diff --git a/home-assistant-dev/values.yaml b/home-assistant-dev/values.yaml
index 9a3945d..4011ac4 100644
--- a/home-assistant-dev/values.yaml
+++ b/home-assistant-dev/values.yaml
@@ -5,6 +5,9 @@ home-assistant:
 
   hostNetwork: false
 
+  http:
+    enabled: true
+
   homekit:
     enabled: false
 
diff --git a/home-assistant/templates/deployment.yaml b/home-assistant/templates/deployment.yaml
index 30bcddc..3584e60 100644
--- a/home-assistant/templates/deployment.yaml
+++ b/home-assistant/templates/deployment.yaml
@@ -37,6 +37,39 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
+        {{- if .Values.http.enabled }}
+        - name: init-http
+          image: busybox:latest
+          command:
+            - /bin/sh
+            - -c
+            - |
+              # Build http.yaml — auto-detect pod/service CIDRs from environment
+              POD_CIDR=$(echo $KUBERNETES_SERVICE_HOST | sed 's/\.[0-9]*$/\.0\/16/')
+              cat > /config/http.yaml << EOF
+              server_port: {{ .Values.http.server_port }}
+              ip_ban_enabled: {{ .Values.http.ip_ban_enabled }}
+              login_attempts_threshold: {{ .Values.http.login_attempts_threshold }}
+              use_x_forwarded_for: true
+              trusted_proxies:
+                - ${POD_CIDR}
+                - 127.0.0.1
+                - "::1"
+              {{- range .Values.http.extra_trusted_proxies }}
+                - {{ . | quote }}
+              {{- end }}
+              EOF
+              # Remove leading whitespace from heredoc
+              sed -i 's/^              //' /config/http.yaml
+              # Ensure configuration.yaml includes http.yaml
+              if ! grep -q 'http.yaml' /config/configuration.yaml 2>/dev/null; then
+                echo "" >> /config/configuration.yaml
+                echo "http: !include http.yaml" >> /config/configuration.yaml
+              fi
+          volumeMounts:
+            - name: config
+              mountPath: /config
+        {{- end }}
         {{- if .Values.haSecrets.enabled }}
         - name: init-secrets
           image: busybox:latest
@@ -100,7 +133,7 @@ spec:
               exec /init
           ports:
             - name: http
-              containerPort: 8123
+              containerPort: {{ .Values.http.server_port }}
               protocol: TCP
             {{- if .Values.homekit.enabled }}
             - name: homekit
diff --git a/home-assistant/templates/service.yaml b/home-assistant/templates/service.yaml
index 3a36dff..21f491e 100644
--- a/home-assistant/templates/service.yaml
+++ b/home-assistant/templates/service.yaml
@@ -11,7 +11,7 @@ spec:
   type: {{ .Values.service.type }}
   ports:
     - port: {{ .Values.service.port }}
-      targetPort: 8123
+      targetPort: {{ .Values.http.server_port }}
       protocol: TCP
       name: http
   selector:
diff --git a/home-assistant/values.yaml b/home-assistant/values.yaml
index c2e8635..33694b9 100644
--- a/home-assistant/values.yaml
+++ b/home-assistant/values.yaml
@@ -72,6 +72,14 @@ persistence:
       - ReadWriteOnce
     storageClass: ""
 
+http:
+  enabled: false
+  server_port: 8123
+  ip_ban_enabled: false
+  login_attempts_threshold: 5
+  # Pod/service CIDRs and localhost are auto-detected; add extra entries here
+  extra_trusted_proxies: []
+
 haSecrets:
   enabled: false
   # K8s Secret containing key-value pairs to write as /config/secrets.yaml