birdnet-go: harden config init, auto-wire MQTT/MariaDB, trim ingress proxy

Bugs fixed in 01-structure.sh: - Database backup created during BIRDSONGS_FOLDER migration was written to the script's CWD instead of /config, and the restore path was recomputed with a fresh timestamp — so any second-boundary crossing between backup and restore left the user unable to recover. Backup path is now absolute and reused for restore. - Path inputs are validated against [A-Za-z0-9._/-]+ before being interpolated into the SQL UPDATE statement. - Default-config download tolerates network failure instead of leaving an empty config.yaml behind. - output.sqlite.path and logging.file_output.* are now seeded with the "set-if-missing" idiom (`//=`) so user edits to config.yaml survive restarts. (Breaking: addon options for log rotation now only seed defaults on first run.) - Path normalization centralized; trailing-slash juggling removed. UX upgrades: - 33-mqtt.sh now auto-configures realtime.mqtt.* in config.yaml from the HA Mosquitto addon (with new mqtt_disable opt-out option). - 33-mariadb.sh now auto-switches output.mysql.* to the HA MariaDB addon and disables SQLite (with mariadb_disable opt-out option). Cleanup: - Dockerfile: upstream entrypoint sed-patch now warns (not silently succeeds) when the target pattern is missing in a new nightly. - Removed dead nginx upstream.conf pointing at unused port 8096. - Trimmed redundant nginx HTML-attribute sub_filters; upstream birdnet-go handles those itself via X-Ingress-Path. JS string rewrites kept since the upstream HTML rewriter does not touch JS. (Breaking UI-side if upstream regresses — see CHANGELOG.)
2026-07-01 19:48:47 +02:00 · 2026-05-28 17:01:42 +00:00
parent 9151d3bc8a
commit 2087da7f18
10 changed files with 200 additions and 70 deletions
--- a/birdnet-go/CHANGELOG.md
+++ b/birdnet-go/CHANGELOG.md
@@ -1,3 +1,14 @@
+## nightly-20260525-3 (28-05-2026)
+- Auto-configure the Home Assistant MQTT addon: when Mosquitto is active, `realtime.mqtt.{enabled,broker,username,password}` are written directly to `config.yaml`. Set the new `mqtt_disable: true` addon option to opt out.
+- Auto-configure the Home Assistant MariaDB addon: when active, `output.mysql.*` is filled in and `output.sqlite.enabled` is set to `false`. Set the new `mariadb_disable: true` addon option to opt out.
+- **Breaking**: `output.sqlite.path` and `logging.file_output.*` are now seeded only when missing from `config.yaml` (previously overwritten every restart). Values changed through the BirdNET-Go UI or by hand-editing `config.yaml` now survive container restarts. If you relied on `LOG_MAX_SIZE_MB` / `LOG_MAX_AGE_DAYS` addon options to override an existing setting in `config.yaml`, remove the existing key from `config.yaml` or edit it directly — the option will only be applied on first run.
+- **Breaking (UI only)**: The nginx ingress reverse-proxy no longer rewrites HTML `href`/`src`/`action` attributes; upstream BirdNET-Go handles those itself via `X-Ingress-Path`. JavaScript string-literal rewrites are unchanged. Please file an issue if you see broken images, links, or forms in the ingress UI after upgrade.
+- Fix database-migration restore: the timestamped backup created during a `BIRDSONGS_FOLDER` change was being written to the script's working directory and looked up under a fresh timestamp on restore, so a SQL failure left the user unable to recover. Backup path is now absolute and reused for restore.
+- Harden the `BIRDSONGS_FOLDER` SQL/YAML path substitution: paths containing characters outside `[A-Za-z0-9._/-]` are now rejected up front instead of being interpolated raw into the SQL UPDATE statement.
+- Tolerate a missing internet connection on first boot: if the default `config.yaml` cannot be downloaded from GitHub, BirdNET-Go now falls back to its embedded defaults instead of starting with an empty config.
+- Warn (without failing the build) if the upstream `entrypoint.sh` patch target drifts in a new nightly.
+- Remove a dead nginx upstream definition that pointed at an unused port.
