3. Initial Configuration:

client_id: ""
client_secret: ""
domain: tesla.duckdns.org
debug: true
regenerate_auth: false
region: Europe, Middle East, Africa

Redirect Router Port 443

From your router interface, redirect traffic on port 443 to your HA instance (IP of the client or VM running it). The method varies for each device depending on its interface.

Start the Addons

1. Launch DuckDNS. Wait a few moments.
2. Then launch Nginx. Wait a few moments.
3. Start the HTTP proxy. Wait a few moments. It will crash with an error like: FATAL: Fix public key before proceeding. This is normal at this stage; do not try to resolve it.
4. Restart Nginx.

At this stage, check that your public key is accessible at https://tesla.duckdns.org/.well-known/appspecific/com.tesla.3p.public-key.pem.

Create a Tesla Developer Account for Obtaining Client ID and Client Secret

Go to the developer.tesla.com website. For those concerned about creating an account, it seems okay according to what's mentioned on the official GitHub.

Fill out the form with the following parameters:

1. Business Details - will differ based on your country

   • Business Name: Personal Use
   • Country/Regions: France
   • TAX ID: FR00000000000
   • Address Line 1: My Home
   • City: My City
   • Zip Code: 00000

2. Application Access Request

   • Application Name: Tesla-Endpoint
   • Purpose of Usage: Personal use.

3. Application Access Request

   • Authorization Code and Machine to Machine
   • Allowed Origin URL(s): https://tesla.duckdns.org
   • Allowed Redirect URL(s): https://tesla.duckdns.org/callback

4. Application Access Request Check the boxes:

   • Profile Information
   • Vehicle Information
   • Vehicle Commands
   • Vehicle Charging Management

At this stage, your request will be submitted to Tesla. In my case, it was immediately approved. You'll then arrive at the developer dashboard and can access your application.

Copy the Client ID and Client Secret.

Configure tesla_http_proxy

Back in HA, on the proxy configuration page, enter the client ID and client secret.

Restart the addon. At this stage, you should be able to access the UI.

Subsequently:

1. Click on "Login to Tesla account".
2. Authenticate with your credentials.
3. You'll be redirected to a URL that will generate a 404 error.
4. Copy the URL and paste it in the field provided in the addon interface (below Login to Tesla account).
5. Click on "Generate token from URL".
6. The refresh token will be displayed. Make sure to copy it.

Set up the Tesla Custom Integration

1. Assuming you are using HACS: in HACS > Integrations > Explore & Add Repositories search for "Tesla". Add https://github.com/alandtse/tesla as a custom repository.
2. Restart Home Assistant.
3. In the HA UI go to "Settings" -> "Devices & Services" then click "+" and search for "Tesla Custom Integration".
4. In the setup modal, check "Use fleet API proxy" and click "Submit".
5. On the next page, fill out your e-mail address and the refresh token that you copied in the previous section. Everything else should already be filled out for you.
6. Click "Submit" to finish setting up the Tesla Custom Integration.

You will now have read-only access to your vehicle(s) and other assets. Just one more step to go:

Vehicle Configuration

Steps to repeat for each vehicle:

1. Sit in the vehicle with your phone.
2. Open the Home Assistant app and go to the proxy addon interface.
3. Press Enroll public key in your vehicle.
4. A confirmation will be requested to authorize access to your vehicle. Grant access after verifying the domain name.
5. If everything goes well, after a few moments, a validation message will be displayed, and you should see a new key in the list of authorized keys for your car. The mention fleet key should be present.