# Bamboo

Bamboo connects your home network to a Blacktip edge over WireGuard. Websites and ports you open in Hammerhead can then reach Home Assistant, and any other device at home, without opening a port on your router. Bamboo only makes outbound connections.

## Set up

1. In Hammerhead, open **Sites**, choose **Add site**, and copy the site's token with **Show command**.
2. Install this add-on and open its **Configuration** tab.
3. Enter the **Hammerhead address** (for example `https://hammerhead.example.com`) and the **Site token**, then save.
4. Start the add-on. The site shows as online in Hammerhead within a few seconds, and the add-on's log says `WireGuard up`.

## Reach Home Assistant from the internet

Add a resource in Hammerhead:

* **What are you sharing:** Website
* **Where does it point:** this site, host `127.0.0.1`, port `8123`
* **How do people reach it:** your hostname, for example `home.example.com`

Home Assistant refuses requests that come through a proxy unless it trusts the proxy. Bamboo connects from the same machine, so add this to `configuration.yaml` and restart Home Assistant:

```yaml
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - ::1
```

Without it, the page fails with "400: Bad Request". Home Assistant has its own sign-in, so you can leave the resource without a login in Hammerhead, or put one in front for a second layer.

## Reach other devices at home

The add-on uses host networking, so a resource can also point at any address on your network, such as a camera at `192.168.1.40`. Pick this site as the target and enter that address and port.

## SSH server (optional)

Turn on **SSH server** and list at least one key under **SSH public keys** (the line from your `id_ed25519.pub`, for example). Bamboo then runs an SSH server on `127.0.0.1:2222` inside the add-on. In Hammerhead, add a TCP port whose target is this site, host `127.0.0.1`, port `2222`, and connect with `ssh -p <port> anyname@<your edge address>`. The user name you give is ignored.

This is a shell **inside the add-on's container**, as root: you can look around the add-on's own files and `/data`, and reach your network from it, but it is not the Home Assistant operating system or its terminal. Only the listed keys can sign in, with no passwords, and there is no port forwarding or SFTP. The server's host key is kept in `/data`, so it stays the same across restarts, and its fingerprint is in the add-on's log. Changes to the key list apply when the add-on is restarted.

## Suggest services (optional)

Turn on **Suggest services** and Bamboo reports the services listening on Home Assistant's machine to Hammerhead, so you can pick one as a target instead of typing its address. Fill in **Scan subnets** (for example `192.168.1.0/24`) and it also looks for services on those networks, trying the ports in **Scan ports** or a short list of common ones. It is gentle, with a rate limit (**Scan speed**, 50 connection attempts per second by default) and a sweep every 15 minutes, and only private networks are accepted. Nothing is exposed until you pick a target. Only scan networks you are allowed to scan.

## Updates

The add-on version is the Bamboo release it installs. Update it from the add-on's page when a new version appears. Bamboo's own auto-update is not used here, because a new version arrives as an add-on update instead. Your WireGuard key and settings are kept across updates.

## Troubleshooting

* **The log asks for configuration:** the address or token is empty.
* **The site stays offline:** check that the address opens in a browser from the same network, and that the token belongs to a site, not an edge.
* **Home Assistant shows "400: Bad Request":** add the `http:` block above.