BentoPDF: optional own TLS certificate from /ssl (#3126) (#3128)

* bentopdf: optional own TLS certificate from /ssl (#3126)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* bentopdf: fix add-on linter (HEALTHCHECK instead of watchdog, drop default stage/startup)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: BirdNET-Go Addon Builder <addon-builder@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

bentopdf/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.8.8.1 (18-10-2026)
+
+- Added `ssl`, `certfile` and `keyfile` options: when `ssl` is true, port 8443 serves your own certificate from `/ssl` (e.g. Let's Encrypt) instead of the self-signed one. Off by default, so nothing changes unless you enable it (#3126)
+- Replaced the obsolete Supervisor `watchdog` with a Docker `HEALTHCHECK` on the same endpoint. Also dropped `stage` and `startup`, which were set to their default values (add-on linter)
+
 ## 2.8.8 (03-09-2026)
 
 - Now builds upstream's Simple Mode release instead of the standard one. It leaves out the bentopdf.com marketing pages (nav bar, hero, features, FAQ, footer). Both builds carry the same 130 tool pages and the same LibreOffice WebAssembly payload, so the served payload just gets smaller: about 228 MB, down from about 258 MB.

bentopdf/DOCS.md

@@ -45,6 +45,9 @@ Yes. The certificate secures the connection between **your browser and your own
 | Option | Default | Description |
 |--------|---------|-------------|
 | `log_level` | `info` | Log verbosity: `info`, `debug`, `warn`, `error` |
+| `ssl` | `false` | Serve port 8443 with your own certificate from `/ssl` instead of the self-signed one |
+| `certfile` | `fullchain.pem` | Certificate file in `/ssl`, used when `ssl` is true |
+| `keyfile` | `privkey.pem` | Private key file in `/ssl`, used when `ssl` is true |
 
 ## Support
 

bentopdf/Dockerfile

@@ -1,6 +1,6 @@
 # Global build args — must be declared before the first FROM to be usable in FROM instructions
 ARG BUILD_FROM=ghcr.io/home-assistant/amd64-base:3.23
-ARG BUILD_VERSION=2.8.8
+ARG BUILD_VERSION=2.8.8.1
 # Upstream BentoPDF release to fetch. Tracked separately from BUILD_VERSION so
 # the add-on can carry a local patch counter (e.g. 2.8.8.1) without breaking the
 # release URLs, which only exist for real upstream tags.
@@ -43,3 +43,10 @@ LABEL \
   io.hass.arch="aarch64|amd64"
 
 ENTRYPOINT ["/init"]
+
+HEALTHCHECK \
+    --interval=5s \
+    --retries=5 \
+    --start-period=30s \
+    --timeout=25s \
+    CMD curl -s -f "http://127.0.0.1:8080/" >/dev/null || exit 1

bentopdf/README.md

@@ -101,6 +101,9 @@ A privacy-first PDF toolkit running entirely in your browser — no uploads, no
 | Option | Default | Description |
 |--------|---------|-------------|
 | `log_level` | `info` | Log verbosity: `info`, `debug`, `warn`, `error` |
+| `ssl` | `false` | Serve port 8443 with your own certificate from `/ssl` instead of the self-signed one |
+| `certfile` | `fullchain.pem` | Certificate file in `/ssl`, used when `ssl` is true |
+| `keyfile` | `privkey.pem` | Private key file in `/ssl`, used when `ssl` is true |
 
 No other configuration is needed. Drop your files in and go.
 

bentopdf/config.yaml

@@ -2,30 +2,36 @@ name: "BentoPDF"
 slug: bentopdf
 image: ghcr.io/alexbelgium/bentopdf-{arch}
 description: "Privacy-first PDF toolkit. 50+ tools, all processing client-side in the browser. Files never leave your device."
-version: "2.8.8"
+version: "2.8.8.1"
 url: "https://github.com/alexbelgium/hassio-addons/tree/master/bentopdf"
 arch:
   - amd64
   - aarch64
-startup: application
 init: false
-stage: stable
+
+map:
+  - ssl:ro
 
 ports:
   8080/tcp: 8080
   8443/tcp: 8443
 ports_description:
-  8080/tcp: "BentoPDF HTTP (watchdog / redirect to HTTPS)"
+  8080/tcp: "BentoPDF HTTP (healthcheck / redirect to HTTPS)"
   8443/tcp: "BentoPDF HTTPS Web UI"
 
 webui: "https://[HOST]:[PORT:8443]"
-watchdog: "http://[HOST]:[PORT:8080]/"
 
 panel_icon: mdi:file-pdf-box
 panel_title: BentoPDF
 
 options:
   log_level: "info"
+  ssl: false
+  certfile: fullchain.pem
+  keyfile: privkey.pem
 
 schema:
   log_level: list(info|debug|warn|error)
+  ssl: bool
+  certfile: str
+  keyfile: str

bentopdf/rootfs/etc/cont-init.d/50-ssl.sh

@@ -1,7 +1,16 @@
-#!/usr/bin/with-contenv bash
+#!/usr/bin/with-contenv bashio
 # shellcheck shell=bash
-# Generate a self-signed TLS certificate for HTTPS access on LAN.
-# The cert is stored under /config/bentopdf/ssl/ so it persists across restarts.
+# Serve HTTPS with the user's certificate from /ssl when `ssl` is enabled,
+# otherwise generate a self-signed one under /config/bentopdf/ssl/.
+
+if bashio::config.true 'ssl'; then
+    bashio::config.require.ssl
+    CERT="/ssl/$(bashio::config 'certfile')"
+    KEY="/ssl/$(bashio::config 'keyfile')"
+    sed -i "s|ssl_certificate .*;|ssl_certificate     ${CERT};|; s|ssl_certificate_key .*;|ssl_certificate_key ${KEY};|" /etc/nginx/nginx.conf
+    bashio::log.info "[50-ssl] Using certificate ${CERT}"
+    exit 0
+fi
 
 SSL_DIR=/config/bentopdf/ssl
 CERT="${SSL_DIR}/cert.pem"

bentopdf/rootfs/etc/nginx/nginx.conf

@@ -29,13 +29,14 @@ http {
     gzip_comp_level 9;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/wasm application/x-javascript text/x-component;
 
-    # HTTP on 8080 — redirect to HTTPS; root path returns 200 for HA watchdog
+    # HTTP on 8080 — redirect to HTTPS; root path returns 200 for the Docker healthcheck
     server {
         listen 8080;
         listen [::]:8080;
         server_name localhost;
 
         location = / {
+            access_log off;
             return 200 "ok";
         }
 

bentopdf/translations/en.yaml

@@ -2,6 +2,15 @@ configuration:
   log_level:
     name: Log level
     description: Controls the verbosity of add-on logging.
+  ssl:
+    name: Use own certificate
+    description: Serve port 8443 with your own certificate from /ssl.
+  certfile:
+    name: Certificate file
+    description: Certificate file in /ssl.
+  keyfile:
+    name: Key file
+    description: Private key file in /ssl.
 
 network:
   8080/tcp: Web UI port (direct access, not used for Ingress)