fix(komga): rewrite the cookie path onto the ingress entry (#2964)

Komga scopes its cookies to its servlet context path, so the browser never
sent them back from the ingress url and every request after a successful
login was anonymous (401).

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

komga/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.26.1.3 (2026-08-12)
+
+- Fix : 401 errors after a successful login through ingress. Komga scopes its session cookies to its servlet context path (`Path=/komga`), which the browser never sends back from the ingress url, so every request after the login was anonymous. Nginx now rewrites the cookie path onto the ingress entry
+
 ## 1.26.1.2 (2026-08-12)
 
 - Fix : local disks (`localdisks`) and SMB shares failed to mount with `cannot mount /dev/sdX read-only`. Without an `apparmor.txt` the add-on ran under Docker's default AppArmor profile, which denies `mount` and raw block device access. Ships the same profile as the other add-ons that mount disks

komga/config.yaml

@@ -101,4 +101,4 @@ schema:
 slug: komga
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/komga
-version: "1.26.1.2"
+version: "1.26.1.3"

komga/rootfs/etc/nginx/servers/ingress.conf

@@ -33,6 +33,13 @@ server {
         proxy_redirect http://127.0.0.1:25600/ %%ingress_entry%%/;
         proxy_redirect / %%ingress_entry%%/;
 
+        # Komga scopes its cookies to the servlet context path
+        # (Set-Cookie: ...; Path=/komga). The browser lives under the ingress
+        # entry, so such a cookie is never sent back : login succeeds, then
+        # every following request arrives anonymous and Komga answers 401.
+        proxy_cookie_path /komga %%ingress_entry%%/komga;
+        proxy_cookie_path / %%ingress_entry%%/;
+
         # Komga renders its index page with Thymeleaf @{...} link expressions,
         # so every asset url and window.resourceBaseUrl carry the context path
         # (/komga). Ingress strips its own prefix before forwarding, so the