fix(cleanuparr): make ingress work

The add-on declared `ingress: true` without `ingress_port`, so Supervisor
proxied the sidebar entry and "Open Web UI" to its default port 8099, where
nothing listened.

Pointing `ingress_port` at Cleanuparr's own port 11011 is not enough, and
setting Cleanuparr's `BASE_PATH` to the ingress entry is actively wrong: Home
Assistant strips the `/api/hassio_ingress/<token>` prefix before the request
reaches the container, while `BASE_PATH` makes Cleanuparr 404 every request
that does not carry the prefix and redirect `/` to it — an ingress redirect
loop.

Serve port 8099 with nginx instead, as many other add-ons in this repo already
do, and rewrite the one thing the browser gets wrong: the `_server_base_path`
value Cleanuparr injects into index.html, which its Angular frontend builds
every asset, API and SignalR URL from. The prefix is taken from the
`X-Ingress-Path` header Home Assistant Core sets on every ingress request, so
nothing has to be looked up or written at startup, and a request arriving
without that header is left alone. The application keeps serving from the root
on 11011, so direct access is untouched and no user-set option changes.

Fixes #3084

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cleanuparr/CHANGELOG.md

@@ -1,4 +1,12 @@
  
+## 2.10.6.1 (2026-09-23)
+- Fix ingress: the add-on declared `ingress: true` without `ingress_port`, so Home
+  Assistant proxied the sidebar entry and "Open Web UI" to the default port 8099,
+  where nothing listened. An nginx proxy now serves that port and rewrites the base
+  path Cleanuparr's web UI builds its asset, API and SignalR URLs from, so they
+  resolve under the ingress path instead of the Home Assistant root. Direct access
+  on port 11011 is unchanged (#3084)
+ 
 ## 2.10.6 (2026-09-19)
 - Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
 - Migrate legacy add-on configuration map names to current app configuration terminology.

cleanuparr/Dockerfile

@@ -36,6 +36,12 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
 # 3 Install apps #
 ##################
 
+# Install nginx, which proxies Home Assistant ingress (see rootfs/etc/nginx/nginx.conf).
+# Installed before the rootfs is copied so dpkg does not own our nginx.conf.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends nginx && \
+    rm -rf /var/lib/apt/lists/*
+
 # Add rootfs
 COPY rootfs/ /
 RUN find /. -type f \( -name "*.sh" \) -print -exec chmod +x {} \;

cleanuparr/config.yaml

@@ -91,5 +91,5 @@ schema:
   TZ: str?
 slug: cleanuparr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
-version: "2.10.6"
+version: "2.10.6.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"

cleanuparr/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,57 @@
+# Ingress proxy for Cleanuparr.
+#
+# Home Assistant serves the add-on under /api/hassio_ingress/<token>/ but strips
+# that prefix before the request reaches this container, passing it along in the
+# X-Ingress-Path header instead. Cleanuparr's own BASE_PATH option cannot be
+# used: it makes the application reject every request that does not carry the
+# prefix. So the prefix is put back into the page on its way out instead, and
+# the application keeps serving from the root on port 11011 for direct access.
+
+user root;
+pid /var/run/nginx.pid;
+worker_processes 1;
+error_log /dev/stderr error;
+
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log off;
+    client_max_body_size 0;
+    server_tokens off;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    # Requests that arrive without the header are not coming through ingress.
+    map $http_x_ingress_path $ingress_base_path {
+        default $http_x_ingress_path;
+        ''      /;
+    }
+
+    server {
+        listen 8099 default_server;
+
+        location / {
+            proxy_pass http://127.0.0.1:11011;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+
+            # Cleanuparr's index.html carries the base path its frontend builds
+            # every asset, API and SignalR URL from. Rewrite it to the ingress
+            # prefix so those URLs come back through ingress.
+            proxy_set_header Accept-Encoding "";
+            sub_filter_once off;
+            sub_filter "window['_server_base_path'] = '/';" "window['_server_base_path'] = '$ingress_base_path';";
+        }
+    }
+}

cleanuparr/rootfs/ha_entrypoint.sh

@@ -40,6 +40,11 @@ ln -sfn "$HA_DATA_DIR" /app/config
 
 chown -R "${PUID:-0}:${PGID:-0}" "$HA_DATA_DIR"
 
+# ─── Ingress proxy ───────────────────────────────────────────────────────────
+# See /etc/nginx/nginx.conf for why ingress needs a proxy at all.
+echo "[Cleanuparr] Starting ingress proxy on port 8099..."
+nginx
+
 # ─── Start Cleanuparr directly (bypass original /entrypoint.sh) ──────────────
 echo "[Cleanuparr] Starting application on port ${HTTP_PORTS:-11011}..."
 cd /app