I’m just trying to setup the custom domain for my Homey SHS, but Homey rejects setting up my custom domain.
Homey SHS is running in my local network
Local user for Homey SHS is enabled
A record (IPv4) for my CUSTOM_DOMAIN is set to reach the `PUBLIC_IP` of my local network
Port forwarding PUBLIC_IP:443 -> LOCAL_REVERSE_PROXY_IP:443 on my router is set up, to reach my local reverse proxy
Local reverse proxy forwards LOCAL_REVERSE_PROXY_IP:443 -> LOCAL_HOMEYS_IP:4859 (web sockets are enabled)
Local reverse proxy has a valid SSL certificate for my CUSTOM_DOMAIN
I can access Homey SHS in browser using https://CUSTOM_DOMAIN, everything works
Edit Custom Domain in Homey account fails with error message: Something went wrong, please try again
In fact the only reason I set up a public DNS entry and enabled port forwarding on my router is, that I thought Homey may validates the domain before saving it.
But it seems like this didn’t help, still the same error.
The actual goal is to set up my custom domain but not having a public DNS entry for, I just want to have the DNS entry in my local network. For me there is no need to access Homey SHS via internet.
This is what Homey Bot replied (it’s pretty accurate):
What I understand so far
You run Homey Self-Hosted Server (SHS) on your LAN behind a reverse proxy.
Public DNS points CUSTOM_DOMAIN → your public IP and you’ve forwarded 443 → reverse proxy → Homey SHS at http://HOMEY_IP:4859 with valid HTTPS and WebSockets enabled.
You can open https://CUSTOM_DOMAIN successfully in a browser.
But saving the Custom Domain in your Homey account (My Self-Hosted Servers → Edit Custom Domain) fails with “Something went wrong, please try again.”
Your end goal is to use a custom domain only inside your LAN (no public DNS), ideally.
Key points about Custom Domain validation:
When you save a Custom Domain, Homey validates that your SHS is reachable at that domain before it’s saved. If it’s saved, it’s working.
The reverse proxy must:
Terminate HTTPS on port 443 for your custom domain
Forward to http:// :4859
Have WebSocket support enabled
Given your checklist, here are focused checks to resolve the save failure:
Confirm external reachability exactly as Homey validates
Validation expects:
HTTPS on port 443 (not another port)
A valid TLS certificate matching the custom domain
Working WebSockets end-to-end
No HTTP auth or IP whitelists that block Homey’s validator
Action:
Temporarily disable any geo/IP allowlists or basic-auth on your reverse proxy for this host to let the validator reach it.
From an external network (e.g., mobile data), open:
https://CUSTOM_DOMAIN
Ensure pages load and interactive parts work (to hint that WebSockets are allowed).
If you use Cloudflare or similar in front, ensure:
“WebSockets” is enabled,
SSL mode is Full (strict preferred),
No bot/Firewall rules block requests from unknown IPs.
Double-check proxy target and headers
Target must be http://HOMEY_IP:4859 (per docs). Avoid proxying to 4860.
Ensure upgrade headers are passed for WebSockets:
Connection: upgrade
Upgrade: websocket
X-Forwarded-Proto: https (helps SHS know it is behind HTTPS)
Remove forced HSTS/redirect loops during validation. The path “/” should load cleanly over HTTPS.
Certificate chain and SNI
Use a publicly trusted cert (Let’s Encrypt, etc.) and include full chain.
The reverse proxy must present the cert when SNI = CUSTOM_DOMAIN on port 443.
DNS propagation and caching
If you recently created/changed the public A record, wait up to an hour and try again.
Verify with:
nslookup CUSTOM_DOMAIN 8.8.8.8 → returns your public IP
curl -I https://CUSTOM_DOMAIN from an external host
Try the basics once more:
Restart reverse proxy and SHS.
Re-attempt saving via My Self-Hosted Servers → Edit Custom Domain.
About using a LAN-only custom domain:
The validator requires the domain to be reachable to save it. A private/LAN-only DNS entry typically won’t pass validation from outside, so the save will fail.
If your goal is LAN-only access and you don’t need the app to prefer the domain, you can:
Skip the Custom Domain feature and just use your own DNS override internally (e.g., split-horizon DNS) to map CUSTOM_DOMAIN → HOMEY_IP, and keep using the standard connection. Or
Keep a minimal public A record + 443 reachability only for validation and ongoing app use. Once saved, the Homey app prefers the custom domain across iOS/Android/Web. Removing public reachability later may break that behavior.
If you want to keep it private only
Recommended: Don’t set a Custom Domain in the Homey account. Instead, run your reverse proxy and internal DNS to serve CUSTOM_DOMAIN only on LAN. The Homey app will continue to connect via the default, managed routes (local when at home, cloud relay when away).
If you still want the app to prefer your domain, you’ll need to keep the domain publicly reachable at 443 with a valid cert and WebSockets.
Two quick questions to pinpoint the blocker:
Do you have any IP allowlists/basic-auth/firewall rules on the reverse proxy for this host?
Can you confirm that https://CUSTOM_DOMAIN is reachable from outside your network (mobile data) and that WebSockets work?
If you can share your reverse proxy product (e.g., Nginx Proxy Manager, Traefik) and any special security rules, I can provide exact header/rule snippets to pass validation.
