Infrastructure designer: your apps and home network on one canvas

The infrastructure designer is a page in the blitz.cloud dashboard that draws everything in your account on one canvas: apps, databases, addresses, private networks and the devices on them. You connect two things by drawing a line between them. That's how Home Assistant on blitz.cloud reaches the Hue Bridge in your living room, and how your NAS at home gets an address like nas.lena.blitz.cloud that only opens on your own devices. Nothing gets opened on your router, so it works behind carrier-grade NAT and DS-Lite too.

What a line on the canvas does

Every line is a real connection, made the same way as on the other pages of the dashboard. Delete the line and the connection goes, after one sentence telling you what stops working.

Link two apps

Draw a line from one app to another and give the link a name, for example api. The first app then gets the other's internal address as a setting, API_URL, and can call it without a detour through the internet. While the first app is awake, the one it links to stays awake as well, so a call never lands on a sleeping app.

Connect a database

A line from an app to a database connects them, just like on the Databases page. The app gets DATABASE_URL and the other connection settings.

Reach a device at home

Draw a line from Home Assistant, or any other app, to a device on your home network and give it a name such as hue-bridge. The app now reaches the device under that name, over TCP and UDP, on the ports you choose. Only the apps you drew a line from can reach it. Your other apps can't, and nobody on the internet can.

Give a home device an address

A NAS, a camera or the box Home Assistant runs on at home can get an address like nas.lena.blitz.cloud, with HTTPS. It is private by default: it opens on your phone and laptop when they're on your private network, and nowhere else. If you want to open it from any browser, switch it to public. A sign-in page then comes first, and only you and the email addresses you add get past it. You can switch that page off, after a warning about what it means.

How your home network joins

The designer works with the private networks you can already connect on blitz.cloud: your Tailscale tailnet, a WireGuard network you run yourself, for example on a FRITZ!Box, or the WireGuard network blitz.cloud hosts for you. See private networks for how to connect each one.

Behind carrier-grade NAT or DS-Lite your router can't take connections from outside, so most remote access setups fail there. The hosted network turns this around: a small Linux machine in your home, like a Raspberry Pi or the server Home Assistant used to run on, connects out to blitz.cloud and carries your home range, for example 192.168.178.0/24. You don't open or forward a port anywhere.

Devices show up by themselves

Phones, laptops and other devices on your private network appear on the canvas as soon as they're connected. Devices on your home network, like a printer or a smart plug, show up when you click "Scan my network". The scan looks at your home range for the ports such devices use (web interfaces, NAS, cameras, Home Assistant, MQTT, Sonos, Plex, printers) and reads the title of each web page it finds. It never runs on a schedule or by itself. You can also add a device by hand with its address.

One thing to know about Home Assistant

Home Assistant usually finds devices on its own through broadcasts on the local network. Those don't travel through a tunnel, so on blitz.cloud nothing pops up by itself. You add the integration and type the name you gave the device, hue-bridge, where it asks for a host. Connect Home Assistant to devices at home has every step.

What stays closed

• A device is only reachable from the apps you connected it to, never from other apps, other accounts or the internet.
• Connections from blitz.cloud go only to the devices you forwarded or gave an address, not to the rest of your network.
• A device address is private until you switch it to public, and a public one asks for a sign-in first.
• The network scan runs only when you click the button.

What it costs

The canvas and links between apps come with every plan, the free one included. The free plan has 3 device forwards and 1 device address. Pro has as many as you need, for 7 EUR a month for your whole account. See pricing for the rest.

Questions

How do I reach Home Assistant from outside my home without port forwarding?

Give the Home Assistant box at home an address in the designer. As a private address it opens on your phone and laptop through your private network, with nothing opened on your router. Made public, it opens in any browser after the sign-in page. Or run Home Assistant on blitz.cloud itself and let it reach your devices at home through forwards.

Does it work behind CGNAT or DS-Lite?

Yes, with the hosted WireGuard network or Tailscale. In both, the machine at home connects out, which works on any connection that can browse the web. A WireGuard config from your own router only works when that router can be reached from the internet, which CGNAT and DS-Lite prevent.

Can Home Assistant on blitz.cloud find my devices automatically?

No. Discovery uses broadcasts (mDNS and similar) that stay inside your home network. Add the integration by hand and enter the device's forward name as the host. "Scan my network" helps you find the device's address first.

Which devices can an app reach?

Anything on your home network that talks TCP or UDP on a fixed port: a Hue Bridge, Shelly plugs, ESPHome boards, an MQTT broker, a NAS, an IP camera's video stream, a printer. Protocols that depend on broadcasts across the network don't work through a forward.

Is my home network open to the internet then?

No. Your router stays closed. Apps reach only the devices you forwarded to them, and a device address only opens to everyone if you make it public, and then behind a sign-in page unless you switch that off.

Do I need Pro for this?

No. The canvas and app links are free, and the free plan includes 3 device forwards and 1 device address. Pro removes those limits.