From 9bfad91d7b010391a79c76a3b9d3e760a660fac5 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 10:43:52 +0200 Subject: [PATCH] fix(birdnet-pi): health-check the WebUI port, drop inert abc sudoers Standalone Docker (no Supervisor) disables nginx and serves the WebUI via Caddy on 8081; nothing listens on port 80 when ssl=false, so the Docker HEALTHCHECK failed and the container reported "unhealthy" although it worked. Point HEALTH_PORT at 8081. HA mode is unaffected (Supervisor ignores Docker health-checks). Also drop rootfs/etc/sudoers.d/birdnet-abc-systemctl. A chroot boot harness against the published image confirmed the standalone container already boots and serves the WebUI (HTTP 200), and that nothing ever runs as the `abc` user: pi has `NOPASSWD:ALL` and caddy has NOPASSWD:ALL via the pre-existing 010_caddy-nopasswd drop-in, so the abc rule was valid but inert. Co-Authored-By: Claude Opus 4.8 --- birdnet-pi/CHANGELOG.md | 2 ++ birdnet-pi/Dockerfile | 5 ++++- birdnet-pi/config.yaml | 2 +- birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl | 3 --- 4 files changed, 7 insertions(+), 5 deletions(-) delete mode 100644 birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl diff --git a/birdnet-pi/CHANGELOG.md b/birdnet-pi/CHANGELOG.md index 535298e0fc..0015dfec38 100644 --- a/birdnet-pi/CHANGELOG.md +++ b/birdnet-pi/CHANGELOG.md @@ -1,3 +1,5 @@ +## 2026.07.22 (22-07-2026) +- Fix: health-check the WebUI port (8081) instead of port 80, so the standalone Docker container no longer reports "unhealthy" when ssl=false ## 2026.07.10 (10-07-2026) - Minor bugs fixed ## 2026.06.01 (19-06-2026) diff --git a/birdnet-pi/Dockerfile b/birdnet-pi/Dockerfile index 44d1703689..5d3a3ab477 100644 --- a/birdnet-pi/Dockerfile +++ b/birdnet-pi/Dockerfile @@ -238,7 +238,10 @@ RUN \ mv /etc/nginx/nginx.conf.new /etc/nginx/nginx.conf; \ fi -ENV HEALTH_PORT="80" \ +# Health-check the actual WebUI port. In standalone Docker (no Supervisor) nginx +# is disabled and Caddy serves the UI on 8081; nothing listens on port 80 when +# ssl=false, which made the container report "unhealthy" even though it worked. +ENV HEALTH_PORT="8081" \ HEALTH_URL="" HEALTHCHECK \ --interval=5s \ diff --git a/birdnet-pi/config.yaml b/birdnet-pi/config.yaml index 42b148b948..7b86eb67f0 100644 --- a/birdnet-pi/config.yaml +++ b/birdnet-pi/config.yaml @@ -116,5 +116,5 @@ tmpfs: true udev: true url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi usb: true -version: 2026.07.10 +version: 2026.07.22 video: true diff --git a/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl b/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl deleted file mode 100644 index 9913d6f5f1..0000000000 --- a/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl +++ /dev/null @@ -1,3 +0,0 @@ -# BirdNET-Pi's upstream restart_services.sh is executed by the LinuxServer abc user. -# Permit only the container-local systemctl replacement required to manage BirdNET services. -abc ALL=(root) NOPASSWD: /bin/systemctl, /usr/bin/systemctl