fix(birdnet-pi): restore the ingress Caddy site (502 Bad Gateway) (#2931)

* fix(birdnet-pi): restore the ingress Caddy site, ingress returned 502

nginx forwards ingress traffic to 127.0.0.1:8082 (rootfs/etc/nginx/servers/
ingress.conf:11), a site appended to the Caddyfile by helpers/caddy_ingress.sh.
The upstream script $HOME/BirdNET-Pi/scripts/update_caddyfile.sh regenerates
/etc/caddy/Caddyfile from scratch and 02-caddy.sh runs it immediately before
`exec caddy run`, so 91-nginx_ingress.sh injected a call to caddy_ingress.sh
into that script to re-add the site. The injection was anchored on
`sudo caddy fmt --overwrite`.

Since 2026.07.10-1 the Dockerfile strips `sudo ` from every BirdNET-Pi script at
build time (Dockerfile:110), so the shipped line is `caddy fmt --overwrite` and
the anchor stopped matching. sed reports success when a pattern matches nothing,
so this failed silently: Caddy came up listening only on :8081 and every ingress
request got connection-refused on 8082. Confirmed by extracting the script from
the published ghcr.io/alexbelgium/birdnet-pi-amd64 image - it contains no `sudo`.

- 91-nginx_ingress.sh: make the anchor accept the line with or without `sudo`,
  skip the injection when it is already there (cont-init re-runs on restart),
  and verify afterwards, falling back to appending the call if the anchor is
  ever gone again.
- caddy_ingress.sh: return early when a `:8082` site already exists. The script
  now runs from more than one place, and a duplicate site address makes Caddy
  refuse to start.
- 02-caddy.sh: re-add the ingress site just before starting Caddy if it is
  missing, so a future upstream change to update_caddyfile.sh cannot silently
  bring back the 502.
- 91-nginx_ingress.sh: drop /ingress_url when ingress is off, so that marker is
  a truthful signal for the check above even across an in-container restart.

Verified with a harness that replays the boot sequence (build-time sudo strip,
81-modifications.sh, 91-nginx_ingress.sh, 02-caddy.sh) against the real upstream
update_caddyfile.sh: master ends with no :8082 site, this branch ends with
exactly one, on fresh boot, on restart, and when the `caddy fmt` anchor is
removed entirely; standalone mode still gets no ingress site.

Closes #2928

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(birdnet-pi): harden the ingress-site recovery check in 02-caddy.sh

Review feedback on the pre-start check:

- Require /etc/caddy/Caddyfile to exist and silence grep's stderr. `! grep` is
  also true for grep's exit code 2, so an unreadable or missing Caddyfile read
  as "ingress site missing" and would have produced an ingress-only Caddyfile
  out of an error state. Letting caddy fail on the missing config is easier to
  diagnose.
- Report a failure of caddy_ingress.sh instead of swallowing it. Do not exit:
  /custom-services.d scripts are LSIO longruns that s6 restarts when they
  return, so exiting would flap the service and take the WebUI down on 8081 as
  well, which is strictly worse than ingress alone being broken.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

birdnet-pi/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 2026.08.02 (02-08-2026)
+- Fix: ingress returned "502 Bad Gateway" because Caddy never listened on :8082. `91-nginx_ingress.sh` hooked the ingress site into `update_caddyfile.sh` with a sed anchored on `sudo caddy fmt --overwrite`, but 2026.07.10-1 strips `sudo` from every BirdNET-Pi script at build time, so the anchor stopped matching. `update_caddyfile.sh` then rewrote the Caddyfile from scratch just before Caddy started, dropping the ingress site
+- Fix: `caddy_ingress.sh` no longer appends a second `:8082` block when it runs twice (a duplicate site address makes Caddy refuse to start)
+- Fix: `02-caddy.sh` re-adds the ingress site if it is missing from the Caddyfile just before starting Caddy
 ## 2026.07.22 (22-07-2026)
 - Fix: health-check the WebUI port (8081) instead of port 80, so the standalone Docker container no longer reports "unhealthy" when ssl=false
 - Fix: health-check now probes https when ssl is enabled, and no longer silently reports "healthy" regardless of the actual result (the previous check's `&>` redirection is a bash-ism that dash, the image's /bin/sh, parses as background + no-op, discarding curl's exit status)

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.07.22
+version: 2026.08.02
 video: true

birdnet-pi/rootfs/custom-services.d/02-caddy.sh

@@ -25,5 +25,24 @@ export TZ="${TZ_VALUE:-Etc/UTC}"
 # Update caddyfile with password
 "$HOME"/BirdNET-Pi/scripts/update_caddyfile.sh &> /dev/null || true
 
