# Set up custom domain **URL:** \ **Category:** Homey Self-Hosted Server\ **Created:** [August 14, 2026, 8:44am UTC](https://community.homey.app/t/set-up-custom-domain/158277 "2026-08-14T08:44:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Evan](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@Evan](https://community.homey.app/u/Evan)\ **Post date:** [August 14, 2026, 8:44am UTC](https://community.homey.app/t/set-up-custom-domain/158277/1 "2026-08-14T08:44:49Z")
I’m just trying to setup the custom domain for my Homey SHS, but Homey rejects setting up my custom domain. - Homey SHS is running in my local network - ✅ Local user for Homey SHS is enabled - ✅ A record (IPv4) for my `CUSTOM_DOMAIN` is set to reach the ``PUBLIC_IP`` of my local network - ✅ Port forwarding `PUBLIC_IP:443 -> LOCAL_REVERSE_PROXY_IP:443` on my router is set up, to reach my local reverse proxy - ✅ Local reverse proxy forwards `LOCAL_REVERSE_PROXY_IP:443 -> LOCAL_HOMEYS_IP:4859` (web sockets are enabled) - ✅ Local reverse proxy has a valid SSL certificate for my `CUSTOM_DOMAIN` - ✅ I can access Homey SHS in browser using `https://CUSTOM_DOMAIN`, everything works - ❌ **Edit Custom Domain** in Homey account fails with error message: _Something went wrong, please try again_ In fact the only reason I set up a public DNS entry and enabled port forwarding on my router is, that I thought Homey may validates the domain before saving it. But it seems like this didn’t help, still the same error. The actual goal is to set up my custom domain but not having a public DNS entry for, I just want to have the DNS entry in my local network. For me there is no need to access Homey SHS via internet. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [August 14, 2026, 10:20am UTC](https://community.homey.app/t/set-up-custom-domain/158277/2 "2026-08-14T10:20:10Z")
> [@Evan](#): > > - **Edit Custom Domain** in Homey account fails with error message: Do you refer to this part of the [KB article](https://support.homey.app/hc/en-us/articles/24060221985436-Set-up-a-Custom-Domain-for-Homey-Self-Hosted-Server)? ![Screenshot_20260814_121925_Ecosia](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/6/7/674870fd4bbb519c52bf12667108574602f88c8b.jpeg) . This is what Homey Bot replied (it’s pretty accurate): What I understand so far You run Homey Self-Hosted Server (SHS) on your LAN behind a reverse proxy. Public DNS points CUSTOM\_DOMAIN → your public IP and you’ve forwarded 443 → reverse proxy → Homey SHS at http://HOMEY\_IP:4859 with valid HTTPS and WebSockets enabled. You can open https://CUSTOM\_DOMAIN successfully in a browser. But saving the Custom Domain in your Homey account (My Self-Hosted Servers → Edit Custom Domain) fails with “Something went wrong, please try again.” Your end goal is to use a custom domain only inside your LAN (no public DNS), ideally. Key points about Custom Domain validation: When you save a Custom Domain, Homey validates that your SHS is reachable at that domain before it’s saved. If it’s saved, it’s working. The reverse proxy must: Terminate HTTPS on port 443 for your custom domain Forward to http:// :4859 Have WebSocket support enabled Given your checklist, here are focused checks to resolve the save failure: Confirm external reachability exactly as Homey validates Validation expects: HTTPS on port 443 (not another port) A valid TLS certificate matching the custom domain Working WebSockets end-to-end No HTTP auth or IP whitelists that block Homey’s validator Action: Temporarily disable any geo/IP allowlists or basic-auth on your reverse proxy for this host to let the validator reach it. From an external network (e.g., mobile data), open: https://CUSTOM\_DOMAIN Ensure pages load and interactive parts work (to hint that WebSockets are allowed). If you use Cloudflare or similar in front, ensure: “WebSockets” is enabled, SSL mode is Full (strict preferred), No bot/Firewall rules block requests from unknown IPs. Double-check proxy target and headers Target must be http://HOMEY\_IP:4859 (per docs). Avoid proxying to 4860. Ensure upgrade headers are passed for WebSockets: Connection: upgrade Upgrade: websocket X-Forwarded-Proto: https (helps SHS know it is behind HTTPS) Remove forced HSTS/redirect loops during validation. The path “/” should load cleanly over HTTPS. Certificate chain and SNI Use a publicly