+
 ## nightly-20260525-2 (26-05-2026)
 - Suppress noisy startup logs: silence `chmod /dev/snd` errors on the read-only HA mount, and hide unavailable ALSA plugins (JACK, OSS, dsnoop) from device enumeration so libjack and pcm_oss/dsnoop probes no longer print at launch. ALSA overrides are written to `/root/.asoundrc` (since `/etc/asound.conf` is read-only in this environment).
 - Allow advanced users to override the ALSA config by dropping a custom `asound.conf` into the addon config folder.
--- a/birdnet-go/Dockerfile
+++ b/birdnet-go/Dockerfile
@@ -39,8 +39,14 @@ RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -e
 # Silence "chmod: Read-only file system" noise from upstream entrypoint:
 # Home Assistant mounts /dev/snd read-only, so the chmod is a no-op and the
 # stderr output is just noise. The "|| true" already absorbs the exit code.
+# Warn (without failing the build) if the upstream pattern drifts so we notice
+# in CI logs and can update the patch.
 RUN if [ -f /usr/bin/entrypoint.sh ]; then \
-        sed -i 's#chmod -R a+rw /dev/snd || true#chmod -R a+rw /dev/snd 2>/dev/null || true#' /usr/bin/entrypoint.sh; \
+        if grep -q 'chmod -R a+rw /dev/snd || true' /usr/bin/entrypoint.sh; then \
+            sed -i 's#chmod -R a+rw /dev/snd || true#chmod -R a+rw /dev/snd 2>/dev/null || true#' /usr/bin/entrypoint.sh; \
+        else \
+            echo "WARN: upstream entrypoint.sh /dev/snd chmod pattern not found; nightly drift?" >&2; \
+        fi; \
    fi

 # Uses /bin for compatibility purposes
--- a/birdnet-go/README.md
+++ b/birdnet-go/README.md
@@ -49,6 +49,8 @@ Options can be configured through three ways :
 ALSA_CARD : number of the card (0 or 1 usually), see https://github.com/tphakala/birdnet-go/blob/main/doc/installation.md#deciding-alsa_card-value
 TZ: Etc/UTC specify a timezone to use, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
 COMMAND : realtime --rtsp url # allows to provide arguments to birdnet-go
+mqtt_disable: false # set true to skip auto-wiring of the Home Assistant MQTT addon
+mariadb_disable: false # set true to skip auto-wiring of the Home Assistant MariaDB addon
 ```

 - Config.yaml
@@ -57,6 +59,14 @@ Additional variables can be configured using the config.yaml file found in /conf
 - Config_env.yaml
 Additional environment variables can be configured there

+### MQTT and MariaDB auto-configuration
+
+If the Home Assistant **MQTT** addon is installed and running, BirdNET-Go is now wired to it automatically on startup: `realtime.mqtt.enabled`, `broker`, `username`, and `password` in `config.yaml` are populated from the HA Mosquitto credentials, and the topic defaults to `birdnet`. Set `mqtt_disable: true` in the addon options to keep manual control.
+
+If the Home Assistant **MariaDB** addon is installed and running, BirdNET-Go is switched to it automatically: `output.mysql` is enabled with the HA credentials (database `birdnet`, created on first connect) and `output.sqlite.enabled` is set to `false`. Set `mariadb_disable: true` to keep using SQLite or to point at a different MySQL server manually.
+
+The addon also seeds `output.sqlite.path` and `logging.file_output.*` defaults only when those keys are missing from `config.yaml`, so values you change through the BirdNET-Go UI now survive container restarts.
+
 ### Mounting Drives

 This addon supports mounting both local drives and remote SMB shares:
--- a/birdnet-go/config.yaml
+++ b/birdnet-go/config.yaml
@@ -89,6 +89,8 @@ options:
  LOG_MAX_SIZE_MB: 50
  LOG_MAX_AGE_DAYS: 7
  homeassistant_microphone: false
+  mqtt_disable: false
+  mariadb_disable: false
 panel_admin: false
 panel_icon: mdi:bird
 ports:
@@ -114,6 +116,8 @@ schema:
  cifsusername: str?
  homeassistant_microphone: bool?
  localdisks: str?
+  mariadb_disable: bool?
