N° 01 / 08 — Smart home · IoT
SphereHome
Your smart home, finally yours: everything runs from one place, with no cloud, even when the internet goes down.
- Role
- Design and development
- Year
- 2025
- Status
- In progressProfessional
- Stack
- Python · FastAPI · React Native · Next.js · Home Assistant · Zigbee
- Links
- Website ↗
01 / 07
The problem
Most smart home products rely on a manufacturer's cloud. If the service stops or the internet goes down, the house stops responding, and its data leaves the home.
I wanted a connected home that stays entirely at home while remaining simple to use, for a family, a rental or several properties.
02 / 07
What I did
I designed a fully local platform: several homes, several users, fine-grained permissions and time-limited access.
It drives devices over Zigbee, MQTT, Matter and Thread, handles RTSP streams and talks to local APIs. The interface shows the home in 3D and brings every device together. I also built the mobile app and the website.
03 / 07
How it's built
Inside the home, Home Assistant talks to the devices, extended by custom-built Sphere integrations: authentication, per-home permissions, 3D models of the home. Around it, Python / FastAPI services on PostgreSQL handle accounts, homes and subscriptions.
Remote access goes through an SNI tunnel, behind a Traefik reverse proxy: the home stays reachable from outside without depending on a third-party cloud. Everything is containerised with Docker and deployed to Docker Swarm by GitLab CI.
- Devices (Zigbee, MQTT, Matter)
- Home Assistant and Sphere integrations
- FastAPI services
- SNI tunnel and Traefik
- App and 3D view
04 / 07
Challenges
- 01
Secure access, even without internet
Each resident gets a signed token (JWT, RS256) carrying their permissions, home by home, with their time windows. The hub verifies it itself, with public keys kept locally: when the internet goes down nobody loses access, and no check depends on an outside server. Permissions are enforced all the way into the WebSocket connection.
- 02
Reachable from outside, with no open port
The hub itself opens an SNI tunnel to a relay server. That relay, behind a Traefik reverse proxy, routes each connection to the right home from the requested name (SNI), without decrypting it: the home's certificate stays in the home.
- 03
Certificates with no third party
Each home obtains and renews its own Let's Encrypt certificates through the ACME HTTP-01 challenge, served by a small dedicated FastAPI server. End-to-end HTTPS, without trusting a cloud with anything.
- 04
Infrastructure that deploys itself
The services run as Docker containers on Docker Swarm. GitLab CI builds the images, pushes them to a private registry and updates the stack: rolling deployment, with automatic rollback to the previous version on failure.
- 05
Getting every protocol to talk
Zigbee, MQTT, Matter, Thread, RTSP cameras: each has its own rules. The Home Assistant integrations written for Sphere bring them together behind one interface, so users never see the complexity.
05 / 07
Results
The home can be controlled even without internet, with no data collection or tracking.
Sphere is in pre-launch: the website presents the offer to individuals and to professionals managing several sites.
06 / 07
What I learned
Promising local-first means rethinking everything: authentication, remote access and certificates can no longer lean on a third-party service.
It is also a lesson in humility with IoT protocols: each has its own rules, and the user must never see them.
07 / 07
Tech stack
- Front end
- Next.jsTypeScriptTailwind CSSInternationalisation (i18n)
- 3D, motion and real time
- WebSocketReact Three FiberThree.js
- Back end and APIs
- PythonFastAPIStripe
- Data
- PostgreSQLSQLAlchemyAlembic (migrations)
- Mobile
- React NativeExpo
- IoT and embedded
- Home AssistantZigbeeMQTTMatterThreadRTSP (cameras)
- DevOps, cloud and testing
- DockerDocker SwarmGitLab CI/CDGitPytest
- Security and networking
- JWTAuth0 (OAuth 2)Access controlSecure offline accessSNI tunnelReverse proxy (Traefik)TLS and Let's Encrypt (ACME)
- Product, SEO and methods
- SEOPostHog (analytics)Jira
Next project · 02 / 08
LiveRadar
LiveRadar
