The house never opened a port

Home Assistant runs on a Raspberry Pi in the hallway closet. The router has no port forwarded, no dynamic DNS, no VPN. The Pi runs one more process: the tunnel client, one WebSocket out to a container on your Hoody server.

Two bindings ride that session. EXPOSE 8123 gives the house an HTTPS URL, the container's own, certificate already managed, login gate set in proxy permissions. PULL 8123 puts the same port on the container's loopback, where the sunset cron and the agent that answers "did I leave the garage open" call it. The Pi dialed out, so nothing dials in.

When the power flickers and the Pi reboots, the session resumes and both bindings come back. The brain lives on a flat-rate box; the house is a client.

The house never opened a port; it made a phone call.