+  mqtt_disable: bool?
  networkdisks: str?
 services:
  - mysql:want
@@ -122,4 +126,4 @@ slug: birdnet-go
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-go
 usb: true
-version: "nightly-20260525-2"
+version: "nightly-20260525-3"
--- a/birdnet-go/rootfs/etc/cont-init.d/01-structure.sh
+++ b/birdnet-go/rootfs/etc/cont-init.d/01-structure.sh
@@ -3,12 +3,38 @@
 set -e

 # Default Variables
-DEFAULT_BIRDSONGS_FOLDER="/data/clips/"
+DEFAULT_BIRDSONGS_FOLDER="/data/clips"
 CONFIG_LOCATION="/config/config.yaml"

+# Strip trailing slashes; canonical internal form has none.
+normalize_path() {
+    local p="$1"
+    while [[ "$p" == */ && "$p" != "/" ]]; do
+        p="${p%/}"
+    done
+    printf '%s' "$p"
+}
+
+# Reject paths containing characters that would break the SQL/YAML literals
+# we substitute into below. We deliberately allow only "safe" filename chars.
+validate_safe_path() {
+    local p="$1"
+    if [[ ! "$p" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+        bashio::log.fatal "Refusing unsafe path: '$p' (only [A-Za-z0-9._/-] allowed)"
+        exit 1
+    fi
+}
+
 if [ ! -f "$CONFIG_LOCATION" ]; then
    bashio::log.warning "There is no config.yaml yet in the config folder, downloading a default one. Please customize"
-    curl -L -s -S https://raw.githubusercontent.com/tphakala/birdnet-go/refs/heads/main/internal/conf/config.yaml -o "$CONFIG_LOCATION"
+    # Network may be unreachable on first boot; tolerate failure and let
+    # birdnet-go fall back to its embedded default on first run.
+    if ! curl -fL -s -S \
+            https://raw.githubusercontent.com/tphakala/birdnet-go/refs/heads/main/internal/conf/config.yaml \
+            -o "$CONFIG_LOCATION"; then
+        bashio::log.warning "Could not download default config.yaml; birdnet-go will create one from its embedded defaults"
+        rm -f "$CONFIG_LOCATION"
+    fi
 fi

 #################
@@ -22,20 +48,22 @@ fi
 ######################
 # Birdsongs Location
 ######################
-CURRENT_BIRDSONGS_FOLDER="clips/"
-# Read the current folder from config files
+# Read the current folder from config.yaml; fall back to the legacy default.
 CURRENT_BIRDSONGS_FOLDER="$(yq '.realtime.audio.export.path' "$CONFIG_LOCATION" | tr -d '\"')"
 CURRENT_BIRDSONGS_FOLDER="${CURRENT_BIRDSONGS_FOLDER:-$DEFAULT_BIRDSONGS_FOLDER}"
-
-# Adjust default path if it matches the default string
-if [[ "$CURRENT_BIRDSONGS_FOLDER" == "clips/" ]]; then
+# Treat the upstream-shipped relative "clips/" as the legacy default.
+if [[ "$CURRENT_BIRDSONGS_FOLDER" == "clips" || "$CURRENT_BIRDSONGS_FOLDER" == "clips/" ]]; then
    CURRENT_BIRDSONGS_FOLDER="$DEFAULT_BIRDSONGS_FOLDER"
 fi
+CURRENT_BIRDSONGS_FOLDER="$(normalize_path "$CURRENT_BIRDSONGS_FOLDER")"

-# Set the new birdsongs folder
+# Set the new birdsongs folder from addon options (default: relative "clips").
