From 32765daf998c6955b83f6ab20f2d60382f1af65e Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Thu, 16 Jul 2026 17:41:00 +0200
Subject: [PATCH] fix(claude_desktop): proxy Selkies API websocket in ingress

---
 .../rootfs/etc/cont-init.d/90-ingress.sh      | 109 +++++++++++++++---
 1 file changed, 90 insertions(+), 19 deletions(-)

diff --git a/claude_desktop/rootfs/etc/cont-init.d/90-ingress.sh b/claude_desktop/rootfs/etc/cont-init.d/90-ingress.sh
index 6d3074e901..7bd828bd2f 100755
--- a/claude_desktop/rootfs/etc/cont-init.d/90-ingress.sh
+++ b/claude_desktop/rootfs/etc/cont-init.d/90-ingress.sh
@@ -4,34 +4,105 @@ set -e
 
 NGINX_CONFIG=/etc/nginx/sites-available/ingress.conf
 SUBFOLDER="$(bashio::addon.ingress_entry)"
+INGRESS_PORT="$(bashio::addon.ingress_port)"
+DOWNLOADS_PATH="${HOME:-/config}"
 
-# Ensure subfolder ends with a trailing slash (except for root)
+# Home Assistant normally strips the ingress prefix before forwarding to the add-on,
+# but keep the normalized value available for diagnostics and future-safe logging.
 if [[ -n "${SUBFOLDER}" && "${SUBFOLDER}" != "/" ]]; then
     [[ "${SUBFOLDER}" == */ ]] || SUBFOLDER="${SUBFOLDER}/"
 else
     SUBFOLDER="/"
 fi
 
-cp /defaults/default.conf "${NGINX_CONFIG}"
+# Claude Desktop exposes only 3001/tcp in config.yaml. Older Supervisor/bashio
+# combinations can return an empty ingress_port when it is not explicit, which would
+# make nginx write an invalid `listen` directive. Fall back to the declared port.
+if [[ -z "${INGRESS_PORT}" ]]; then
+    INGRESS_PORT="3001"
+fi
 
-# Keep only the first (non-SSL) server block
-awk -v n=2 '/^[[:space:]]*server[[:space:]]*\{/{n--} n>0' "${NGINX_CONFIG}" > tmpfile
-mv tmpfile "${NGINX_CONFIG}"
+DOWNLOADS_PATH="${DOWNLOADS_PATH%/}"
 
-# Disable IPv6 listeners for ingress proxying
-sed -i '/listen \[::\]/d' "${NGINX_CONFIG}"
+cat > "${NGINX_CONFIG}" <<EOF
+server {
+  listen ${INGRESS_PORT} default_server;
+  client_max_body_size 10M;
 
-# Adapt ports and upstream paths for Home Assistant ingress
-sed -i "s|3000|$(bashio::addon.ingress_port)|g" "${NGINX_CONFIG}"
-sed -i "s|SUBFOLDER|/|g" "${NGINX_CONFIG}"
-sed -i "s|CWS|8082|g" "${NGINX_CONFIG}"
-sed -i "s|REPLACE_HOME|${HOME:-/root}|g" "${NGINX_CONFIG}"
-sed -i "s|REPLACE_DOWNLOADS_PATH|${HOME:-/config}|g" "${NGINX_CONFIG}"
-sed -i '/proxy_buffering/a proxy_set_header Accept-Encoding "";' "${NGINX_CONFIG}"
-sed -i '/proxy_buffering/a sub_filter_once off;' "${NGINX_CONFIG}"
-sed -i '/proxy_buffering/a sub_filter_types *;' "${NGINX_CONFIG}"
-sed -i '/proxy_buffering/a sub_filter "vnc/index.html?autoconnect" "vnc/index.html?path=%%path%%/websockify?autoconnect";' "${NGINX_CONFIG}"
-sed -i "s|%%path%%|${SUBFOLDER:1}|g" "${NGINX_CONFIG}"
+  location / {
+    alias /usr/share/selkies/web/;
+    index index.html index.htm;
+    try_files \$uri \$uri/ /index.html;
+  }
+
+  location /devmode {
+    proxy_set_header        Upgrade \$http_upgrade;
+    proxy_set_header        Connection "upgrade";
+    proxy_set_header        Host \$host;
+    proxy_set_header        X-Real-IP \$remote_addr;
+    proxy_set_header        X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header        X-Forwarded-Proto \$scheme;
+    proxy_http_version      1.1;
+    proxy_read_timeout      3600s;
+    proxy_send_timeout      3600s;
+    proxy_connect_timeout   3600s;
+    proxy_buffering         off;
+    proxy_set_header        Accept-Encoding "";
+    proxy_pass              http://127.0.0.1:5173;
+  }
+
+  # Current Selkies WebSocket mode connects to <base>/api/websockets.
+  # The older linuxserver default.conf only proxies /websocket, leaving the
+  # dashboard loaded but stuck on "waiting for stream" under Home Assistant ingress.
+  location /api/ {
+    proxy_set_header        Upgrade \$http_upgrade;
+    proxy_set_header        Connection "upgrade";
+    proxy_set_header        Host \$host;
+    proxy_set_header        X-Real-IP \$remote_addr;
+    proxy_set_header        X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header        X-Forwarded-Proto \$scheme;
+    proxy_http_version      1.1;
+    proxy_read_timeout      3600s;
+    proxy_send_timeout      3600s;
+    proxy_connect_timeout   3600s;
+    proxy_buffering         off;
+    proxy_set_header        Accept-Encoding "";
+    proxy_pass              http://127.0.0.1:8082;
+  }
+
+  # Keep compatibility with older Selkies/noVNC clients and linuxserver templates.
+  location /websocket {
+    proxy_set_header        Upgrade \$http_upgrade;
+    proxy_set_header        Connection "upgrade";
+    proxy_set_header        Host \$host;
+    proxy_set_header        X-Real-IP \$remote_addr;
+    proxy_set_header        X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header        X-Forwarded-Proto \$scheme;
+    proxy_http_version      1.1;
+    proxy_read_timeout      3600s;
+    proxy_send_timeout      3600s;
+    proxy_connect_timeout   3600s;
+    proxy_buffering         off;
+    proxy_set_header        Accept-Encoding "";
+    proxy_pass              http://127.0.0.1:8082;
+  }
+
+  location /files {
+    fancyindex on;
+    fancyindex_footer /nginx/footer.html;
+    fancyindex_header /nginx/header.html;
+    alias ${DOWNLOADS_PATH}/;
+    if (-f \$request_filename) {
+      add_header Content-Disposition "attachment";
+      add_header X-Content-Type-Options "nosniff";
+    }
+  }
+
+  error_page 500 502 503 504 /50x.html;
+  location = /50x.html {
+    root /usr/share/selkies/web/;
+  }
+}
+EOF
 
-# Avoid content encoding on proxied responses to keep Selkies happy (handled by proxy_set_header Accept-Encoding insertion above)
 cp "${NGINX_CONFIG}" /etc/nginx/sites-enabled