trusted cert (Let’s Encrypt, etc.) and include full chain. The reverse proxy must present the cert when SNI = CUSTOM\_DOMAIN on port 443. DNS propagation and caching If you recently created/changed the public A record, wait up to an hour and try again. Verify with: nslookup CUSTOM\_DOMAIN 8.8.8.8 → returns your public IP curl -I https://CUSTOM\_DOMAIN from an external host Try the basics once more: Restart reverse proxy and SHS. Re-attempt saving via My Self-Hosted Servers → Edit Custom Domain. About using a LAN-only custom domain: The validator requires the domain to be reachable to save it. A private/LAN-only DNS entry typically won’t pass validation from outside, so the save will fail. If your goal is LAN-only access and you don’t need the app to prefer the domain, you can: Skip the Custom Domain feature and just use your own DNS override internally (e.g., split-horizon DNS) to map CUSTOM\_DOMAIN → HOMEY\_IP, and keep using the standard connection. Or Keep a minimal public A record + 443 reachability only for validation and ongoing app use. Once saved, the Homey app prefers the custom domain across iOS/Android/Web. Removing public reachability later may break that behavior. ## If you want to keep it private only _ **Recommended: Don’t set a Custom Domain in the Homey account** _. Instead, run your reverse proxy and internal DNS to serve CUSTOM\_DOMAIN only on LAN. The Homey app will continue to connect via the default, managed routes (local when at home, cloud relay when away). If you still want the app to prefer your domain, you’ll need to keep the domain publicly reachable at 443 with a valid cert and WebSockets. Two quick questions to pinpoint the blocker: - Do you have any IP allowlists/basic-auth/firewall rules on the reverse proxy for this host? - Can you confirm that https://CUSTOM\_DOMAIN is reachable from outside your network (mobile data) and that WebSockets work? If you can share your reverse proxy product (e.g., Nginx Proxy Manager, Traefik) and any special security rules, I can provide exact header/rule snippets to pass validation. If everything above checks out and it still fails, please capture: - The exact time you attempted to save Your SHS version and reverse proxy brand/version - A redacted screenshot of the error Then visit our support page to create a ticket, and include those details so we can review the validation logs. ---
**Author:** ![Evan](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@Evan](https://community.homey.app/u/Evan)\ **Post date:** [August 14, 2026, 11:09am UTC](https://community.homey.app/t/set-up-custom-domain/158277/3 "2026-08-14T11:09:03Z")
> The validator requires the domain to be reachable to save it. A private/LAN-only DNS entry typically won’t pass validation from outside, so the save will fail. Right, that’s why I setup a public DNS entry at my DNS provider for my domain, not on the pi-hole in my local network. To confirm this: > Confirm external reachability exactly as Homey validates > > - HTTPS on port 443 (not another port) > - A valid TLS certificate matching the custom domain > - Working WebSockets end-to-end > - No HTTP auth or IP whitelists that block Homey’s validator Here are more details about the setup **1. DNS: ClouDNS** - `A` record for `CUSTOM_DOMAIN` , targets the `PUBLIC_IP` address assigned to my home internet connection by my ISP. **2. Router: Unifi Cloud Gateway** - Port forwarding for port `443` to the `REVERSE_PROXY_IP` on port `443` in my local network **3. Reverse proxy: Nginx Proxy Manager** - **Proxy Host** set up for `CUSTOM_DOMAIN` on port `443` to local `HOMEY_SHS_IP` on port `4859`. - The proxy uses a valid matching **SSL certificate** for `CUSTOM_DOMAIN` issued by **Let’s Encrypt**. - **Websocket** support is **enabled.** - **HSTS** is **not enabled**. - No geo/IP allowlists or basic-auth enabled When I open `https://CUSTOM_DOMAIN` on my phone while being on mobile data, not connected to my local WiFi. Homey-SHS opens, I can login with the local user, I can see and edit flows or devices, just everything works as expected. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [August 14, 2026, 11:39am UTC](https://community.homey.app/t/set-up-custom-domain/158277/4 "2026-08-14T11:39:01Z")
