Node-RED

Last reviewed Aug 26, 2026 · 806 words

Every home automation stack I have seen survive more than a year has Node-RED bolted onto the side of it. Not because Home Assistant cannot do automations, but because the moment logic gets conditional, time-dependent, or involves 3 external APIs, dragging wires between nodes in a browser beats editing YAML by a wide margin. Node-RED has been doing this since 2013, is Apache-2.0 with 23,582 stars, runs on port 1880 in about 256 MB of RAM, and is rated Easy for a reason. The one thing it does not do by default is protect its own editor, and that is the first section for a reason too.

The default install has no login

A stock Node-RED exposes its editor on port 1880 to anyone who can reach the port, and that editor can run arbitrary JavaScript in function nodes and read every credential you have stored. On a LAN behind a router that is a moderate risk; on a VPS it is a compromised server waiting to happen. Fix it before building a single flow. Generate a password hash with node-red admin hash-pw, then add an adminAuth block to settings.js:

adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "$2b$08$...paste-the-hash-here...",
        permissions: "*"
    }]
},
credentialSecret: "a-long-random-string-you-back-up",

The credentialSecret line matters almost as much: it encrypts stored credentials in flows_cred.json, and without it Node-RED generates a random one and warns you that a moved install will lose every saved password. Set it, and keep the whole data directory in your backups.

Docker in 6 lines

services:
  nodered:
    image: nodered/node-red:latest
    ports: ["1880:1880"]
    volumes: ["./data:/data"]
    restart: unless-stopped

Everything lives in /data: settings.js, flows.json, the encrypted credentials, and any extra nodes you install through the palette manager (which go into a node_modules folder there, so they survive image updates). Put the editor behind a reverse proxy with TLS if it faces anything beyond your LAN, and pin a version tag instead of latest once things work; major releases occasionally raise the Node.js baseline, and a surprise pull is a poor way to find out.

Where it beats Home Assistant automations, and where n8n wins

The Home Assistant integration is the killer use: install the node-red-contrib-home-assistant-websocket palette and every entity, state change and service call appears as a node. Logic like "if motion after sunset and nobody has been in the kitchen for 20 minutes and the TV is off, dim the lights over 5 seconds, unless guest mode" is 8 nodes and readable at a glance. The same rule in YAML is a wall. MQTT is native, so a Zigbee2MQTT topic is an input node with no plugin at all. Anything with a timer, a debounce, or a state machine is where the flow model earns its keep, and the first month with Home Assistant post is where I suggest adding it.

What it is not is a business automation tool. The listed con "not aimed at business SaaS" is fair: there is no built-in catalogue of 400 SaaS connectors with OAuth handled for you. If your flows are "new row in a spreadsheet, post to Slack, create a ticket", n8n is the better tool, and the n8n vs Node-RED comparison draws that line in more detail. Node-RED is for devices, protocols and events; n8n is for SaaS APIs. Many homes run both.

Flows get tangled, and the fix is discipline, not features

Node-RED's other honest con is that a big flow becomes spaghetti. The tools to prevent it exist and nobody uses them early enough. Split logic across tabs by room or by system. Use link-in and link-out nodes instead of wires that cross the whole canvas. Wrap anything you repeat into a subflow with named inputs. Name every function node with what it does, not "function 12". And turn on the Projects feature in settings.js, which puts your flows in a git repository with commit history from inside the editor; the first time a bad edit takes down your lights at 23:00, git revert from the editor is worth every minute of setup.

What I'd do

Node-RED in Docker on the same host as Home Assistant, editor password set before the first flow, credentialSecret recorded in your password manager, /data backed up nightly. Move only the automations that hurt in YAML, leave the simple ones where they are, and organise by tab from day one. Keep n8n for the SaaS glue if you have any. Run like that, the 256 MB it costs is the best-spent memory on the box.