Hass Guard
Hass Guard runs a small read-only agent beside Home Assistant and sends privacy-minimized health, backup, and security snapshots to the portal.
Installation
- Add the Craftama apps repository to Home Assistant.
- Install Hass Guard from the app store.
- In https://guard.infra.craftama.eu, create or open the Home Assistant instance and generate a pairing code.
- Paste the code into the app configuration and start it.
The backend defaults to https://guard.infra.craftama.eu. Keep it as the site origin: the agent automatically adds its /api/v1 paths.
Options
| Option | Default | Description |
|---|---|---|
| backend_url | https://guard.infra.craftama.eu | Hass Guard site origin, without /api. |
| pairing_code | empty | Single-use code generated in the portal. |
| interval | 15m | Scan cadence in Go duration syntax. |
| log_level | info | debug, info, warn, or error. |
| inventory_mode | summary | Infrastructure detail: off, privacy-preserving summary, or detailed. |
| live_status | true | Outbound WSS health pulse with HTTPS fallback. |
| on_demand_checks | false | Allow an immediate typed read-only scan from the portal. |
Permission boundary
The app requests the Home Assistant and Supervisor APIs, and the agent performs
only read operations against them to collect health data. Infrastructure
inventory stays on hassio_role: default and uses default-readable system
and per-app information; it does not require the manager role. The app does not
request host networking, the Docker socket, privileged mode, host PID access,
an inbound port, or Home Assistant config directory access.
Raw Home Assistant responses stay inside the app. The outbound snapshot uses allowlisted fields, keyed pseudonyms, and semantic categories rather than raw names and custom attributes. TLS verification is mandatory and redirects are rejected.
Summary inventory sends pseudonymous app identities, state, permission-risk flags, and Supervisor-declared ports without app names or Home Assistant origins. Detailed names and configured origins are opt-in. Neither mode sends ingress URLs, app options, credentials, environment variables, or network interface addresses; inventory can also be disabled. A detailed Home Assistant origin may itself contain an IP address when configured that way.
Backup inventory uses the default-role read-only Supervisor endpoint. It sends only dates, size, scope, protection/compression flags, storage class, bounded content counts, and keyed pseudonyms. Backup names and slugs, storage names, app/folder names, paths, and passwords stay inside Home Assistant. The Agent cannot create, restore, or delete a backup.
For full pairing, lifecycle, and troubleshooting information, see the app documentation.