Can a prompt replace Home Assistant Cloud?

Replace the remote-access half of a Home Assistant Cloud subscription, and be honest about the half you cannot.

Start with the private option, because it is the one most people should choose: install Tailscale on the machine running Home Assistant and on every phone that needs it. The hub becomes reachable at a stable private address from anywhere, with no port forwarded, no certificate to renew and no public surface at all. For a single household this is a twenty-minute job and it is strictly safer than exposing the hub.

If something outside your network genuinely needs to reach it — a webhook from a service, a guest without your VPN — then and only then expose it: a subdomain, DNS pointing at your address, a reverse proxy terminating TLS with automatic certificates, and Home Assistant configured to trust that proxy. Put the hub behind authentication, enable multi-factor, and rate-limit the login endpoint. An unauthenticated home automation hub on the public internet controls the locks.

Write the runbook, because this is the part that decides whether it still works in a year: what to do when the certificate fails to renew, what to do when your address changes, and how to check from outside that the whole path works. Add a monthly external check from a host that is not on your network — a request that must return the login page — and alert when it does not.

For voice, use a local pipeline: a self-hosted speech-to-text and text-to-speech engine driving the built-in assistant. It works, it is private, and it is measurably worse at recognising a request shouted from the kitchen than the cloud one.

Do not attempt to build your own Alexa or Google Assistant integration. It requires an approved skill under each platform's developer terms, and it is a partnership rather than a technical task.