If everything above checks out and it still fails, please capture:
The exact time you attempted to save
Your SHS version and reverse proxy brand/version
A redacted screenshot of the error Then visit our support page to create a ticket, and include those details so we can review the validation logs.
The validator requires the domain to be reachable to save it. A private/LAN-only DNS entry typically won’t pass validation from outside, so the save will fail.
Right, that’s why I setup a public DNS entry at my DNS provider for my domain, not on the pi-hole in my local network.
To confirm this:
Confirm external reachability exactly as Homey validates
HTTPS on port 443 (not another port)
A valid TLS certificate matching the custom domain
Working WebSockets end-to-end
No HTTP auth or IP whitelists that block Homey’s validator
Here are more details about the setup
1. DNS: ClouDNS
A record for CUSTOM_DOMAIN , targets the PUBLIC_IP address assigned to my home internet connection by my ISP.
2. Router: Unifi Cloud Gateway
Port forwarding for port 443 to the REVERSE_PROXY_IP on port 443 in my local network
3. Reverse proxy: Nginx Proxy Manager
Proxy Host set up for CUSTOM_DOMAIN on port 443 to local HOMEY_SHS_IP on port 4859.
The proxy uses a valid matching SSL certificate for CUSTOM_DOMAIN issued by Let’s Encrypt.
Websocket support is enabled.
HSTS is not enabled.
No geo/IP allowlists or basic-auth enabled
When I open https://CUSTOM_DOMAIN on my phone while being on mobile data, not connected to my local WiFi. Homey-SHS opens, I can login with the local user, I can see and edit flows or devices, just everything works as expected.
What I understand
Public DNS via ClouDNS → PUBLIC_IP.
UniFi Cloud Gateway forwards 443/TCP → Nginx Proxy Manager (NPM) 443.
NPM terminates TLS with Let’s Encrypt for CUSTOM_DOMAIN, WebSockets enabled, no auth/allowlists, HSTS off.
NPM proxies to http://HOMEY_SHS_IP:4859.
From mobile data, https://CUSTOM_DOMAIN fully works (login, flows, devices). So public reachability, TLS, and WebSockets are good.
Yet, My Self-Hosted Servers → Edit Custom Domain fails with “Something went wrong, please try again.”
Given your setup meets all documented requirements, the failure likely isn’t due to reachability. The most common remaining causes are subtle proxy header issues, SNI/cert chain presentation, or a transient validation error on save.
Targeted actions to resolve:
Ensure upstream protocol awareness
In Nginx Proxy Manager, enable “Block Common Exploits” off for a quick test (if on), and add the following advanced config for this host to make sure SHS knows it’s behind HTTPS:
Under Proxy Host → Advanced:
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection “upgrade”;
Save and test again in the Homey account.
Verify full certificate chain and SNI
In NPM SSL settings for this host, ensure the Let’s Encrypt cert includes the full chain (NPM typically handles this, but if you manually uploaded, re-issue via Let’s Encrypt within NPM).
Confirm the certificate’s CN/SAN exactly matches CUSTOM_DOMAIN and is presented when SNI=CUSTOM_DOMAIN on port 443.
Quick check from an external machine:
curl -Iv https://CUSTOM_DOMAIN
You should see the correct cert chain and an HTTP/2 or HTTP/1.1 200/302 from SHS via NPM.
Temporarily bypass HTTP/2
Some validators are picky with HTTP/2 + upgrade. In NPM Advanced for this host, try disabling HTTP/2 for the test:
add: proxy_set_header Connection “upgrade”;
and in the SSL tab, temporarily uncheck “HTTP/2 Support” (if available in your NPM version).
Retry saving the custom domain.
Confirm proxy target is HTTP on 4859 (not HTTPS)
Keep target as http://HOMEY_SHS_IP:4859 exactly (as per docs). Don’t proxy to 4860.
Retry after a clean restart
Restart NPM container/service and try saving again.
Then restart Homey SHS and retry saving once more, in case the validator hit a stale state.
If it still fails:
Please capture:
Exact timestamp (UTC) of your last “Save Custom Domain” attempt.
Your CUSTOM_DOMAIN (you can DM or redact here if needed for privacy).
NPM version and a screenshot of the host’s SSL and Advanced tabs (redact public IP if you like).
Then create a ticket at our support page so we can check the validator logs on our side. Mention that external reachability, TLS, WebSockets, and reverse proxy checks all pass, but account UI still returns “Something went wrong.”
About LAN-only goal:
Today, saving a custom domain requires external validation. If you prefer LAN-only, you can skip setting the Custom Domain in the account and continue using split-horizon/internal DNS and your NPM setup just for local access. The Homey apps will keep preferring local connections at home and cloud relay when away.
Would you like me to draft the exact NPM Advanced config block for copy/paste, or help you file the ticket with the right details?
Note that the Homey mobile app will always use the proxy connection when you’re away from home (unless you use a VPN to access your home network). I would recommend using the built in secure remote access, but if you choose to use port forwarding, make sure to block it to specific IP ranges as 443 is a widely targeted port by IP scanners.
This helped me, the certificate was working in Nginx Proxy Manager, but the full chain could not be verified. Just updated the certificate there and now it works.
Local user for Homey SHS is enabled
Edit Custom Domain in Homey account fails with error message:
