diff --git a/SCRIPT-VARIANTS.md b/SCRIPT-VARIANTS.md
index 0032911..955b7f8 100644
--- a/SCRIPT-VARIANTS.md
+++ b/SCRIPT-VARIANTS.md
@@ -12,6 +12,13 @@ complete, standalone script).
 
 `<ver>` is `24.04` or `26.04`.
 
+> New services are added to the **`-crowdsec`** tier only (the current tip of
+> the evolution); the original and `-no-keycloak` scripts are frozen as
+> historical snapshots. For example, **Home Assistant** (home-automation hub,
+> port 8123) is available in the `-crowdsec` variants. It ships with a
+> `trusted_proxies` config pre-seeded so it works behind the Caddy reverse
+> proxy out of the box.
+
 ## Which one?
 
 - **Original (`.sh`)** — unchanged baseline, kept for fallback. Still offers
diff --git a/ubuntu-post-install-24.04-crowdsec.sh b/ubuntu-post-install-24.04-crowdsec.sh
index d235992..656028f 100644
--- a/ubuntu-post-install-24.04-crowdsec.sh
+++ b/ubuntu-post-install-24.04-crowdsec.sh
@@ -2595,6 +2595,7 @@ else
         [ -d "$DOCKER_DIR/caddy" ] && EXISTING_SERVICES[CADDY]="ON"
         [ -d "$DOCKER_DIR/lms" ] && EXISTING_SERVICES[LYRION]="ON"
         [ -d "$DOCKER_DIR/mealie" ] && EXISTING_SERVICES[MEALIE]="ON"
+        [ -d "$DOCKER_DIR/homeassistant" ] && EXISTING_SERVICES[HOMEASSISTANT]="ON"
         [ -d "$DOCKER_DIR/minecraft" ] && EXISTING_SERVICES[MINECRAFT]="ON"
         [ -d "$DOCKER_DIR/jellyfin" ] && EXISTING_SERVICES[JELLYFIN]="ON"
         [ -d "$DOCKER_DIR/frigate" ] && EXISTING_SERVICES[FRIGATE]="ON"
@@ -2636,6 +2637,7 @@ else
                     "CROWDSEC" "Intrusion prevention (CrowdSec: bans + geo + reputation)" ${EXISTING_SERVICES[CROWDSEC]:-OFF} \
                     "LYRION" "Music streaming server (LMS)" ${EXISTING_SERVICES[LYRION]:-OFF} \
                     "MEALIE" "Recipe manager & meal planner" ${EXISTING_SERVICES[MEALIE]:-OFF} \
+                    "HOMEASSISTANT" "Home automation hub (Home Assistant)" ${EXISTING_SERVICES[HOMEASSISTANT]:-OFF} \
                     "MINECRAFT" "Minecraft game server" ${EXISTING_SERVICES[MINECRAFT]:-OFF} \
                     "JELLYFIN" "Free media server (Emby alternative)" ${EXISTING_SERVICES[JELLYFIN]:-OFF} \
                     "FRIGATE" "AI-powered NVR for security cameras" ${EXISTING_SERVICES[FRIGATE]:-OFF} \
@@ -2667,6 +2669,7 @@ else
                 [ -n "${EXISTING_SERVICES[CROWDSEC]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS CROWDSEC \"Intrusion prevention\" ON"
                 [ -n "${EXISTING_SERVICES[LYRION]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS LYRION \"Music server\" ON"
                 [ -n "${EXISTING_SERVICES[MEALIE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MEALIE \"Recipe manager\" ON"
+                [ -n "${EXISTING_SERVICES[HOMEASSISTANT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS HOMEASSISTANT \"Home automation\" ON"
                 [ -n "${EXISTING_SERVICES[MINECRAFT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MINECRAFT \"Game server\" ON"
                 [ -n "${EXISTING_SERVICES[JELLYFIN]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS JELLYFIN \"Media server\" ON"
                 [ -n "${EXISTING_SERVICES[FRIGATE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS FRIGATE \"NVR cameras\" ON"
@@ -2717,6 +2720,7 @@ else
         : ${INSTALL_CROWDSEC:="n"}
         : ${INSTALL_LMS:="n"}
         : ${INSTALL_MEALIE:="n"}
+        : ${INSTALL_HOMEASSISTANT:="n"}
         : ${INSTALL_MINECRAFT:="n"}
         : ${INSTALL_JELLYFIN:="n"}
         : ${INSTALL_FRIGATE:="n"}
@@ -2743,6 +2747,7 @@ else
         if echo "$SELECTED_SERVICES" | grep -q "CROWDSEC"; then INSTALL_CROWDSEC="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then INSTALL_LMS="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then INSTALL_MEALIE="y"; fi
+        if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then INSTALL_HOMEASSISTANT="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then INSTALL_MINECRAFT="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then INSTALL_JELLYFIN="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then INSTALL_FRIGATE="y"; fi
@@ -2815,6 +2820,7 @@ else
                 if echo "$SELECTED_SERVICES" | grep -q "CADDY"; then uninstall_service "Caddy" "$DOCKER_DIR/caddy" "caddy"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then uninstall_service "Lyrion" "$DOCKER_DIR/lms" "lms"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then uninstall_service "Mealie" "$DOCKER_DIR/mealie" "mealie"; fi
+                if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then uninstall_service "Home Assistant" "$DOCKER_DIR/homeassistant" "homeassistant"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then uninstall_service "Minecraft" "$DOCKER_DIR/minecraft" "minecraft"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then uninstall_service "Jellyfin" "$DOCKER_DIR/jellyfin" "jellyfin"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then uninstall_service "Frigate" "$DOCKER_DIR/frigate" "frigate"; fi
@@ -4946,6 +4952,90 @@ MEALIE_COMPOSE
         fi
     fi
 
+    # ---- HOME ASSISTANT ----
+    if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_HOMEASSISTANT" ]; then
+        echo ""
+        echo "┌─────────────────────────────────────────────────────────────────┐"
+        echo "│ HOME ASSISTANT - Open-source home automation hub                │"
+        echo "│ Smart-home control, automations, dashboards.                    │"
+        echo "│ Port: 8123                                                      │"
+        echo "└─────────────────────────────────────────────────────────────────┘"
+        prompt_yn "Install Home Assistant? (y/n):" "n" INSTALL_HOMEASSISTANT
+    fi
+
+    if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
+        echo "Installing Home Assistant..."
+        HOMEASSISTANT_DIR="$DOCKER_DIR/homeassistant"
+
+        if [ "$DRY_RUN" = true ]; then
+            echo "[DRY-RUN] Would create $HOMEASSISTANT_DIR"
+        else
+            mkdir -p "$HOMEASSISTANT_DIR"
+            ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
+            cd "$HOMEASSISTANT_DIR"
+
+            cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
+name: homeassistant
+
+services:
+  homeassistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    container_name: homeassistant
+    hostname: homeassistant
+    restart: unless-stopped
+    privileged: true
+    environment:
+      - TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
+    volumes:
+      - ./config:/config
+      - /run/dbus:/run/dbus:ro
+    ports:
+      - "8123:8123"
+    # For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
+    # remove the 'ports:' block above and add:  network_mode: host
+HOMEASSISTANT_COMPOSE
+
+            mkdir -p config
+
+            # Pre-seed trusted_proxies so HA works behind the Caddy reverse proxy.
+            # Only written on a fresh install (never clobber an existing config).
+            if [ ! -f config/configuration.yaml ]; then
+                cat > config/configuration.yaml << 'HA_CONFIG'
+# Loads default set of integrations. Do not remove.
