Fix Bazarr ingress: keep redirects relative so they aren't blocked as mixed content (#2910)

* Fix Bazarr ingress: keep redirects relative so they aren't blocked as mixed content

Opening the Bazarr panel over HTTPS failed with:

  Mixed Content: ... requested an insecure frame
  'http://<ha_host>:8099/bazarr/'. This request has been blocked

Bazarr is Flask-based and answers /bazarr (the ingress entry, which has no
trailing slash) with a redirect to /bazarr/, made absolute against the Host
nginx sends upstream -- http://127.0.0.1:6767/bazarr/. proxy_redirect's
implicit "default" rule strips that prefix, which makes nginx treat the
Location as its own; the header filter then re-absolutises it as
$scheme://$host:$server_port/... Since $host is the browser's host forwarded
by the Supervisor and $server_port is the ingress port (8099, the Supervisor
default as no ingress_port is declared), the result is a plain-http URL on a
port the browser refuses to frame from an https page.

absolute_redirect off keeps the Location relative, and the proxy_redirect
rules re-prefix it with the ingress entry so it resolves under
/api/hassio_ingress/<token>/. The second rule also covers backends that emit
an already-relative Location; external absolute redirects match neither rule
and pass through untouched.

Verified against a local nginx with a stand-in backend: the pre-fix config
reproduces http://<host>:<ingress_port>/bazarr/ exactly, and the fixed config
returns /api/hassio_ingress/<token>/bazarr/ for both absolute and relative
upstream Locations while leaving an external redirect alone.

Also fixes the fallback base_url in services.d/nginx/run, which wrote it
without the leading / and so reintroduced the startup crash fixed in 1.5.6-4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Tighten base_url guard in nginx run script to require the leading slash

CodeRabbit review on #2910: the guard `grep -q "base_url.*$slug"` matches
both "base_url: bazarr" and "base_url: /bazarr" -- the .* swallows the slash
-- so it treated the malformed no-slash form as already correct and never
triggered the repair. Require the literal "base_url: /$slug" instead, so a
config missing the slash is actually detected and fixed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

bazarr/CHANGELOG.md

@@ -1,4 +1,9 @@
 
+## 1.6.0.1 (2026-07-27)
+
+- Fix ingress: nginx rewrote Bazarr's redirects into an absolute `http://<host>:8099/...` URL, which the browser blocked as mixed content when Home Assistant is served over HTTPS. Redirects now stay relative and point at the ingress path
+- Fix fallback base_url in the nginx service script missing its leading `/`, which crashed Bazarr on startup
+
 ## 1.6.0 (2026-07-08)
 
 - Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)

bazarr/config.yaml

@@ -112,4 +112,4 @@ schema:
 slug: bazarr_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/bazarr
-version: "1.6.0"
+version: "1.6.0.1"

bazarr/rootfs/etc/nginx/servers/ingress.conf

@@ -19,6 +19,19 @@ server {
        proxy_set_header Connection $http_connection;
        #auth_basic off;
 
+       # Adjust Location headers in backend redirects
+       # Bazarr is Flask-based and answers /bazarr with a redirect to /bazarr/,
+       # made absolute against the Host nginx sends upstream, so it reads
+       # http://127.0.0.1:6767/bazarr/. proxy_redirect strips that prefix, and
+       # nginx then re-absolutises the result as $scheme://$host:$server_port/...
+       # i.e. http://<ha_host>:8099/bazarr/ -- blocked by the browser as mixed
+       # content inside the ingress iframe. absolute_redirect off keeps it
+       # relative; the proxy_redirect rules re-prefix it with the ingress entry
+       # (the second rule also covers a redirect that was relative already).
+       absolute_redirect off; # Do not add port to redirect
+       proxy_redirect http://127.0.0.1:6767/ %%ingress_entry%%/;
+       proxy_redirect / %%ingress_entry%%/;
+
        # Correct base_url
        proxy_set_header Accept-Encoding "";
        sub_filter_once off;

bazarr/rootfs/etc/services.d/nginx/run

@@ -15,9 +15,10 @@ bashio::net.wait_for "$port" localhost 900
 if [ -f "$CONFIG_LOCATION" ]; then
     if ! bashio::config.true "ingress_disabled"; then
         if ! bashio::config.has_value "connection_mode" || [ "$(bashio::config 'connection_mode')" != "noingress_auth" ]; then
-            if ! grep -q "base_url.*$slug" "$CONFIG_LOCATION"; then
+            if ! grep -q "base_url: /$slug" "$CONFIG_LOCATION"; then
                 bashio::log.warning "BaseUrl not set properly, restarting"
-                sed -i "s/  base_url:.*/  base_url: $slug/" "$CONFIG_LOCATION"
+                # Must start with / for Flask blueprint registration
+                sed -i "s|  base_url:.*|  base_url: /$slug|" "$CONFIG_LOCATION"
                 bashio::addon.restart
             fi
         fi