Merge branch 'alexbelgium:master' into manyfold_0.135.0

README.md

@@ -608,7 +608,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
-✓ ![image](https://api.iconify.design/mdi/wifi-check.svg) [NetAlertX](netalertx/) : 🖧🔍 WIFI / LAN scanner, intruder, and presence detector
+✓ ![image](https://api.iconify.design/mdi/wifi-check.svg) [NetAlertX](netalertx/) : 🖧🔍 Centralized network visibility and continuous asset discovery.
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fnetalertx%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fnetalertx%2Fupdater.json)

arpspoof/apparmor.txt

@@ -3,7 +3,13 @@
 profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile arpspoof_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

autobrr/apparmor.txt

@@ -3,7 +3,13 @@
 profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile autobrr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

baikal/apparmor.txt

@@ -4,7 +4,11 @@
 profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -19,12 +23,6 @@ profile baikal_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

battybirdnet-pi/apparmor.txt

@@ -3,7 +3,13 @@
 profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile battybirdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

bazarr/apparmor.txt

@@ -4,7 +4,13 @@
 profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -19,12 +25,6 @@ profile bazarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

binance-trading-bot/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_binance-trading-bot flags=(attach_disconnected,mediate_deleted)
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

birdnet-go/apparmor.txt

@@ -3,7 +3,14 @@
 profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_resource,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile db21ed7f_birdnet-go flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

birdnet-pi/apparmor.txt

@@ -3,7 +3,13 @@
 profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile birdnet-pi_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

birdnet-pipy/apparmor.txt

@@ -3,7 +3,11 @@
 profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,10 +22,6 @@ profile birdnet-pipy_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
 
 # S6-Overlay
   /init ix,

bitwarden/apparmor.txt

@@ -3,7 +3,11 @@
 profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile bitwarden_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

booksonic_air/apparmor.txt

@@ -3,7 +3,13 @@
 profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile booksonic-air_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

browser_chromium/apparmor.txt

@@ -3,7 +3,13 @@
 profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile chromium_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

browserless_chrome/apparmor.txt

@@ -4,7 +4,11 @@
 profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -19,12 +23,6 @@ profile browserlesschrome_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

calibre/apparmor.txt

@@ -3,7 +3,14 @@
 profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile calibre_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

calibre_web/apparmor.txt

@@ -3,7 +3,14 @@
 profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile calibre-web_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

changedetection.io/apparmor.txt

@@ -3,7 +3,11 @@
 profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile addon_db21ed7f_changedetection.io_nas flags=(attach_disconnected,mediate
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

cleanuparr/apparmor.txt

@@ -3,7 +3,11 @@
 profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile cleanuparr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

cloudcommander/apparmor.txt

@@ -3,7 +3,13 @@
 profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile cloudcommander_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

codex/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_codex flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

collabora/apparmor.txt

@@ -3,7 +3,11 @@
 profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile collabora_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

comixed/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

elasticsearch/apparmor.txt

@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

emby/apparmor.txt

@@ -3,7 +3,13 @@
 profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

emby_beta/apparmor.txt

@@ -3,7 +3,13 @@
 profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_emby_nas flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

enedisgateway2mqtt/apparmor.txt

@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

enedisgateway2mqtt_dev/apparmor.txt

@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

ente/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

epicgamesfree/apparmor.txt

@@ -3,7 +3,11 @@
 profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile epicgamesfree_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

filebrowser/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

filebrowser_quantum/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

fireflyiii/apparmor.txt

@@ -3,7 +3,11 @@
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

fireflyiii_data_importer/apparmor.txt

@@ -3,7 +3,11 @@
 profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile fireflyiii_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

fireflyiii_fints_importer/apparmor.txt

@@ -3,7 +3,11 @@
 profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile fireflyiii_fints_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

flaresolverr/apparmor.txt

@@ -3,7 +3,11 @@
 profile joplin flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  capability sys_rawio,
 
