From 278eeb931bbcf462bb02b0be20de934002352199 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Mon, 27 Jul 2026 15:52:00 +0200 Subject: [PATCH] Fix Bazarr ingress: keep redirects relative so they aren't blocked as mixed content (#2910) * Fix Bazarr ingress: keep redirects relative so they aren't blocked as mixed content Opening the Bazarr panel over HTTPS failed with: Mixed Content: ... requested an insecure frame 'http://:8099/bazarr/'. This request has been blocked Bazarr is Flask-based and answers /bazarr (the ingress entry, which has no trailing slash) with a redirect to /bazarr/, made absolute against the Host nginx sends upstream -- http://127.0.0.1:6767/bazarr/. proxy_redirect's implicit "default" rule strips that prefix, which makes nginx treat the Location as its own; the header filter then re-absolutises it as $scheme://$host:$server_port/... Since $host is the browser's host forwarded by the Supervisor and $server_port is the ingress port (8099, the Supervisor default as no ingress_port is declared), the result is a plain-http URL on a port the browser refuses to frame from an https page. absolute_redirect off keeps the Location relative, and the proxy_redirect rules re-prefix it with the ingress entry so it resolves under /api/hassio_ingress//. The second rule also covers backends that emit an already-relative Location; external absolute redirects match neither rule and pass through untouched. Verified against a local nginx with a stand-in backend: the pre-fix config reproduces http://:/bazarr/ exactly, and the fixed config returns /api/hassio_ingress//bazarr/ for both absolute and relative upstream Locations while leaving an external redirect alone. Also fixes the fallback base_url in services.d/nginx/run, which wrote it without the leading / and so reintroduced the startup crash fixed in 1.5.6-4. Co-Authored-By: Claude Opus 5 * Tighten base_url guard in nginx run script to require the leading slash CodeRabbit review on #2910: the guard `grep -q "base_url.*$slug"` matches both "base_url: bazarr" and "base_url: /bazarr" -- the .* swallows the slash -- so it treated the malformed no-slash form as already correct and never triggered the repair. Require the literal "base_url: /$slug" instead, so a config missing the slash is actually detected and fixed. Co-Authored-By: Claude Opus 5 --------- Co-authored-by: Claude --- bazarr/CHANGELOG.md | 5 +++++ bazarr/config.yaml | 2 +- bazarr/rootfs/etc/nginx/servers/ingress.conf | 13 +++++++++++++ bazarr/rootfs/etc/services.d/nginx/run | 5 +++-- 4 files changed, 22 insertions(+), 3 deletions(-) diff --git a/bazarr/CHANGELOG.md b/bazarr/CHANGELOG.md index 11630808d2..10249b94b1 100644 --- a/bazarr/CHANGELOG.md +++ b/bazarr/CHANGELOG.md @@ -1,4 +1,9 @@ +## 1.6.0.1 (2026-07-27) + +- Fix ingress: nginx rewrote Bazarr's redirects into an absolute `http://:8099/...` URL, which the browser blocked as mixed content when Home Assistant is served over HTTPS. Redirects now stay relative and point at the ingress path +- Fix fallback base_url in the nginx service script missing its leading `/`, which crashed Bazarr on startup + ## 1.6.0 (2026-07-08) - Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases) diff --git a/bazarr/config.yaml b/bazarr/config.yaml index 74363800e6..0ad56e4885 100644 --- a/bazarr/config.yaml +++ b/bazarr/config.yaml @@ -112,4 +112,4 @@ schema: slug: bazarr_nas udev: true url: https://github.com/alexbelgium/hassio-addons/tree/master/bazarr -version: "1.6.0" +version: "1.6.0.1" diff --git a/bazarr/rootfs/etc/nginx/servers/ingress.conf b/bazarr/rootfs/etc/nginx/servers/ingress.conf index 95f57fca46..01eb1ab00f 100644 --- a/bazarr/rootfs/etc/nginx/servers/ingress.conf +++ b/bazarr/rootfs/etc/nginx/servers/ingress.conf @@ -19,6 +19,19 @@ server { proxy_set_header Connection $http_connection; #auth_basic off; + # Adjust Location headers in backend redirects + # Bazarr is Flask-based and answers /bazarr with a redirect to /bazarr/, + # made absolute against the Host nginx sends upstream, so it reads + # http://127.0.0.1:6767/bazarr/. proxy_redirect strips that prefix, and + # nginx then re-absolutises the result as $scheme://$host:$server_port/... + # i.e. http://:8099/bazarr/ -- blocked by the browser as mixed + # content inside the ingress iframe. absolute_redirect off keeps it + # relative; the proxy_redirect rules re-prefix it with the ingress entry + # (the second rule also covers a redirect that was relative already). + absolute_redirect off; # Do not add port to redirect + proxy_redirect http://127.0.0.1:6767/ %%ingress_entry%%/; + proxy_redirect / %%ingress_entry%%/; + # Correct base_url proxy_set_header Accept-Encoding ""; sub_filter_once off; diff --git a/bazarr/rootfs/etc/services.d/nginx/run b/bazarr/rootfs/etc/services.d/nginx/run index 94c657e39c..daf1d3739b 100644 --- a/bazarr/rootfs/etc/services.d/nginx/run +++ b/bazarr/rootfs/etc/services.d/nginx/run @@ -15,9 +15,10 @@ bashio::net.wait_for "$port" localhost 900 if [ -f "$CONFIG_LOCATION" ]; then if ! bashio::config.true "ingress_disabled"; then if ! bashio::config.has_value "connection_mode" || [ "$(bashio::config 'connection_mode')" != "noingress_auth" ]; then - if ! grep -q "base_url.*$slug" "$CONFIG_LOCATION"; then + if ! grep -q "base_url: /$slug" "$CONFIG_LOCATION"; then bashio::log.warning "BaseUrl not set properly, restarting" - sed -i "s/ base_url:.*/ base_url: $slug/" "$CONFIG_LOCATION" + # Must start with / for Flask blueprint registration + sed -i "s| base_url:.*| base_url: /$slug|" "$CONFIG_LOCATION" bashio::addon.restart fi fi