+default_config:
+
+# Allow access through a reverse proxy (e.g. Caddy)
+http:
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 10.0.0.0/8
+    - 127.0.0.1
+    - ::1
+HA_CONFIG
+            fi
+
+            chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HOMEASSISTANT_DIR"
+
+            echo ""
+            echo "✓ Home Assistant configured at $HOMEASSISTANT_DIR"
+
+            # Configure Caddy reverse proxy before starting
+            configure_caddy_for_service "Home Assistant" "8123" "home"
+
+            prompt_yn "Start Home Assistant now? (y/n):" "y" START_HOMEASSISTANT
+            if [ "$START_HOMEASSISTANT" = "y" ] || [ "$START_HOMEASSISTANT" = "Y" ]; then
+                docker compose up -d 2>/dev/null && echo "  ✓ Home Assistant started" || echo "  ⚠ Failed to start"
+            fi
+
+            echo "  Access at:  http://localhost:8123"
+            echo "  First run:  open the URL and create your admin account (onboarding)."
+            echo "  Note:       first startup can take a minute while HA initializes."
+            echo ""
+        fi
+    fi
+
     # ---- MINECRAFT SERVER ----
     if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_MINECRAFT" ]; then
         echo ""
@@ -5463,6 +5553,11 @@ CADDY_ENV
 #     reverse_proxy mealie:9000
 # }
 
+# Home Assistant (home)
+# home.{$MY_DOMAIN} {
+#     reverse_proxy homeassistant:8123
+# }
+
 # ntfy (notifications)
 # ntfy.{$MY_DOMAIN} {
 #     reverse_proxy ntfy:80
@@ -7144,6 +7239,10 @@ if [ "$CONFIGURE_UFW" = "y" ] || [ "$CONFIGURE_UFW" = "Y" ]; then
                         ufw allow 9925/tcp comment 'Mealie' 2>/dev/null
                         echo "  ✓ Allowed Mealie (9925)"
                     fi
+                    if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
+                        ufw allow 8123/tcp comment 'Home Assistant' 2>/dev/null
+                        echo "  ✓ Allowed Home Assistant (8123)"
+                    fi
                     if [ "$INSTALL_MAGICMIRROR" = "y" ] || [ "$INSTALL_MAGICMIRROR" = "Y" ]; then
                         ufw allow 8081:8083/tcp comment 'MagicMirror' 2>/dev/null
                         echo "  ✓ Allowed MagicMirror (8081-8083)"
diff --git a/ubuntu-post-install-26.04-crowdsec.sh b/ubuntu-post-install-26.04-crowdsec.sh
index 44c971a..c99443c 100644
--- a/ubuntu-post-install-26.04-crowdsec.sh
+++ b/ubuntu-post-install-26.04-crowdsec.sh
@@ -2595,6 +2595,7 @@ else
         [ -d "$DOCKER_DIR/caddy" ] && EXISTING_SERVICES[CADDY]="ON"
         [ -d "$DOCKER_DIR/lms" ] && EXISTING_SERVICES[LYRION]="ON"
         [ -d "$DOCKER_DIR/mealie" ] && EXISTING_SERVICES[MEALIE]="ON"
+        [ -d "$DOCKER_DIR/homeassistant" ] && EXISTING_SERVICES[HOMEASSISTANT]="ON"
         [ -d "$DOCKER_DIR/minecraft" ] && EXISTING_SERVICES[MINECRAFT]="ON"
         [ -d "$DOCKER_DIR/jellyfin" ] && EXISTING_SERVICES[JELLYFIN]="ON"
         [ -d "$DOCKER_DIR/frigate" ] && EXISTING_SERVICES[FRIGATE]="ON"
@@ -2636,6 +2637,7 @@ else
                     "CROWDSEC" "Intrusion prevention (CrowdSec: bans + geo + reputation)" ${EXISTING_SERVICES[CROWDSEC]:-OFF} \
                     "LYRION" "Music streaming server (LMS)" ${EXISTING_SERVICES[LYRION]:-OFF} \
                     "MEALIE" "Recipe manager & meal planner" ${EXISTING_SERVICES[MEALIE]:-OFF} \
+                    "HOMEASSISTANT" "Home automation hub (Home Assistant)" ${EXISTING_SERVICES[HOMEASSISTANT]:-OFF} \
                     "MINECRAFT" "Minecraft game server" ${EXISTING_SERVICES[MINECRAFT]:-OFF} \
                     "JELLYFIN" "Free media server (Emby alternative)" ${EXISTING_SERVICES[JELLYFIN]:-OFF} \