 # S6-Overlay
   /init ix,

flexget/apparmor.txt

@@ -3,7 +3,11 @@
 profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile flexget_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

free_games_claimer/apparmor.txt

@@ -3,7 +3,11 @@
 profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile free_games_claimer_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

gazpar2mqtt/apparmor.txt

@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

gitea/apparmor.txt

@@ -3,7 +3,11 @@
 profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile gitea_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

grampsweb/apparmor.txt

@@ -3,7 +3,11 @@
 profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile grampsweb_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

grav/apparmor.txt

@@ -3,7 +3,11 @@
 profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile grav_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

guacamole/apparmor.txt

@@ -3,7 +3,11 @@
 profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile guacamole_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

immich/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

immich_frame/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 1.0.32.0-4 (17-03-2026)
+- Fix: env_vars now properly written to Settings.yaml instead of only environment variables
+- Added General config options to addon UI (Interval, ShowClock, PhotoDateFormat, Style, Layout, etc.)
+- Added per-Account config options to addon UI (Albums, People, ShowFavorites, ShowMemories, etc.)
+- env_vars are automatically classified as General or Account settings in Settings.yaml
+- Full backward compatibility: existing env_vars configurations continue to work
+
 ## 1.0.32.0-3 (16-03-2026)
 - Minor bugs fixed
 

immich_frame/README.md

@@ -39,12 +39,71 @@ Webui can be found at `<your-ip>:8171`.
 
 ### Options
 
+#### Connection
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `ImmichServerUrl` | str | URL of your Immich server (e.g., `http://homeassistant:3001`). Used for single-account setup. |
+| `ApiKey` | str | Immich API key for authentication. Used for single-account setup. |
+| `Accounts` | list | List of Immich accounts for multi-account support. Each entry requires `ImmichServerUrl` and `ApiKey`, plus optional per-account filters (see below). |
+| `TZ` | str | Timezone (e.g., `Europe/London`) |
+
+#### General (Display) Options
+
+These top-level options map to ImmichFrame's `General` settings and control the display behavior:
+
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
-| `ImmichServerUrl` | str | | URL of your Immich server (e.g., `http://homeassistant:3001`). Used for single-account setup. |
+| `Interval` | int | 45 | Image display interval in seconds |
-| `ApiKey` | str | | Immich API key for authentication. Used for single-account setup. |
+| `TransitionDuration` | float | 2 | Transition duration in seconds |
-| `Accounts` | list | `[]` | List of Immich accounts for multi-account support. Each entry requires `ImmichServerUrl` and `ApiKey`. |
+| `ShowClock` | bool | true | Display the current time |
-| `TZ` | str | | Timezone (e.g., `Europe/London`) |
+| `ClockFormat` | str | `hh:mm` | Time format for the clock |
+| `ClockDateFormat` | str | `eee, MMM d` | Date format for the clock |
+| `ShowProgressBar` | bool | true | Display the progress bar |
+| `ShowPhotoDate` | bool | true | Display the date of the current image |
+| `PhotoDateFormat` | str | `MM/dd/yyyy` | Date format for photo dates |
+| `ShowImageDesc` | bool | true | Display image description |
+| `ShowPeopleDesc` | bool | true | Display people names |
+| `ShowTagsDesc` | bool | true | Display tag names |
+| `ShowAlbumName` | bool | true | Display album names |
+| `ShowImageLocation` | bool | true | Display image location |
+| `ShowWeatherDescription` | bool | true | Display weather description |
+| `ImageZoom` | bool | true | Zoom into images for a touch of life |
+| `ImagePan` | bool | false | Pan images in a random direction |
+| `ImageFill` | bool | false | Fill available space (may crop) |
+| `PlayAudio` | bool | false | Play audio for videos with audio tracks |
+| `PrimaryColor` | str | `#f5deb3` | Primary UI color (hex) |
+| `SecondaryColor` | str | `#000000` | Secondary UI color (hex) |
+| `Style` | str | `none` | Background style: `none`, `solid`, `transition`, `blur` |
+| `Layout` | str | `splitview` | Layout: `single` or `splitview` |
+| `BaseFontSize` | str | `17px` | Base font size (CSS format) |
+| `Language` | str | `en` | 2-digit ISO language code |
+| `WeatherApiKey` | str | | OpenWeatherMap API key |
+| `UnitSystem` | str | `imperial` | `imperial` or `metric` |
+| `WeatherLatLong` | str | | Weather location as `lat,lon` |
+| `ImageLocationFormat` | str | `City,State,Country` | Location display format |
+| `DownloadImages` | bool | false | Download images to server |
+| `RenewImagesDuration` | int | 30 | Re-download images after this many days |
+| `RefreshAlbumPeopleInterval` | int | 12 | Hours between album/people refresh |
+
+#### Per-Account Options
+
+These options can be set within each `Accounts` entry to control which images are shown:
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `Albums` | str | Comma-separated album UUIDs |
+| `ExcludedAlbums` | str | Comma-separated excluded album UUIDs |
+| `People` | str | Comma-separated people UUIDs |
+| `Tags` | str | Comma-separated tag paths (e.g., `Vacation,Travel/Europe`) |
+| `ShowFavorites` | bool | Show favorite images |
+| `ShowMemories` | bool | Show memory images |
+| `ShowArchived` | bool | Show archived images |
+| `ShowVideos` | bool | Include video assets |
+| `ImagesFromDays` | int | Show images from the last X days |
+| `ImagesFromDate` | str | Show images after this date |
+| `ImagesUntilDate` | str | Show images before this date |
+| `Rating` | int | Filter by star rating (-1 to 5) |
 
