{
  "port": 8123,
  "protocol": "tcp",
  "service": "Home Assistant (or ClickHouse HTTP)",
  "oneLiner": "Home Assistant's web UI and REST API — or, on a database host, the ClickHouse HTTP interface.",
  "whatItIs": "Home Assistant serves its frontend, REST API, and WebSocket API over HTTP on 8123 by default; container and Core installs still use it, while Home Assistant OS moved its default to port 80 in the 2026.8 release. It shows up on scans of home LANs from a Raspberry Pi, NUC, or NAS running HA. Unrelated but common in server fleets: clickhouse-server listens on 8123 for its HTTP interface, and a bare GET / there returns the string \"Ok.\".",
  "exposure": {
    "verdict": "careful",
    "note": "Home Assistant has real user authentication but ships plain HTTP by default and controls locks and cameras — put it behind a reverse proxy with TLS or a VPN rather than forwarding 8123."
  },
  "checkCommand": "curl -s -m 3 -o /dev/null -w '%{http_code} %{content_type}\\n' http://TARGET:8123/",
  "links": [
    {
      "title": "Home Assistant — HTTP integration (server_port, default 8123)",
      "url": "https://www.home-assistant.io/integrations/http/",
      "kind": "official-docs"
    },
    {
      "title": "Home Assistant — REST API developer documentation",
      "url": "https://developers.home-assistant.io/docs/api/rest/",
      "kind": "official-docs"
    },
    {
      "title": "home-assistant/core",
      "url": "https://github.com/home-assistant/core",
      "kind": "github"
    },
    {
      "title": "ClickHouse — HTTP interface (port 8123)",
      "url": "https://clickhouse.com/docs/interfaces/http",
      "kind": "official-docs"
    }
  ]
}