                     "FRIGATE" "AI-powered NVR for security cameras" ${EXISTING_SERVICES[FRIGATE]:-OFF} \
@@ -2667,6 +2669,7 @@ else
                 [ -n "${EXISTING_SERVICES[CROWDSEC]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS CROWDSEC \"Intrusion prevention\" ON"
                 [ -n "${EXISTING_SERVICES[LYRION]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS LYRION \"Music server\" ON"
                 [ -n "${EXISTING_SERVICES[MEALIE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MEALIE \"Recipe manager\" ON"
+                [ -n "${EXISTING_SERVICES[HOMEASSISTANT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS HOMEASSISTANT \"Home automation\" ON"
                 [ -n "${EXISTING_SERVICES[MINECRAFT]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS MINECRAFT \"Game server\" ON"
                 [ -n "${EXISTING_SERVICES[JELLYFIN]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS JELLYFIN \"Media server\" ON"
                 [ -n "${EXISTING_SERVICES[FRIGATE]}" ] && UNINSTALL_OPTIONS="$UNINSTALL_OPTIONS FRIGATE \"NVR cameras\" ON"
@@ -2717,6 +2720,7 @@ else
         : ${INSTALL_CROWDSEC:="n"}
         : ${INSTALL_LMS:="n"}
         : ${INSTALL_MEALIE:="n"}
+        : ${INSTALL_HOMEASSISTANT:="n"}
         : ${INSTALL_MINECRAFT:="n"}
         : ${INSTALL_JELLYFIN:="n"}
         : ${INSTALL_FRIGATE:="n"}
@@ -2743,6 +2747,7 @@ else
         if echo "$SELECTED_SERVICES" | grep -q "CROWDSEC"; then INSTALL_CROWDSEC="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then INSTALL_LMS="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then INSTALL_MEALIE="y"; fi
+        if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then INSTALL_HOMEASSISTANT="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then INSTALL_MINECRAFT="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then INSTALL_JELLYFIN="y"; fi
         if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then INSTALL_FRIGATE="y"; fi
@@ -2815,6 +2820,7 @@ else
                 if echo "$SELECTED_SERVICES" | grep -q "CADDY"; then uninstall_service "Caddy" "$DOCKER_DIR/caddy" "caddy"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "LYRION"; then uninstall_service "Lyrion" "$DOCKER_DIR/lms" "lms"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "MEALIE"; then uninstall_service "Mealie" "$DOCKER_DIR/mealie" "mealie"; fi
+                if echo "$SELECTED_SERVICES" | grep -q "HOMEASSISTANT"; then uninstall_service "Home Assistant" "$DOCKER_DIR/homeassistant" "homeassistant"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "MINECRAFT"; then uninstall_service "Minecraft" "$DOCKER_DIR/minecraft" "minecraft"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "JELLYFIN"; then uninstall_service "Jellyfin" "$DOCKER_DIR/jellyfin" "jellyfin"; fi
                 if echo "$SELECTED_SERVICES" | grep -q "FRIGATE\""; then uninstall_service "Frigate" "$DOCKER_DIR/frigate" "frigate"; fi
@@ -4926,6 +4932,90 @@ MEALIE_COMPOSE
         fi
     fi
 
+    # ---- HOME ASSISTANT ----
+    if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_HOMEASSISTANT" ]; then
+        echo ""
+        echo "┌─────────────────────────────────────────────────────────────────┐"
+        echo "│ HOME ASSISTANT - Open-source home automation hub                │"
+        echo "│ Smart-home control, automations, dashboards.                    │"
+        echo "│ Port: 8123                                                      │"
+        echo "└─────────────────────────────────────────────────────────────────┘"
+        prompt_yn "Install Home Assistant? (y/n):" "n" INSTALL_HOMEASSISTANT
+    fi
+
+    if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
+        echo "Installing Home Assistant..."