 ### Single Account Example
 
@@ -52,6 +111,9 @@ Webui can be found at `<your-ip>:8171`.
 ImmichServerUrl: "http://homeassistant:3001"
 ApiKey: "your-immich-api-key-here"
 TZ: "Europe/London"
+ShowClock: false
+Interval: 30
+PhotoDateFormat: "dd/MM/yyyy"
 ```
 
 ### Multi-Account Example
@@ -62,8 +124,13 @@ To display photos from multiple Immich accounts (e.g., you and your partner), us
 Accounts:
   - ImmichServerUrl: "http://homeassistant:3001"
     ApiKey: "api-key-for-user-1"
+    Albums: "album-uuid-1,album-uuid-2"
+    ShowFavorites: true
   - ImmichServerUrl: "http://homeassistant:3001"
     ApiKey: "api-key-for-user-2"
+    People: "person-uuid-1,person-uuid-2"
+ShowClock: false
+Interval: 40
 TZ: "Europe/London"
 ```
 
@@ -84,7 +151,16 @@ For more configuration options, see the [ImmichFrame documentation](https://immi
 This addon supports custom scripts and environment variables through the `addon_config` mapping:
 
 - **Custom scripts**: See [Running Custom Scripts in Addons](https://github.com/alexbelgium/hassio-addons/wiki/Running-custom-scripts-in-Addons)
-- **env_vars option**: Use the add-on `env_vars` option to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
+- **env_vars option**: Use the add-on `env_vars` option to pass extra ImmichFrame settings not available in the addon UI. Environment variables are automatically classified as General or Account-level settings and written to `Settings.yaml`. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
+
+**env_vars example** (for settings not in the UI):
+```yaml
+env_vars:
+  - name: AuthenticationSecret
+    value: "my-secret"
+  - name: Webhook
+    value: "http://example.com/notify"
+```
 
 ## Installation
 

immich_frame/apparmor.txt

@@ -3,7 +3,11 @@
 profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile db21ed7f_immich_frame flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

immich_frame/config.yaml

@@ -19,13 +19,56 @@ schema:
   Accounts:
     - ImmichServerUrl: str
       ApiKey: str
+      Albums: str?
+      ExcludedAlbums: str?
+      People: str?
+      Tags: str?
+      ShowFavorites: bool?
+      ShowMemories: bool?
+      ShowArchived: bool?
+      ShowVideos: bool?
+      ImagesFromDays: int?
+      ImagesFromDate: str?
+      ImagesUntilDate: str?
+      Rating: int?
   env_vars:
     - name: match(^[A-Za-z0-9_]+$)
       value: str?
   ApiKey: str?
   ImmichServerUrl: str?
   TZ: str?
+  Interval: int?
+  TransitionDuration: float?
+  ShowClock: bool?
+  ClockFormat: str?
+  ClockDateFormat: str?
+  ShowProgressBar: bool?
+  ShowPhotoDate: bool?
+  PhotoDateFormat: str?
+  ShowImageDesc: bool?
+  ShowPeopleDesc: bool?
+  ShowTagsDesc: bool?
+  ShowAlbumName: bool?
+  ShowImageLocation: bool?
+  ShowWeatherDescription: bool?
+  ImageZoom: bool?
+  ImagePan: bool?
+  ImageFill: bool?
+  PlayAudio: bool?
+  PrimaryColor: str?
+  SecondaryColor: str?
+  Style: str?
+  Layout: str?
+  BaseFontSize: str?
+  Language: str?
+  WeatherApiKey: str?
+  UnitSystem: str?
+  WeatherLatLong: str?
+  ImageLocationFormat: str?
+  DownloadImages: bool?
+  RenewImagesDuration: int?
+  RefreshAlbumPeopleInterval: int?
 slug: immich_frame
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.0.32.0-3"
+version: "1.0.32.0-4"
 webui: http://[HOST]:[PORT:8080]

immich_frame/rootfs/etc/cont-init.d/99-run.sh

@@ -22,45 +22,186 @@ if [ ! -e /app/Config ]; then
     ln -sf /config/Config /app/Config
 fi
 