+# update_caddyfile.sh rewrites the Caddyfile from scratch. 91-nginx_ingress.sh
+# hooks the ingress site back into it, but if that hook ever fails to apply,
+# caddy would start without a :8082 listener and ingress would answer 502.
+# 91-nginx_ingress.sh writes /ingress_url when ingress is on and removes it when
+# it is off, so this is a no-op in standalone mode.
+# Require the Caddyfile to exist: if it is missing something went badly wrong
+# earlier, and caddy failing on a missing config is easier to diagnose than an
+# ingress-only Caddyfile conjured up here.
+if [[ -f /ingress_url ]] && [[ -f /etc/caddy/Caddyfile ]] \
+    && ! grep -qE '^[[:space:]]*:8082[[:space:]]*\{' /etc/caddy/Caddyfile 2> /dev/null; then
+    echo "Ingress site missing from the Caddyfile, re-adding it"
+    if ! /helpers/caddy_ingress.sh; then
+        # Start caddy anyway: ingress stays broken, but direct access on 8081
+        # keeps working. Exiting here would only make s6 restart this service in
+        # a loop and take the WebUI down completely.
+        echo "Failed to re-add the ingress site, the ingress panel will return 502" >&2
+    fi
+fi
+
 echo "Starting service: caddy"
 exec /usr/bin/caddy run --config /etc/caddy/Caddyfile

birdnet-pi/rootfs/etc/cont-init.d/91-nginx_ingress.sh

@@ -26,6 +26,10 @@ ingress_entry=$(bashio::addon.ingress_entry)
 if [[ "$ingress_entry" != "/api"* ]]; then
     bashio::log.info "Ingress entry is not set, exiting configuration."
     sed -i "1a sleep infinity" /custom-services.d/02-nginx.sh
+    # This script re-runs from /etc/scripts-init on an add-on restart, so drop
+    # any marker left by an earlier run: it is what 02-caddy.sh reads to decide
+    # whether the ingress site belongs in the Caddyfile.
+    rm -f /ingress_url
     exit 0
 fi
 
@@ -68,9 +72,23 @@ sed -i "s|localhost|localhost:8082|g" "$HOME/BirdNET-Pi/scripts/utils/notificati
 
 # Update the Caddyfile if update script exists
 caddy_update_script="$HOME/BirdNET-Pi/scripts/update_caddyfile.sh"
-if [ -f "$caddy_update_script" ]; then
+if [ ! -f "$caddy_update_script" ]; then
-    sed -i "/sudo caddy fmt --overwrite/i /helpers/caddy_ingress.sh" "$caddy_update_script"
-else
     bashio::log.error "Caddy update script not found: $caddy_update_script"
     exit 1
 fi
+
+# update_caddyfile.sh rewrites /etc/caddy/Caddyfile from scratch, which drops
+# the ingress site added just above. 02-caddy.sh runs it right before starting
+# caddy, so the hook below has to re-add the site from inside that script, just
+# before it formats and reloads the config.
+# The anchor must not require "sudo": the Dockerfile strips it from every
+# BirdNET-Pi script at build time, so the shipped line is "caddy fmt --overwrite".
+if ! grep -qF "/helpers/caddy_ingress.sh" "$caddy_update_script"; then
+    sed -i -E "/^[[:space:]]*(sudo[[:space:]]+)?caddy[[:space:]]+fmt[[:space:]]+--overwrite/i /helpers/caddy_ingress.sh" "$caddy_update_script"
+fi
+
+# sed is silent when the anchor is missing; make sure the hook is really there
+if ! grep -qF "/helpers/caddy_ingress.sh" "$caddy_update_script"; then
+    bashio::log.warning "Could not anchor the ingress site in $caddy_update_script, appending it instead"
+    printf '\n/helpers/caddy_ingress.sh\n' >> "$caddy_update_script"
+fi

birdnet-pi/rootfs/helpers/caddy_ingress.sh

@@ -6,6 +6,13 @@ set +u
 # shellcheck disable=SC1091
 source /etc/birdnet/birdnet.conf
 
+# Nothing to do if the ingress site is already there. This script runs both from
+# cont-init and from update_caddyfile.sh, and a duplicate ":8082" site address
+# makes caddy refuse to start.
+if grep -qE '^[[:space:]]*:8082[[:space:]]*\{' /etc/caddy/Caddyfile 2> /dev/null; then
+    exit 0
+fi
+
 # Create ingress configuration for Caddyfile
 cat << EOF >> /etc/caddy/Caddyfile
 :8082 {