From c697ed2c064d48af44a4e5f78d74481b3a2051fb Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Sun, 23 Aug 2026 14:02:45 +0200
Subject: [PATCH] fix(calibre-web): trust the addon ip so ingress login works
 on 0.6.27 (#3004)

* fix(calibre-web): trust the addon ip so ingress login works on 0.6.27

Calibre-web 0.6.27 added a trusted-source check for the reverse proxy auth
header (cps/reverse_proxy_auth.py:is_trusted_proxy_source) and defaults
config_reverse_proxy_trusted_ips to "127.0.0.1,::1". The ingress nginx binds
its upstream socket to the addon ip (proxy_bind $server_addr,
rootfs/etc/nginx/servers/ingress.conf:13), so calibre-web sees
::ffff:<addon ip> and discards X-WebAuth-User, leaving ingress at the login
page.

80-configuration.sh now writes that address - plain and ipv4-mapped, plus the
loopback forms - into config_reverse_proxy_trusted_ips next to the two
settings it already applies. The update is tolerated failing because the
column only exists after calibre-web 0.6.27+ has migrated app.db.

Closes #3003

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 calibre_web/CHANGELOG.md                      |  3 +++
 calibre_web/config.yaml                       |  2 +-
 .../etc/cont-init.d/80-configuration.sh       | 20 +++++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/calibre_web/CHANGELOG.md b/calibre_web/CHANGELOG.md
index 3c84e7ea0d..5eaf9b129a 100644
--- a/calibre_web/CHANGELOG.md
+++ b/calibre_web/CHANGELOG.md
@@ -1,4 +1,7 @@
  
+## 0.6.27.1 (2026-08-23)
+- Fix: Ingress login was rejected since 0.6.27, which only accepts the reverse proxy auth header from trusted source addresses. The addon now adds its own ip to that list (https://github.com/alexbelgium/hassio-addons/issues/3003)
+
 ## 0.6.27 (2026-08-13)
 - Update to latest version from linuxserver/docker-calibre-web (changelog : https://github.com/linuxserver/docker-calibre-web/releases)
 
diff --git a/calibre_web/config.yaml b/calibre_web/config.yaml
index 2d08b35d23..ad72563d8e 100644
--- a/calibre_web/config.yaml
+++ b/calibre_web/config.yaml
@@ -116,5 +116,5 @@ schema:
 slug: calibre-web
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/calibre_web
-version: "0.6.27"
+version: "0.6.27.1"
 video: true
diff --git a/calibre_web/rootfs/etc/cont-init.d/80-configuration.sh b/calibre_web/rootfs/etc/cont-init.d/80-configuration.sh
index a7b1d8bcfc..4ae133e43b 100755
--- a/calibre_web/rootfs/etc/cont-init.d/80-configuration.sh
+++ b/calibre_web/rootfs/etc/cont-init.d/80-configuration.sh
@@ -18,6 +18,26 @@ if [ ! -f /config/app.db ]; then
     bashio::log.warning "First boot : disabling Ingress until addon restart"
 else
     sqlite3 /config/app.db 'update settings set config_reverse_proxy_login_header_name="X-WebAuth-User",config_allow_reverse_proxy_header_login=1'
+
+    # Calibre-web 0.6.27 only accepts the ingress auth header from a trusted source address, and
+    # defaults that list to "127.0.0.1,::1". Nginx binds its upstream socket to the addon ip
+    # (proxy_bind $server_addr in ingress.conf) and calibre-web listens dual-stack, so it sees
+    # ::ffff:<addon ip> and drops the header. Both the plain and the ipv4-mapped forms are listed
+    # because an ipv4 entry never matches an ipv6-mapped address on the calibre-web side.
+    # The column only exists once calibre-web 0.6.27+ has migrated app.db, so a failure here is
+    # not fatal : the next start applies it.
+    addon_ip=$(bashio::addon.ip_address)
+    trusted_ips="127.0.0.1,::1,::ffff:127.0.0.1"
+    if bashio::var.has_value "${addon_ip}"; then
+        trusted_ips="${trusted_ips},${addon_ip},::ffff:${addon_ip}"
+    fi
+    trusted_ips_error=$(sqlite3 /config/app.db "update settings set config_reverse_proxy_trusted_ips='${trusted_ips}'" 2>&1) || {
+        if echo "${trusted_ips_error}" | grep -q "no such column"; then
+            bashio::log.warning "Could not set the ingress trusted ip list, it will be applied at next start"
+        else
+            bashio::log.warning "Could not set the ingress trusted ip list: ${trusted_ips_error}"
+        fi
+    }
 fi
 
 bashio::log.info "Default username:password is admin:admin123"