-# Generate Settings.yaml from addon options for multi-account support
+# ---- Settings.yaml generation ----
 SETTINGS_FILE="/config/Config/Settings.yaml"
-ACCOUNT_COUNT=$(jq '.Accounts // [] | length' /data/options.json 2>/dev/null || echo 0)
 
-if [ "$ACCOUNT_COUNT" -gt 0 ]; then
+# Known account-level setting names (ImmichFrame v2 config)
-    bashio::log.info "Configuring ${ACCOUNT_COUNT} account(s) from Accounts list"
+ACCOUNT_KEYS=" ImmichServerUrl ApiKey ApiKeyFile Albums ExcludedAlbums People Tags ShowFavorites ShowMemories ShowArchived ShowVideos ImagesFromDays ImagesFromDate ImagesUntilDate Rating "
-    {
+# Settings that accept comma-separated values and should become YAML lists
+LIST_KEYS=" Albums ExcludedAlbums People Tags Webcalendars "
+
+# Helper: check if word is in a space-padded list
+in_list() { [[ "$2" == *" $1 "* ]]; }
+
+# Helper: read a value from options.json handling booleans and nulls correctly
+config_val() {
+    jq -r "($1) as \$v | if \$v == null then \"\" else (\$v | tostring) end" /data/options.json 2>/dev/null
+}
+config_has() {
+    jq -e "($1) != null" /data/options.json >/dev/null 2>&1
+}
+
+# Helper: write a YAML key-value pair with proper formatting
+yaml_kv() {
+    local indent="$1" key="$2" value="$3"
+
+    # List-type settings -> YAML array
+    if in_list "$key" "$LIST_KEYS"; then
+        echo "${indent}${key}:"
+        IFS=',' read -ra ITEMS <<< "$value"
+        for item in "${ITEMS[@]}"; do
+            item="$(echo "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+            [ -n "$item" ] && echo "${indent}  - '${item//\'/\'\'}'"
+        done
+        return
+    fi
+
+    # Boolean
+    if [ "$value" = "true" ] || [ "$value" = "false" ]; then
+        echo "${indent}${key}: ${value}"
+        return
+    fi
+
+    # Integer
+    if [[ "$value" =~ ^-?[0-9]+$ ]]; then
+        echo "${indent}${key}: ${value}"
+        return
+    fi
+
+    # Float
+    if [[ "$value" =~ ^-?[0-9]+\.[0-9]+$ ]]; then
+        echo "${indent}${key}: ${value}"
+        return
+    fi
+
+    # String (single-quoted with escaping)
+    echo "${indent}${key}: '${value//\'/\'\'}'"
+}
+
+# ---- Classify env_vars into general vs account settings ----
+declare -A GENERAL_ENVS
+declare -A ACCOUNT_ENVS
+
+ENV_COUNT=$(jq '.env_vars // [] | length' /data/options.json 2>/dev/null || echo 0)
+if [ "$ENV_COUNT" -gt 0 ]; then
+    bashio::log.info "Processing ${ENV_COUNT} env_var(s) for Settings.yaml"
+fi
+for idx in $(seq 0 $((ENV_COUNT - 1))); do
+    ENAME=$(jq -r ".env_vars[${idx}].name" /data/options.json)
+    EVALUE=$(jq -r ".env_vars[${idx}].value // \"\"" /data/options.json)
+    [ -z "$ENAME" ] && continue
+    [ -z "$EVALUE" ] && continue
+    [ "$ENAME" = "TZ" ] && continue  # TZ is a system env var, not an ImmichFrame setting
+
+    if in_list "$ENAME" "$ACCOUNT_KEYS"; then
+        ACCOUNT_ENVS["$ENAME"]="$EVALUE"
+        bashio::log.info "  env_var ${ENAME} -> Account setting"