 BIRDSONGS_FOLDER="$(bashio::config "BIRDSONGS_FOLDER")"
-BIRDSONGS_FOLDER="${BIRDSONGS_FOLDER:-clips/}"
-BIRDSONGS_FOLDER="${BIRDSONGS_FOLDER%/}" # Remove trailing slash if present
+BIRDSONGS_FOLDER="$(normalize_path "${BIRDSONGS_FOLDER:-clips}")"
+
+validate_safe_path "$BIRDSONGS_FOLDER"
+validate_safe_path "$CURRENT_BIRDSONGS_FOLDER"
+
 if [[ ! "$BIRDSONGS_FOLDER" == /* ]]; then
    if [ ! -d "/config/$BIRDSONGS_FOLDER" ]; then
        mkdir -p "/config/$BIRDSONGS_FOLDER"
@@ -52,42 +80,43 @@ fi
 bashio::log.info "... audio clips saved to $BIRDSONGS_FOLDER according to addon options"

 # Migrate data if the folder has changed
-if [[ "${CURRENT_BIRDSONGS_FOLDER%/}" != "${BIRDSONGS_FOLDER%/}" ]]; then
+if [[ "$CURRENT_BIRDSONGS_FOLDER" != "$BIRDSONGS_FOLDER" ]]; then
    bashio::log.warning "Birdsongs folder changed from $CURRENT_BIRDSONGS_FOLDER to $BIRDSONGS_FOLDER"
-    # Update config files with the new birdsongs folder path
-    yq -i -y ".realtime.audio.export.path = \"$BIRDSONGS_FOLDER/\"" "$CONFIG_LOCATION"
+    # Update config.yaml with the new birdsongs folder path (trailing slash
+    # restored only at the boundary, since birdnet-go expects it).
+    yq -i -y ".realtime.audio.export.path = \"${BIRDSONGS_FOLDER}/\"" "$CONFIG_LOCATION"
    # Move files only if sqlite paths changed
    if [[ -d "$CURRENT_BIRDSONGS_FOLDER" && "$(ls -A "$CURRENT_BIRDSONGS_FOLDER")" ]]; then
        bashio::log.warning "Migrating files from $CURRENT_BIRDSONGS_FOLDER to $BIRDSONGS_FOLDER"
        cp -rnf "$CURRENT_BIRDSONGS_FOLDER"/* "$BIRDSONGS_FOLDER"/
-        mv "${CURRENT_BIRDSONGS_FOLDER%/}" "${CURRENT_BIRDSONGS_FOLDER%/}_migrated"
+        mv "$CURRENT_BIRDSONGS_FOLDER" "${CURRENT_BIRDSONGS_FOLDER}_migrated"
    fi
    # Adapt the database
    if [ -f /config/birdnet.db ]; then
-        # Prepare
        backup="$(date +%Y%m%d_%H%M%S)"
-        bashio::log.warning "Modifying database paths from $CURRENT_BIRDSONGS_FOLDER to $BIRDSONGS_FOLDER. A backup named birdnet.db_$backup will be created before"
+        BACKUP_FILE="/config/birdnet.db_${backup}"
+        bashio::log.warning "Modifying database paths from $CURRENT_BIRDSONGS_FOLDER to $BIRDSONGS_FOLDER. A backup will be created at ${BACKUP_FILE}"

-        # Create backup
-        if ! cp /config/birdnet.db "birdnet.db_$backup"; then
+        # Create backup at the absolute path we'll restore from on failure.
+        if ! cp /config/birdnet.db "$BACKUP_FILE"; then
            bashio::log.error "Failed to create a backup of the database. Aborting path modification."
            exit 1
        fi

-        # Execute the query using sqlite3
-        SQL_QUERY="UPDATE notes SET clip_name = '${BIRDSONGS_FOLDER%/}/' || substr(clip_name, length('${CURRENT_BIRDSONGS_FOLDER%/}/') + 1) WHERE clip_name LIKE '${CURRENT_BIRDSONGS_FOLDER%/}/%';"
+        # Paths were validated above against [A-Za-z0-9._/-]+ so quote
+        # escaping in the SQL literal is not a concern.
+        SQL_QUERY="UPDATE notes SET clip_name = '${BIRDSONGS_FOLDER}/' || substr(clip_name, length('${CURRENT_BIRDSONGS_FOLDER}/') + 1) WHERE clip_name LIKE '${CURRENT_BIRDSONGS_FOLDER}/%';"

        if ! sqlite3 /config/birdnet.db "$SQL_QUERY"; then
            bashio::log.warning "An error occurred while updating the paths. The database backup will be restored."
-            BACKUP_FILE="/config/birdnet.db_$(date +%Y%m%d_%H%M%S)" # Make sure this matches the earlier backup filename
            if [ -f "$BACKUP_FILE" ]; then
                mv "$BACKUP_FILE" /config/birdnet.db
                bashio::log.info "The database backup has been restored."
            else
-                bashio::log.error "Backup file not found! Manual intervention required."
