fix(birdnet-pi): keep sudo in the BirdNET-Pi scripts so WebUI service actions work (#3155)

* fix(birdnet-pi): keep sudo in the BirdNET-Pi scripts so WebUI service actions work

Since 2026.07.10-1 the build stripped "sudo " from every file under
$HOME/BirdNET-Pi/scripts, on the premise that php-fpm's caddy user is not a
sudoer. It is (upstream install_services.sh writes 010_caddy-nopasswd, present
in the published image per 9bfad91d7b), and pi has NOPASSWD too. The strip
instead broke the WebUI:
- service_controls.php (stripped) emits "systemctl ..." button values while
  homepage/views.php (not under scripts/) only allows "sudo systemctl ...",
  so the System Controls buttons were ignored;
- config.php / restart_services.sh ran systemctl as caddy, and systemctl3
  keeps unit state in /run for root but /tmp/run otherwise, so it could not
  see or stop the root-started services (and caddy cannot setuid to pi);
- "sudo -u <user> cmd" in config.php became "-u <user> cmd".

Delete the strip. The ingress hook in 91-nginx_ingress.sh already anchors on
an optional sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(birdnet-pi): attach the hadolint ignore to the RUN it was written for

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

birdnet-pi/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 2026.10.26.1 (26-10-2026)
+- Fix: WebUI service actions (System Controls buttons, "Restart services", the chart restart after saving settings) work again. Since 2026.07.10-1 the build stripped `sudo` from every BirdNET-Pi script, so these ran `systemctl` as php-fpm's `caddy` user: the service-control buttons no longer matched the WebUI's allow-list (which still expects `sudo systemctl ...`) and were ignored, and the `systemctl` replacement looked for the running services in `/tmp/run` instead of root's `/run`, so it could neither see nor stop them. It also turned `sudo -u <user> ...` into a bare `-u <user> ...` in `config.php` (species list, test notification). `sudo` is kept again; `caddy` and `pi` already have passwordless sudo in the image
+
 ## 2026.10.26 (26-10-2026)
 - Fix: restarting the services no longer leaves a previous `daily_plot.py` or recording loop running next to the new one. The `systemctl` replacement has no cgroups and skips the children of a main process that already died, so `restart_services.sh` now clears leftover `daily_plot.py`, `birdnet_recording.sh`, and `ffmpeg`/`arecord` recorders writing to `StreamData` once the recorder is stopped
 - Fix: an unreachable audio source (RTSP host switched off, missing soundcard) no longer causes a restart loop. The monitoring service treated a static `analyzing_now.txt` as a hung analyzer and ran `restart_services.sh` every two minutes, which stacked up a second `daily_plot.py` and a second recording loop each time, so RAM kept growing. It now reports the silent source instead of restarting when there is nothing queued to analyze, and limits that static `analyzing_now.txt` restart path to once every 30 minutes

birdnet-pi/Dockerfile

@@ -37,10 +37,10 @@ ARG CONFIGLOCATION="/config"
 RUN chmod 744 /ha_lsio.sh && if grep -qr "lsio" /etc; then /ha_lsio.sh "$CONFIGLOCATION"; fi && rm /ha_lsio.sh
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-# hadolint ignore=DL3015,SC2016
 # Add rootfs
 COPY rootfs/ /
 RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
+# hadolint ignore=DL3015,SC2016
 RUN \
     # Install dependencies
     echo "Install dependencies" && \
@@ -99,16 +99,6 @@ RUN \
     # Execute installer
     /./newinstaller.sh && \
     \
-    # Remove sudo from the installed BirdNET-Pi scripts.
-    # Inside the container everything already runs with the privileges it needs
-    # (root during init, user "pi" for the services), so "sudo" is never required.
-    # Leaving it in breaks any script invoked by a user that is not in sudoers -
-    # e.g. php-fpm's "caddy" user driving the WebUI System Controls, or the "abc"
-    # user - which is what prevented BirdNET-Pi from working in standalone
-    # (no-Supervisor) mode. This must run AFTER the installer has cloned the repo;
-    # the previous build-time hook ran before the clone and was therefore a no-op.
-    for file in $(grep -srlF "sudo " "$HOME/BirdNET-Pi/scripts"); do sed -i "s|sudo ||g" "$file"; done && \
-    \
     # Install dateparser and resampy, upgrade numpy
     $PYTHON_VIRTUAL_ENV /usr/bin/pip3 install dateparser resampy && \
     \

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.10.26
+version: 2026.10.26.1
 video: true