+    else
+        GENERAL_ENVS["$ENAME"]="$EVALUE"
+        bashio::log.info "  env_var ${ENAME} -> General setting"
+    fi
+done
+
+# General options from the addon schema
+GENERAL_SCHEMA_OPTS="Interval TransitionDuration ShowClock ClockFormat ClockDateFormat
+    ShowProgressBar ShowPhotoDate PhotoDateFormat ShowImageDesc ShowPeopleDesc
+    ShowTagsDesc ShowAlbumName ShowImageLocation ShowWeatherDescription
+    ImageZoom ImagePan ImageFill PlayAudio PrimaryColor SecondaryColor Style
+    Layout BaseFontSize Language WeatherApiKey UnitSystem WeatherLatLong
+    ImageLocationFormat DownloadImages RenewImagesDuration RefreshAlbumPeopleInterval"
+
+# Per-account options from the addon schema (besides ImmichServerUrl/ApiKey)
+ACCOUNT_SCHEMA_OPTS="Albums ExcludedAlbums People Tags ShowFavorites ShowMemories
+    ShowArchived ShowVideos ImagesFromDays ImagesFromDate ImagesUntilDate Rating"
+
+# ---- Build Settings.yaml ----
+{
+    # -- General section --
+    GENERAL_STARTED=false
+
+    for opt in $GENERAL_SCHEMA_OPTS; do
+        if config_has ".$opt"; then
+            $GENERAL_STARTED || { echo "General:"; GENERAL_STARTED=true; }
+            yaml_kv "  " "$opt" "$(config_val ".$opt")"
+        fi
+    done
+
+    # Add general env_vars (skip if already set via schema option)
+    for key in "${!GENERAL_ENVS[@]}"; do
+        if ! config_has ".$key"; then
+            $GENERAL_STARTED || { echo "General:"; GENERAL_STARTED=true; }
+            yaml_kv "  " "$key" "${GENERAL_ENVS[$key]}"
+        fi
+    done
+
+    # -- Accounts section --
+    ACCOUNT_COUNT=$(jq '.Accounts // [] | length' /data/options.json 2>/dev/null || echo 0)
+
+    if [ "$ACCOUNT_COUNT" -gt 0 ]; then
+        bashio::log.info "Configuring ${ACCOUNT_COUNT} account(s) from Accounts list"
         echo "Accounts:"
         for i in $(seq 0 $((ACCOUNT_COUNT - 1))); do
-            SERVER_URL=$(jq -r ".Accounts[${i}].ImmichServerUrl" /data/options.json)
+            SRV="$(config_val ".Accounts[${i}].ImmichServerUrl")"
-            API_KEY=$(jq -r ".Accounts[${i}].ApiKey" /data/options.json)
+            KEY="$(config_val ".Accounts[${i}].ApiKey")"
-            # Escape single quotes for YAML single-quoted strings
+            echo "  - ImmichServerUrl: '${SRV//\'/\'\'}'"
-            SERVER_URL="${SERVER_URL//\'/\'\'}"
+            echo "    ApiKey: '${KEY//\'/\'\'}'"
-            API_KEY="${API_KEY//\'/\'\'}"
+
-            echo "  - ImmichServerUrl: '${SERVER_URL}'"
+            for opt in $ACCOUNT_SCHEMA_OPTS; do
-            echo "    ApiKey: '${API_KEY}'"
+                if config_has ".Accounts[${i}].${opt}"; then
-            bashio::log.info "  Account $((i + 1)): ${SERVER_URL}"
+                    yaml_kv "    " "$opt" "$(config_val ".Accounts[${i}].${opt}")"
+                fi
+            done
+
+            # Apply account-level env_vars (only if not already set in this account's schema)