+                bashio::log.error "Backup file $BACKUP_FILE not found! Manual intervention required."
            fi
        else
-            echo "Paths have been successfully updated."
+            bashio::log.info "Paths have been successfully updated."
        fi
    fi
 fi
@@ -95,11 +124,13 @@ fi
 ####################
 # Correct Defaults
 ####################
-bashio::log.info "Correcting configuration for defaults"
+# Seed addon-specific defaults only if the user has not set them in
+# config.yaml. The "//=" form leaves any user-edited value alone, so
+# changes made via the BirdNET-Go UI or by hand-editing /config/config.yaml
+# survive container restarts.
+bashio::log.info "Seeding default configuration values (only if missing)"

-# Update database location in config files
-yq -i -y ".output.sqlite.path = \"/config/birdnet.db\"" "$CONFIG_LOCATION"
-bashio::log.info "... database is located in /config/birdnet.db"
+yq -i -y '.output.sqlite.path //= "/config/birdnet.db"' "$CONFIG_LOCATION"

 ####################
 # Log Management
@@ -109,13 +140,13 @@ LOG_MAX_SIZE_MB="${LOG_MAX_SIZE_MB:-50}"
 LOG_MAX_AGE_DAYS="$(bashio::config "LOG_MAX_AGE_DAYS")"
 LOG_MAX_AGE_DAYS="${LOG_MAX_AGE_DAYS:-7}"

-bashio::log.info "Configuring log rotation: max ${LOG_MAX_SIZE_MB}MB per file, max ${LOG_MAX_AGE_DAYS} days retention"
+bashio::log.info "Seeding default log rotation: max ${LOG_MAX_SIZE_MB}MB per file, max ${LOG_MAX_AGE_DAYS} days retention (only applied if not already set)"

-# Configure log rotation in birdnet-go config
-yq -i -y ".logging.file_output.max_size = ${LOG_MAX_SIZE_MB}" "$CONFIG_LOCATION"
-yq -i -y ".logging.file_output.max_age = ${LOG_MAX_AGE_DAYS}" "$CONFIG_LOCATION"
-yq -i -y ".logging.file_output.max_rotated_files = 3" "$CONFIG_LOCATION"
-yq -i -y ".logging.file_output.compress = true" "$CONFIG_LOCATION"
+# Seed log-rotation defaults; do not clobber user-edited values.
+yq -i -y ".logging.file_output.max_size //= ${LOG_MAX_SIZE_MB}" "$CONFIG_LOCATION"
+yq -i -y ".logging.file_output.max_age //= ${LOG_MAX_AGE_DAYS}" "$CONFIG_LOCATION"
+yq -i -y '.logging.file_output.max_rotated_files //= 3' "$CONFIG_LOCATION"
+yq -i -y '.logging.file_output.compress //= true' "$CONFIG_LOCATION"

 # Trim existing log files that exceed the configured max age
 LOG_DIR="/config/logs"
--- a/birdnet-go/rootfs/etc/cont-init.d/33-mariadb.sh
+++ b/birdnet-go/rootfs/etc/cont-init.d/33-mariadb.sh
@@ -2,15 +2,56 @@
 # shellcheck shell=bash
 set -e

-# Gives mariadb information
+# If the Home Assistant MariaDB addon is active, wire its credentials directly
+# into BirdNET-Go's config.yaml. Upstream reads MySQL settings only from YAML
+# (no env-var overrides exist). Users who prefer SQLite or a different MySQL
+# server can set mariadb_disable: true in the addon options.

-if bashio::services.available 'mysql'; then
-    bashio::log.green "---"
-    bashio::log.yellow "MariaDB addon is active on your system! If you want to use it instead of sqlite, here are the informations to encode :"
-    bashio::log.blue "Database user : $(bashio::services "mysql" "username")"
-    bashio::log.blue "Database password : $(bashio::services "mysql" "password")"
-    bashio::log.blue "Database name : birdnet"
-    bashio::log.blue "Host-name : $(bashio::services "mysql" "host")"
-    bashio::log.blue "Port : $(bashio::services "mysql" "port")"
-    bashio::log.green "---"
+CONFIG_LOCATION="/config/config.yaml"
+MYSQL_DATABASE="birdnet"
+
+if ! bashio::services.available 'mysql'; then
+    exit 0
 fi
+
+if bashio::config.true 'mariadb_disable'; then
+    bashio::log.info "MariaDB auto-configuration disabled by 'mariadb_disable' addon option; skipping."
