Home Assistant from the metal up

Sat, 10 Oct 2026 00:00:00 +0000

People on IRC keep asking me how my Home Assistant is set up, and someone always wants to copy it. So here’s all of it, starting from the hardware.

The order is deliberate. Automations are the visible part, but they sit on a box that can die, a disk that can be stolen and a VM that can corrupt itself during a backup. If those layers are wrong, it doesn’t matter how good the automations are.

The box: one Raspberry Pi 5, encrypted¶

Everything runs on nowhere, a Raspberry Pi 5 with a 1 TB NVMe drive. There’s no rack and no Proxmox cluster. It’s one Pi, and it also runs the DNS resolver, the internal certificate authority, the metrics and logs stack, the WiFi presence service, the UPS server, and the Claude Code session that’s helping me write this post.

The root filesystem is LUKS-encrypted. The firmware loads an initramfs that asks for the passphrase. Since the Pi has no keyboard attached, the initramfs also runs dropbear, so I can SSH in and unlock it remotely after a power cut. I wrote up the setup step by step in Raspberry PI 5 encrypted root with LUKS.

nvme0n1          953.9G
├─nvme0n1p1      512M   vfat         /boot/firmware
└─nvme0n1p2      953.4G crypto_LUKS
  └─cryptroot    953.3G ext4         /

This matters for Home Assistant because HAOS has no full-disk encryption option. HA’s database holds a complete history of who was home and when, when the alarm was armed and every door event. On bare-metal HAOS, anyone who walks off with the SSD walks off with all of that. Inside a LUKS volume it’s just more ciphertext.

Kvm on Marcello Barnaba

Home Assistant from the metal up

The box: one Raspberry Pi 5, encrypted¶