From a6e2612c9a0ecb61af6f9ae18eb99a5a318ee8a4 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Sun, 18 Oct 2026 10:36:49 +0300 Subject: [PATCH] BentoPDF: optional own TLS certificate from /ssl (#3126) (#3128) * bentopdf: optional own TLS certificate from /ssl (#3126) Co-Authored-By: Claude Opus 5.5 * bentopdf: fix add-on linter (HEALTHCHECK instead of watchdog, drop default stage/startup) Co-Authored-By: Claude Opus 5.5 --------- Co-authored-by: BirdNET-Go Addon Builder Co-authored-by: Claude Opus 5.5 --- bentopdf/CHANGELOG.md | 5 +++++ bentopdf/DOCS.md | 3 +++ bentopdf/Dockerfile | 9 ++++++++- bentopdf/README.md | 3 +++ bentopdf/config.yaml | 16 +++++++++++----- bentopdf/rootfs/etc/cont-init.d/50-ssl.sh | 15 ++++++++++++--- bentopdf/rootfs/etc/nginx/nginx.conf | 3 ++- bentopdf/translations/en.yaml | 9 +++++++++ 8 files changed, 53 insertions(+), 10 deletions(-) diff --git a/bentopdf/CHANGELOG.md b/bentopdf/CHANGELOG.md index 6975793deb..92bbfa6eab 100644 --- a/bentopdf/CHANGELOG.md +++ b/bentopdf/CHANGELOG.md @@ -1,3 +1,8 @@ +## 2.8.8.1 (18-10-2026) + +- Added `ssl`, `certfile` and `keyfile` options: when `ssl` is true, port 8443 serves your own certificate from `/ssl` (e.g. Let's Encrypt) instead of the self-signed one. Off by default, so nothing changes unless you enable it (#3126) +- Replaced the obsolete Supervisor `watchdog` with a Docker `HEALTHCHECK` on the same endpoint. Also dropped `stage` and `startup`, which were set to their default values (add-on linter) + ## 2.8.8 (03-09-2026) - Now builds upstream's Simple Mode release instead of the standard one. It leaves out the bentopdf.com marketing pages (nav bar, hero, features, FAQ, footer). Both builds carry the same 130 tool pages and the same LibreOffice WebAssembly payload, so the served payload just gets smaller: about 228 MB, down from about 258 MB. diff --git a/bentopdf/DOCS.md b/bentopdf/DOCS.md index ab2a7a5965..2b07753479 100644 --- a/bentopdf/DOCS.md +++ b/bentopdf/DOCS.md @@ -45,6 +45,9 @@ Yes. The certificate secures the connection between **your browser and your own | Option | Default | Description | |--------|---------|-------------| | `log_level` | `info` | Log verbosity: `info`, `debug`, `warn`, `error` | +| `ssl` | `false` | Serve port 8443 with your own certificate from `/ssl` instead of the self-signed one | +| `certfile` | `fullchain.pem` | Certificate file in `/ssl`, used when `ssl` is true | +| `keyfile` | `privkey.pem` | Private key file in `/ssl`, used when `ssl` is true | ## Support diff --git a/bentopdf/Dockerfile b/bentopdf/Dockerfile index c7d7a1c9c3..2304cdcbbc 100644 --- a/bentopdf/Dockerfile +++ b/bentopdf/Dockerfile @@ -1,6 +1,6 @@ # Global build args — must be declared before the first FROM to be usable in FROM instructions ARG BUILD_FROM=ghcr.io/home-assistant/amd64-base:3.23 -ARG BUILD_VERSION=2.8.8 +ARG BUILD_VERSION=2.8.8.1 # Upstream BentoPDF release to fetch. Tracked separately from BUILD_VERSION so # the add-on can carry a local patch counter (e.g. 2.8.8.1) without breaking the # release URLs, which only exist for real upstream tags. @@ -43,3 +43,10 @@ LABEL \ io.hass.arch="aarch64|amd64" ENTRYPOINT ["/init"] + +HEALTHCHECK \ + --interval=5s \ + --retries=5 \ + --start-period=30s \ + --timeout=25s \ + CMD curl -s -f "http://127.0.0.1:8080/" >/dev/null || exit 1 diff --git a/bentopdf/README.md b/bentopdf/README.md index 614080cac0..8d1e4c6080 100644 --- a/bentopdf/README.md +++ b/bentopdf/README.md @@ -101,6 +101,9 @@ A privacy-first PDF toolkit running entirely in your browser — no uploads, no | Option | Default | Description | |--------|---------|-------------| | `log_level` | `info` | Log verbosity: `info`, `debug`, `warn`, `error` | +| `ssl` | `false` | Serve