+    exit 0
+fi
+
+if [ ! -f "$CONFIG_LOCATION" ]; then
+    bashio::log.warning "Skipping MariaDB auto-configuration: $CONFIG_LOCATION not found"
+    exit 0
+fi
+
+MYSQL_HOST="$(bashio::services 'mysql' 'host')"
+MYSQL_PORT="$(bashio::services 'mysql' 'port')"
+MYSQL_USER="$(bashio::services 'mysql' 'username')"
+MYSQL_PASS="$(bashio::services 'mysql' 'password')"
+
+bashio::log.green "---"
+bashio::log.blue "Home Assistant MariaDB addon detected; auto-configuring BirdNET-Go"
+bashio::log.blue "Host:     ${MYSQL_HOST}:${MYSQL_PORT}"
+bashio::log.blue "User:     ${MYSQL_USER}"
+bashio::log.blue "Database: ${MYSQL_DATABASE} (will be created by BirdNET-Go on first connect)"
+bashio::log.blue "(Set 'mariadb_disable: true' in addon options to opt out)"
+bashio::log.green "---"
+
+# Upstream config.go stores port as a string; pass it as such to match.
+# $host / $port / etc. are jq/yq variables, not shell expansions — the
+# single quotes around the filter are intentional.
+# shellcheck disable=SC2016
+yq -i -y \
+    --arg host "$MYSQL_HOST" \
+    --arg port "$MYSQL_PORT" \
+    --arg user "$MYSQL_USER" \
+    --arg pass "$MYSQL_PASS" \
+    --arg db "$MYSQL_DATABASE" \
+    '.output.mysql.enabled = true
+     | .output.mysql.host = $host
+     | .output.mysql.port = $port
+     | .output.mysql.username = $user
+     | .output.mysql.password = $pass
+     | .output.mysql.database = $db
+     | .output.sqlite.enabled = false' \
+    "$CONFIG_LOCATION"
--- a/birdnet-go/rootfs/etc/cont-init.d/33-mqtt.sh
+++ b/birdnet-go/rootfs/etc/cont-init.d/33-mqtt.sh
@@ -2,13 +2,50 @@
 # shellcheck shell=bash
 set -e

-# Gives mqtt information
+# If the Home Assistant MQTT addon is active, wire its credentials directly
+# into BirdNET-Go's config.yaml (upstream reads MQTT settings only from YAML;
+# no env-var overrides exist). Users who prefer to manage MQTT manually can
+# set mqtt_disable: true in the addon options.

-if bashio::services.available 'mqtt'; then
-    bashio::log.green "---"
-    bashio::log.yellow "MQTT addon is active on your system! Add the MQTT details below to the Birdnet-go config.yaml :"
-    bashio::log.blue "MQTT user : $(bashio::services "mqtt" "username")"
-    bashio::log.blue "MQTT password : $(bashio::services "mqtt" "password")"
-    bashio::log.blue "MQTT broker : tcp://$(bashio::services "mqtt" "host"):$(bashio::services "mqtt" "port")"
-    bashio::log.green "---"
+CONFIG_LOCATION="/config/config.yaml"
+
+if ! bashio::services.available 'mqtt'; then
+    exit 0
 fi
+
+if bashio::config.true 'mqtt_disable'; then
+    bashio::log.info "MQTT auto-configuration disabled by 'mqtt_disable' addon option; skipping."