+            for key in "${!ACCOUNT_ENVS[@]}"; do
+                in_list "$key" " ImmichServerUrl ApiKey " && continue
+                if ! config_has ".Accounts[${i}].${key}"; then
+                    yaml_kv "    " "$key" "${ACCOUNT_ENVS[$key]}"
+                fi
+            done
+
+            bashio::log.info "  Account $((i + 1)): ${SRV}"
         done
-    } > "${SETTINGS_FILE}"
+
-    chmod 600 "${SETTINGS_FILE}"
+    elif config_has '.ApiKey' && config_has '.ImmichServerUrl'; then
-    bashio::log.info "Settings.yaml generated at ${SETTINGS_FILE}"
+        bashio::log.info "Using single account configuration"
-elif bashio::config.has_value 'ApiKey' && bashio::config.has_value 'ImmichServerUrl'; then
+        SRV="$(config_val '.ImmichServerUrl')"
-    bashio::log.info "Using single account configuration"
+        KEY="$(config_val '.ApiKey')"
-    SERVER_URL=$(bashio::config 'ImmichServerUrl')
-    API_KEY=$(bashio::config 'ApiKey')
-    # Escape single quotes for YAML single-quoted strings
-    SERVER_URL="${SERVER_URL//\'/\'\'}"
-    API_KEY="${API_KEY//\'/\'\'}"
-    {
         echo "Accounts:"
-        echo "  - ImmichServerUrl: '${SERVER_URL}'"
+        echo "  - ImmichServerUrl: '${SRV//\'/\'\'}'"
-        echo "    ApiKey: '${API_KEY}'"
+        echo "    ApiKey: '${KEY//\'/\'\'}'"
-    } > "${SETTINGS_FILE}"
+
-    chmod 600 "${SETTINGS_FILE}"
+        # Apply account-level env_vars to the single account
-    bashio::log.info "Settings.yaml generated at ${SETTINGS_FILE}"
+        for key in "${!ACCOUNT_ENVS[@]}"; do
-else
+            in_list "$key" " ImmichServerUrl ApiKey " && continue
-    bashio::log.fatal "No accounts configured! Set either 'Accounts' list or both 'ApiKey' and 'ImmichServerUrl'"
+            yaml_kv "    " "$key" "${ACCOUNT_ENVS[$key]}"
-    exit 1
+        done
-fi
+
+    elif [ -n "${ACCOUNT_ENVS[ImmichServerUrl]:-}" ] && [ -n "${ACCOUNT_ENVS[ApiKey]:-}" ]; then
+        bashio::log.info "Using account configuration from env_vars"
+        echo "Accounts:"
+        echo "  - ImmichServerUrl: '${ACCOUNT_ENVS[ImmichServerUrl]//\'/\'\'}'"
+        echo "    ApiKey: '${ACCOUNT_ENVS[ApiKey]//\'/\'\'}'"
+
+        for key in "${!ACCOUNT_ENVS[@]}"; do
+            in_list "$key" " ImmichServerUrl ApiKey " && continue
+            yaml_kv "    " "$key" "${ACCOUNT_ENVS[$key]}"
+        done
+    else
+        bashio::log.fatal "No accounts configured! Set either 'Accounts' list or both 'ApiKey' and 'ImmichServerUrl'"
+        exit 1
+    fi
+
+} > "${SETTINGS_FILE}"
+chmod 600 "${SETTINGS_FILE}"
+bashio::log.info "Settings.yaml generated at ${SETTINGS_FILE}"
+
+# Log contents (mask sensitive values)
+bashio::log.info "--- Generated Settings.yaml ---"
+sed -E 's/(ApiKey:).*/\1 *****/;s/(AuthenticationSecret:).*/\1 *****/;s/(WeatherApiKey:).*/\1 *****/' "${SETTINGS_FILE}" | while IFS= read -r line; do
+    bashio::log.info "$line"
+done
+bashio::log.info "-------------------------------"
 