+        HOMEASSISTANT_DIR="$DOCKER_DIR/homeassistant"
+
+        if [ "$DRY_RUN" = true ]; then
+            echo "[DRY-RUN] Would create $HOMEASSISTANT_DIR"
+        else
+            mkdir -p "$HOMEASSISTANT_DIR"
+            ensure_docker_dir_ownership "$HOMEASSISTANT_DIR"
+            cd "$HOMEASSISTANT_DIR"
+
+            cat > docker-compose.yml << HOMEASSISTANT_COMPOSE
+name: homeassistant
+
+services:
+  homeassistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    container_name: homeassistant
+    hostname: homeassistant
+    restart: unless-stopped
+    privileged: true
+    environment:
+      - TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
+    volumes:
+      - ./config:/config
+      - /run/dbus:/run/dbus:ro
+    ports:
+      - "8123:8123"
+    # For full device/mDNS auto-discovery (Zigbee/Z-Wave/Bluetooth/Cast),
+    # remove the 'ports:' block above and add:  network_mode: host
+HOMEASSISTANT_COMPOSE
+
+            mkdir -p config
+
+            # Pre-seed trusted_proxies so HA works behind the Caddy reverse proxy.
+            # Only written on a fresh install (never clobber an existing config).
+            if [ ! -f config/configuration.yaml ]; then
+                cat > config/configuration.yaml << 'HA_CONFIG'
+# Loads default set of integrations. Do not remove.
+default_config:
+
+# Allow access through a reverse proxy (e.g. Caddy)
+http:
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 10.0.0.0/8
+    - 127.0.0.1
+    - ::1
+HA_CONFIG
+            fi
+
+            chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HOMEASSISTANT_DIR"
+
+            echo ""
+            echo "✓ Home Assistant configured at $HOMEASSISTANT_DIR"
+
+            # Configure Caddy reverse proxy before starting
+            configure_caddy_for_service "Home Assistant" "8123" "home"
+
+            prompt_yn "Start Home Assistant now? (y/n):" "y" START_HOMEASSISTANT
+            if [ "$START_HOMEASSISTANT" = "y" ] || [ "$START_HOMEASSISTANT" = "Y" ]; then
+                docker compose up -d 2>/dev/null && echo "  ✓ Home Assistant started" || echo "  ⚠ Failed to start"
+            fi
+
+            echo "  Access at:  http://localhost:8123"
+            echo "  First run:  open the URL and create your admin account (onboarding)."
+            echo "  Note:       first startup can take a minute while HA initializes."
+            echo ""
+        fi
+    fi
+
     # ---- MINECRAFT SERVER ----
     if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_MINECRAFT" ]; then
         echo ""
@@ -5443,6 +5533,11 @@ CADDY_ENV
 #     reverse_proxy mealie:9000
 # }
 
+# Home Assistant (home)
+# home.{$MY_DOMAIN} {
+#     reverse_proxy homeassistant:8123
+# }
+
 # ntfy (notifications)
 # ntfy.{$MY_DOMAIN} {
 #     reverse_proxy ntfy:80
@@ -7124,6 +7219,10 @@ if [ "$CONFIGURE_UFW" = "y" ] || [ "$CONFIGURE_UFW" = "Y" ]; then
                         ufw allow 9925/tcp comment 'Mealie' 2>/dev/null
                         echo "  ✓ Allowed Mealie (9925)"
                     fi
+                    if [ "$INSTALL_HOMEASSISTANT" = "y" ] || [ "$INSTALL_HOMEASSISTANT" = "Y" ]; then
+                        ufw allow 8123/tcp comment 'Home Assistant' 2>/dev/null
+                        echo "  ✓ Allowed Home Assistant (8123)"
+                    fi
                     if [ "$INSTALL_MAGICMIRROR" = "y" ] || [ "$INSTALL_MAGICMIRROR" = "Y" ]; then
                         ufw allow 8081:8083/tcp comment 'MagicMirror' 2>/dev/null
                         echo "  ✓ Allowed MagicMirror (8081-8083)"