

I’m a big fan of mutual TLS, which I just do in nginx reverse proxy.
Client certs get installed on trusted devices and then it’s mostly seamless.
Not every app will support it, but I use Firefox as a fallback for stuff that doesn’t, or my VPN.
TBH, I’m just happy homeassistant supports it as that’s the one thing I’d rather be as seamless as possible.
Other things I don’t mind having to connect a VPN for, like jellyfin, which I don’t currently share with others.
For nextcloud I’m currently not running mTLS as it wasn’t supported back then and I had to share some links with some people where I wouldn’t deal with certs. I think mTLS support has been merged since, so if you just use it for devices under your control, or might be viable









Home assistant also supports mTLS.
home assistant is something you’d likely ever want to allow from a handful of trusted devices, so deploying a client certificate on them can make sense.
This way a non-onboarded device doesn’t even get to the html part, it’s denied upstream by a reverse proxy before HA is involved.