fix(birdnet-pipy): build ingress.conf from the server block only

Upstream 0.8.2 added http-level limit_req_zone directives to its
nginx.conf. The ingress config was a wholesale copy of that file, and
both land in the same http context via servers/*.conf — nginx refuses
to declare a named shared-memory zone twice and dies at startup with
'limit_req_zone "api_rl" already bound' (502 on every page). Extract
everything from the column-0 "server {" onward instead, so maps and
zones stay declared once; zone/variable references resolve across
included files regardless of include order. Also comment out the new
Content-Security-Policy header in the ingress copy, matching the
existing X-* handling.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016acGazhHvyCNUFt71xzFxm

birdnet-pipy/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 0.8.2-1 (2026-07-04)
+- Fix nginx failing to start with `limit_req_zone "api_rl" already bound` (502 on every page, Suncuss/BirdNET-PiPy#59). Upstream 0.8.2 added http-level rate-limit zones, and the ingress config was generated as a full copy of nginx.conf — duplicating those declarations in the shared http context. `ingress.conf` is now built from the `server` block only, so http-level directives stay declared once.
+- Comment out the new upstream Content-Security-Policy header in ingress mode, matching the existing X-* security-header handling (ingress runs inside Home Assistant's authenticated frame; direct access keeps the full CSP).
+
 ## 0.8.2 (2026-07-04)
 - Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
  

birdnet-pipy/config.yaml

@@ -96,4 +96,4 @@ schema:
   ssl: bool?
 slug: birdnet-pipy
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
-version: "0.8.2"
+version: "0.8.2-1"

birdnet-pipy/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -24,11 +24,18 @@ if ! [[ "${ingress_port}" =~ ^[0-9]+$ ]] || [[ "${ingress_port}" -le 0 ]]; then
     exit 0
 fi
 
-cp /etc/nginx/servers/nginx.conf /etc/nginx/servers/ingress.conf
+# Build the ingress server from the server block ONLY. Both files in
+# servers/ are included into one http context, so http-level directives
+# (map, limit_req_zone, ...) must stay declared once, in nginx.conf — a
+# duplicated limit_req_zone is a fatal "already bound" error and nginx
+# never starts (502 on every page). Upstream keeps all http-level
+# directives above its single column-0 "server {".
+sed -n '/^server {/,$p' /etc/nginx/servers/nginx.conf > /etc/nginx/servers/ingress.conf
 sed -i \
     -e "s|listen 80;|listen ${ingress_interface}:${ingress_port} default_server;|g" \
     -e "/index index.html;/a\\    include /etc/nginx/includes/ingress_params.conf;" \
     -e 's|^[[:space:]]*add_header X|#&|g' \
+    -e 's|^[[:space:]]*add_header Content-Security-Policy|#&|g' \
     /etc/nginx/servers/ingress.conf
 
 sed -i "s#%%ingress_entry%%#${ingress_entry}#g" /etc/nginx/includes/ingress_params.conf