OK, here’s the Homey Bot reply: What I understand Public DNS via ClouDNS → PUBLIC\_IP. UniFi Cloud Gateway forwards 443/TCP → Nginx Proxy Manager (NPM) 443. NPM terminates TLS with Let’s Encrypt for CUSTOM\_DOMAIN, WebSockets enabled, no auth/allowlists, HSTS off. NPM proxies to http://HOMEY\_SHS\_IP:4859. From mobile data, https://CUSTOM\_DOMAIN fully works (login, flows, devices). So public reachability, TLS, and WebSockets are good. Yet, My Self-Hosted Servers → Edit Custom Domain fails with “Something went wrong, please try again.” Given your setup meets all documented requirements, the failure likely isn’t due to reachability. The most common remaining causes are subtle proxy header issues, SNI/cert chain presentation, or a transient validation error on save. Targeted actions to resolve: Ensure upstream protocol awareness In Nginx Proxy Manager, enable “Block Common Exploits” off for a quick test (if on), and add the following advanced config for this host to make sure SHS knows it’s behind HTTPS: Under Proxy Host → Advanced: proxy\_set\_header X-Forwarded-Proto https; proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; proxy\_set\_header Host $host; proxy\_http\_version 1.1; proxy\_set\_header Upgrade $http\_upgrade; proxy\_set\_header Connection “upgrade”; Save and test again in the Homey account. Verify full certificate chain and SNI In NPM SSL settings for this host, ensure the Let’s Encrypt cert includes the full chain (NPM typically handles this, but if you manually uploaded, re-issue via Let’s Encrypt within NPM). Confirm the certificate’s CN/SAN exactly matches CUSTOM\_DOMAIN and is presented when SNI=CUSTOM\_DOMAIN on port 443. Quick check from an external machine: curl -Iv https://CUSTOM\_DOMAIN You should see the correct cert chain and an HTTP/2 or HTTP/1.1 200/302 from SHS via NPM. Temporarily bypass HTTP/2 Some validators are picky with HTTP/2 + upgrade. In NPM Advanced for this host, try disabling HTTP/2 for the test: add: proxy\_set\_header Connection “upgrade”; and in the SSL tab, temporarily uncheck “HTTP/2 Support” (if available in your NPM version). Retry saving the custom domain. Confirm proxy target is HTTP on 4859 (not HTTPS) Keep target as http://HOMEY\_SHS\_IP:4859 exactly (as per docs). Don’t proxy to 4860. Retry after a clean restart Restart NPM container/service and try saving again. Then restart Homey SHS and retry saving once more, in case the validator hit a stale state. If it still fails: Please capture: Exact timestamp (UTC) of your last “Save Custom Domain” attempt. Your CUSTOM\_DOMAIN (you can DM or redact here if needed for privacy). NPM version and a screenshot of the host’s SSL and Advanced tabs (redact public IP if you like). Then create a ticket at our support page so we can check the validator logs on our side. Mention that external reachability, TLS, WebSockets, and reverse proxy checks all pass, but account UI still returns “Something went wrong.” About LAN-only goal: Today, saving a custom domain requires external validation. If you prefer LAN-only, you can skip setting the Custom Domain in the account and continue using split-horizon/internal DNS and your NPM setup just for local access. The Homey apps will keep preferring local connections at home and cloud relay when away. Would you like me to draft the exact NPM Advanced config block for copy/paste, or help you file the ticket with the right details? ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [August 14, 2026, 12:39pm UTC](https://community.homey.app/t/set-up-custom-domain/158277/5 "2026-08-14T12:39:12Z")
> [@Evan](#): > > For me there is no need to access Homey SHS via internet. Note that the Homey mobile app will _always_ use the proxy connection when you’re away from home (unless you use a VPN to access your home network). I would recommend using the built in secure remote access, but if you choose to use port forwarding, make sure to block it to specific IP ranges as 443 is a widely targeted port by IP scanners. ---
**Author:** ![Evan](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@Evan](https://community.homey.app/u/Evan)\ **Post date:** [August 14, 2026, 2:02pm UTC](https://community.homey.app/t/set-up-custom-domain/158277/6 "2026-08-14T14:02:14Z")
> [@Peter\_Kawa](#): > > Verify full certificate chain and SNI This helped me, the certificate was working in Nginx Proxy Manager, but the full chain could not be verified. Just updated the certificate there and now it works.