How to best exclude apps such as home assistant from being challenged

[maxdd]

Hello,
I'm running the stock policies behind nginx proxy manager plus. I'm exposing my home assistant service which is accessible via its domain name and when I use a browser such as Chrome or Firefox I can see Anubis doing its work (as well as in the logs).
The issue is that unfortunately the companion app of Home Assistant is a web-view with a user-agent which includes "Home Assistant" text but also Chrome and Firefox and hence issuing the challenge, here is the log

2025-12-31T15:09:24.751329697Z INFO source={"function":"github.com/TecharoHQ/anubis/lib.(*Server).issueChallenge","file":"github.com/TecharoHQ/anubis/lib/anubis.go","line":137} msg=new challenge issued subsystem=anubis host=xxx method=GET path=/api/websocket user_agent=Mozilla/5.0 (Linux; Android 14; KB2003 Build/UKQ1.230924.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/143.0.7499.115 Mobile Safari/537.36 Home Assistant/2025.11.4-19134 (Android 14; KB2003) accept_language=it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7 priority= x-forwarded-for=xxx x-real-ip=xxx challenge=019b74f4-e38f-74aa-bb54-54665b698015

What would be the best solution (both technically and secure) to avoid the challenge here? Is the test on the user agent the solution? Isn't that fragile?

[Albirew]

you can "whitelist" useragent containing "Home Assistant/" in botPolicy.json, like this (not tested):

    {
      "name": "HAss",
      "user_agent_regex": "Home Assistant/",
      "action": "ALLOW"
    },

Also, i really wanna try to set Anubis on my HAss, but everytime i tried, i got an Anubis error (may be related to wss?).
Can you share your front webserver config related to Anubis/HAss?

[maxdd]

Hi, that's what I was thinking but it feels like a little bit too weak as a mechanism given that any bot could fake it.
Anyway I'm using ZoeyVid/NPMplus which has Anubis integration

[Xe]

I don't really have a better suggestion other than allowlisting your IP address or using split horizon DNS such that your home assistant pierces anubis at the routing level.