+    exit 0
+fi
+
+if [ ! -f "$CONFIG_LOCATION" ]; then
+    bashio::log.warning "Skipping MQTT auto-configuration: $CONFIG_LOCATION not found"
+    exit 0
+fi
+
+MQTT_HOST="$(bashio::services 'mqtt' 'host')"
+MQTT_PORT="$(bashio::services 'mqtt' 'port')"
+MQTT_USER="$(bashio::services 'mqtt' 'username')"
+MQTT_PASS="$(bashio::services 'mqtt' 'password')"
+MQTT_BROKER="tcp://${MQTT_HOST}:${MQTT_PORT}"
+
+bashio::log.green "---"
+bashio::log.blue "Home Assistant MQTT addon detected; auto-configuring BirdNET-Go"
+bashio::log.blue "Broker: ${MQTT_BROKER}"
+bashio::log.blue "User:   ${MQTT_USER}"
+bashio::log.blue "(Set 'mqtt_disable: true' in addon options to opt out)"
+bashio::log.green "---"
+
+# $broker / $user / $pass / "birdnet" are jq/yq variables and literals,
+# not shell expansions, so the single quotes are intentional.
+# shellcheck disable=SC2016
+yq -i -y \
+    --arg broker "$MQTT_BROKER" \
+    --arg user "$MQTT_USER" \
+    --arg pass "$MQTT_PASS" \
+    '.realtime.mqtt.enabled = true
+     | .realtime.mqtt.broker = $broker
+     | .realtime.mqtt.username = $user
+     | .realtime.mqtt.password = $pass
+     | .realtime.mqtt.topic //= "birdnet"' \
+    "$CONFIG_LOCATION"
--- a/birdnet-go/rootfs/etc/nginx/includes/upstream.conf
+++ b/birdnet-go/rootfs/etc/nginx/includes/upstream.conf
@@ -1,3 +0,0 @@
-upstream backend {
-    server 127.0.0.1:8096;
-}
--- a/birdnet-go/rootfs/etc/nginx/nginx.conf
+++ b/birdnet-go/rootfs/etc/nginx/nginx.conf
@@ -76,7 +76,6 @@ http {
    }

    include /etc/nginx/includes/resolver.conf;
-    include /etc/nginx/includes/upstream.conf;

    include /etc/nginx/servers/*.conf;
 }
--- a/birdnet-go/rootfs/etc/nginx/servers/ingress.conf
+++ b/birdnet-go/rootfs/etc/nginx/servers/ingress.conf
@@ -21,29 +21,25 @@ server {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

-      # Tell BirdNET-Go its proxy prefix (NEW — required)
+      # Tell BirdNET-Go its proxy prefix. Upstream honours X-Ingress-Path
+      # in internal/api/server.go and rewrites HTML href/src/action
+      # attributes itself, so we no longer duplicate that work here.
      proxy_set_header X-Ingress-Path %%ingress_entry%%;

      # Prevent timeouts
      proxy_read_timeout 86400;
      proxy_send_timeout 86400;

-      # sub_filter setup
+      # sub_filter setup: keep gzip off and the type filter wide so JS gets
+      # touched too (the upstream HTML rewriter does not look inside JS).
      proxy_set_header Accept-Encoding "";
      sub_filter_once off;
      sub_filter_types *;

-      # HTML attribute rewrites
-      sub_filter href=\"/ href=\"%%ingress_entry%%/;
-      sub_filter src=\"/ src=\"%%ingress_entry%%/;
-      sub_filter src=\"'/ src=\"'%%ingress_entry%%/;
-      sub_filter action=\"/ action=\"%%ingress_entry%%/;
-
-      # JavaScript string rewrites (needed for Vite dynamic imports)
+      # JS string-literal rewrites — paths embedded in JS code are not
+      # touched by upstream's HTML rewriter, so we patch them here.
      sub_filter EventSource('/ EventSource('%%ingress_entry%%/;
      sub_filter fetch('/ fetch('%%ingress_entry%%/;
-
-      # Backtick template literal rewrites
      sub_filter `/api/v `%%ingress_entry%%/api/v;
      sub_filter "'/api/v" "'%%ingress_entry%%/api/v";
      sub_filter \"/api/v \"%%ingress_entry%%/api/v;
@@ -53,8 +49,6 @@ server {
      sub_filter `/asset `%%ingress_entry%%/asset;
      sub_filter "'/asset" "'%%ingress_entry%%/asset";
      sub_filter \"/asset \"%%ingress_entry%%/asset;
-
-      # Streaming/EventSource fix
      sub_filter window.location.origin} window.location.origin}%%ingress_entry%%;
    }
 }