port 8443 with your own certificate from `/ssl` instead of the self-signed one | +| `certfile` | `fullchain.pem` | Certificate file in `/ssl`, used when `ssl` is true | +| `keyfile` | `privkey.pem` | Private key file in `/ssl`, used when `ssl` is true | No other configuration is needed. Drop your files in and go. diff --git a/bentopdf/config.yaml b/bentopdf/config.yaml index b8effdbe9d..9a12852b8a 100644 --- a/bentopdf/config.yaml +++ b/bentopdf/config.yaml @@ -2,30 +2,36 @@ name: "BentoPDF" slug: bentopdf image: ghcr.io/alexbelgium/bentopdf-{arch} description: "Privacy-first PDF toolkit. 50+ tools, all processing client-side in the browser. Files never leave your device." -version: "2.8.8" +version: "2.8.8.1" url: "https://github.com/alexbelgium/hassio-addons/tree/master/bentopdf" arch: - amd64 - aarch64 -startup: application init: false -stage: stable + +map: + - ssl:ro ports: 8080/tcp: 8080 8443/tcp: 8443 ports_description: - 8080/tcp: "BentoPDF HTTP (watchdog / redirect to HTTPS)" + 8080/tcp: "BentoPDF HTTP (healthcheck / redirect to HTTPS)" 8443/tcp: "BentoPDF HTTPS Web UI" webui: "https://[HOST]:[PORT:8443]" -watchdog: "http://[HOST]:[PORT:8080]/" panel_icon: mdi:file-pdf-box panel_title: BentoPDF options: log_level: "info" + ssl: false + certfile: fullchain.pem + keyfile: privkey.pem schema: log_level: list(info|debug|warn|error) + ssl: bool + certfile: str + keyfile: str diff --git a/bentopdf/rootfs/etc/cont-init.d/50-ssl.sh b/bentopdf/rootfs/etc/cont-init.d/50-ssl.sh index b418c6ffb5..8c0d608f27 100755 --- a/bentopdf/rootfs/etc/cont-init.d/50-ssl.sh +++ b/bentopdf/rootfs/etc/cont-init.d/50-ssl.sh @@ -1,7 +1,16 @@ -#!/usr/bin/with-contenv bash +#!/usr/bin/with-contenv bashio # shellcheck shell=bash -# Generate a self-signed TLS certificate for HTTPS access on LAN. -# The cert is stored under /config/bentopdf/ssl/ so it persists across restarts. +# Serve HTTPS with the user's certificate from /ssl when `ssl` is enabled, +# otherwise generate a self-signed one under /config/bentopdf/ssl/. + +if bashio::config.true 'ssl'; then + bashio::config.require.ssl + CERT="/ssl/$(bashio::config 'certfile')" + KEY="/ssl/$(bashio::config 'keyfile')" + sed -i "s|ssl_certificate .*;|ssl_certificate ${CERT};|; s|ssl_certificate_key .*;|ssl_certificate_key ${KEY};|" /etc/nginx/nginx.conf + bashio::log.info "[50-ssl] Using certificate ${CERT}" + exit 0 +fi SSL_DIR=/config/bentopdf/ssl CERT="${SSL_DIR}/cert.pem" diff --git a/bentopdf/rootfs/etc/nginx/nginx.conf b/bentopdf/rootfs/etc/nginx/nginx.conf index 804a9eeba2..b46c8703ce 100644 --- a/bentopdf/rootfs/etc/nginx/nginx.conf +++ b/bentopdf/rootfs/etc/nginx/nginx.conf @@ -29,13 +29,14 @@ http { gzip_comp_level 9; gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/wasm application/x-javascript text/x-component; - # HTTP on 8080 — redirect to HTTPS; root path returns 200 for HA watchdog + # HTTP on 8080 — redirect to HTTPS; root path returns 200 for the Docker healthcheck server { listen 8080; listen [::]:8080; server_name localhost; location = / { + access_log off; return 200 "ok"; } diff --git a/bentopdf/translations/en.yaml b/bentopdf/translations/en.yaml index 31b79a6af2..1c97f1c6ec 100644 --- a/bentopdf/translations/en.yaml +++ b/bentopdf/translations/en.yaml @@ -2,6 +2,15 @@ configuration: log_level: name: Log level description: Controls the verbosity of add-on logging. + ssl: + name: Use own certificate + description: Serve port 8443 with your own certificate from /ssl. + certfile: + name: Certificate file + description: Certificate file in /ssl. + keyfile: + name: Key file + description: Private key file in /ssl. network: 8080/tcp: Web UI port (direct access, not used for Ingress)