avm/hassio-addons
1
0
Fork 0
mirror of https://github.com/alexbelgium/hassio-addons.git synced 2026-08-31 09:13:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(calibre-web): trust the addon ip so ingress login works on 0.6.27 (#3004)

Browse Source 
* fix(calibre-web): trust the addon ip so ingress login works on 0.6.27

Calibre-web 0.6.27 added a trusted-source check for the reverse proxy auth
header (cps/reverse_proxy_auth.py:is_trusted_proxy_source) and defaults
config_reverse_proxy_trusted_ips to "127.0.0.1,::1". The ingress nginx binds
its upstream socket to the addon ip (proxy_bind $server_addr,
rootfs/etc/nginx/servers/ingress.conf:13), so calibre-web sees
::ffff:<addon ip> and discards X-WebAuth-User, leaving ingress at the login
page.

80-configuration.sh now writes that address - plain and ipv4-mapped, plus the
loopback forms - into config_reverse_proxy_trusted_ips next to the two
settings it already applies. The update is tolerated failing because the
column only exists after calibre-web 0.6.27+ has migrated app.db.

Closes #3003

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Alexandre
2026-08-23 14:02:45 +02:00
committed by GitHub
parent 1d70eca70a
commit c697ed2c06
3 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
calibre_web/CHANGELOG.md
View File

@@ -1,4 +1,7 @@
## 0.6.27.1 (2026-08-23)
- Fix: Ingress login was rejected since 0.6.27, which only accepts the reverse proxy auth header from trusted source addresses. The addon now adds its own ip to that list (https://github.com/alexbelgium/hassio-addons/issues/3003)
## 0.6.27 (2026-08-13)
- Update to latest version from linuxserver/docker-calibre-web (changelog : https://github.com/linuxserver/docker-calibre-web/releases)

2
calibre_web/config.yaml
View File

@@ -116,5 +116,5 @@ schema:
slug: calibre-web
udev: true
url: https://github.com/alexbelgium/hassio-addons/tree/master/calibre_web
version: "0.6.27"
version: "0.6.27.1"
video: true

20
calibre_web/rootfs/etc/cont-init.d/80-configuration.sh
View File

@@ -18,6 +18,26 @@ if [ ! -f /config/app.db ]; then
bashio::log.warning "First boot : disabling Ingress until addon restart"
else
sqlite3 /config/app.db 'update settings set config_reverse_proxy_login_header_name="X-WebAuth-User",config_allow_reverse_proxy_header_login=1'
# Calibre-web 0.6.27 only accepts the ingress auth header from a trusted source address, and
# defaults that list to "127.0.0.1,::1". Nginx binds its upstream socket to the addon ip
# (proxy_bind $server_addr in ingress.conf) and calibre-web listens dual-stack, so it sees
# ::ffff:<addon ip> and drops the header. Both the plain and the ipv4-mapped forms are listed
# because an ipv4 entry never matches an ipv6-mapped address on the calibre-web side.
# The column only exists once calibre-web 0.6.27+ has migrated app.db, so a failure here is
# not fatal : the next start applies it.
addon_ip=$(bashio::addon.ip_address)
trusted_ips="127.0.0.1,::1,::ffff:127.0.0.1"
if bashio::var.has_value "${addon_ip}"; then
trusted_ips="${trusted_ips},${addon_ip},::ffff:${addon_ip}"
fi
trusted_ips_error=$(sqlite3 /config/app.db "update settings set config_reverse_proxy_trusted_ips='${trusted_ips}'" 2>&1) || {
if echo "${trusted_ips_error}" | grep -q "no such column"; then
bashio::log.warning "Could not set the ingress trusted ip list, it will be applied at next start"
else
bashio::log.warning "Could not set the ingress trusted ip list: ${trusted_ips_error}"
fi
}
fi
bashio::log.info "Default username:password is admin:admin123"