I do it, but I'm completely insane:
- I actually stay on top of all patches, including HomeAssistant itself
- I run it behind a WAF and IPS. lots of VLANs around. even if you breach a service, you'll probably trip something up in the horrific maze I created
- I use 2-factor authentication, even for the limited accounts
- Those limited accounts? I use undocumented HomeAssistant APIs to lock them down to specific entities
- I have lots of other little things in place as a first line of defense (certain requests and/or responses, if repeated a few times, will get you IP banned from my server)
I would not recommend any sane person expose HomeAssistant to the internet, but I think I locked it down well enough not to worry about a VPN.
- I actually stay on top of all patches, including HomeAssistant itself
- I run it behind a WAF and IPS. lots of VLANs around. even if you breach a service, you'll probably trip something up in the horrific maze I created
- I use 2-factor authentication, even for the limited accounts
- Those limited accounts? I use undocumented HomeAssistant APIs to lock them down to specific entities
- I have lots of other little things in place as a first line of defense (certain requests and/or responses, if repeated a few times, will get you IP banned from my server)
I would not recommend any sane person expose HomeAssistant to the internet, but I think I locked it down well enough not to worry about a VPN.