 export IMMICHFRAME_CONFIG_PATH=/config/Config
 exec dotnet ImmichFrame.WebApi.dll

immich_power_tools/apparmor.txt

@@ -3,7 +3,11 @@
 profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile db21ed7f_immich_power_tools flags=(attach_disconnected,mediate_deleted)
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

inadyn/apparmor.txt

@@ -3,7 +3,11 @@
 profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile inadyn_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

jackett/apparmor.txt

@@ -3,7 +3,13 @@
 profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile jackett_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

jellyfin/apparmor.txt

@@ -3,7 +3,14 @@
 profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile addon_db21ed7f_jellyfin_nas flags=(attach_disconnected,mediate_deleted)
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability sys_rawio,
-  capability dac_read_search,
-  # capability dac_override,
 
 # S6-Overlay
   /init ix,

joal/apparmor.txt

@@ -3,7 +3,11 @@
 profile joal_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile joal_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

joplin/apparmor.txt

@@ -3,7 +3,12 @@
 profile joplin flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_time,
   file,
   signal,
   mount,
@@ -18,12 +23,6 @@ profile joplin flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  capability sys_rawio,
 
 # S6-Overlay
   /init ix,

kometa/apparmor.txt

@@ -3,7 +3,13 @@
 profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile kometa_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

librespeed/apparmor.txt

@@ -3,7 +3,11 @@
 profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile librespeed_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

lidarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

linkwarden/apparmor.txt

@@ -3,7 +3,11 @@
 profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile linkwarden_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

maintainerr/apparmor.txt

@@ -3,7 +3,11 @@
 profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile maintainerr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

manyfold/apparmor.txt

@@ -10,7 +10,11 @@ profile hassio-addons/manyfold flags=(attach_disconnected,mediate_deleted) {
   # denying known high-risk kernel interfaces.
   file,
   network,
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
 
   deny /proc/kcore rwklx,
   deny /proc/sysrq-trigger rwklx,

mealie/apparmor.txt

@@ -3,7 +3,11 @@
 profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile mealie_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

monica/apparmor.txt

@@ -3,7 +3,11 @@
 profile monica_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile monica_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

mylar3/apparmor.txt

@@ -3,7 +3,13 @@
 profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile mylar3_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

navidrome/apparmor.txt

@@ -3,7 +3,13 @@
 profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile navidrome_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

netalertx/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 26.3.16-3 (18-03-2026)
+- Minor bugs fixed
+## 26.3.16-2 (17-03-2026)
+- Minor bugs fixed
+## 26.3.16-1 (17-03-2026)
+- Minor bugs fixed
 ## 26.3.7-3 (07-03-2026)
 - Minor bugs fixed
 ## 26.3.7-2 (07-03-2026)

netalertx/apparmor.txt

@@ -3,35 +3,25 @@
 profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
-  umount,
   remount,
-  network udp,
+  umount,
-  network tcp,
+  network,
-  network dgram,
+  ptrace,
-  network stream,
-  network inet,
-  network inet6,
-  network netlink raw,
-  network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
-
-# S6-Overlay
   /init ix,
   /run/{s6,s6-rc*,service}/** ix,
   /package/** ix,
   /command/** ix,
-  /run/{,**} rwk,
-  /dev/tty rw,
   /bin/** ix,
   /usr/bin/** ix,
   /usr/lib/bashio/** ix,
@@ -40,27 +30,5 @@ profile netalertx_addon flags=(attach_disconnected,mediate_deleted) {
   /etc/services.d/** rwix,
   /etc/cont-init.d/** rwix,
   /etc/cont-finish.d/** rwix,
-  /init rix,
-  /var/run/** mrwkl,
-  /var/run/ mrwkl,
-  /dev/i2c-1 mrwkl,
-  # Files required
-  /dev/fuse mrwkl,
-  /dev/sda1 mrwkl,
-  /dev/sdb1 mrwkl,
-  /dev/nvme0 mrwkl,
-  /dev/nvme1 mrwkl,
-  /dev/mmcblk0p1 mrwkl,
-  /dev/* mrwkl,
-  /tmp/** mrkwl,
-
-  # Data access
-  /data/** rw,
-
-  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
-  ptrace (trace,read) peer=docker-default,
-
-  # docker daemon confinement requires explict allow rule for signal
-  signal (receive) set=(kill,term) peer=/usr/bin/docker,
-
 }
+

netalertx/config.yaml

@@ -1,48 +1,39 @@
 arch:
   - aarch64
   - amd64
-description: "\U0001F5A7\U0001F50D WIFI / LAN scanner, intruder, and presence detector"
+description: "\U0001F5A7\U0001F50D Centralized network visibility and continuous asset discovery."
-environment:
-  PGID: "20211"
-  PORT: "20211"
-  PUID: "20211"
-  TZ: Europe/Berlin
-  NETALERTX_DATA: /config
-  NETALERTX_CONFIG: /config/config
-  NETALERTX_DB: /config/db
-  TMP_DIR: /tmp/tmp
-  NETALERTX_CONFIG_FILE: /config/config/app.conf
-  NETALERTX_DB_FILE: /config/db/app.db
 hassio_api: true
 host_network: true
 image: ghcr.io/alexbelgium/netalertx-{arch}
 ingress: true
-ingress_port: 0
+ingress_port: 20211
 ingress_stream: true
 init: false
 map:
   - addon_config:rw
-  - media:rw
-  - share:rw
-  - ssl
 name: NetAlertX
-options:
-  env_vars: []
 panel_icon: mdi:wifi-check
 ports:
   20211/tcp: 20211
   20212/tcp: 20212
 ports_description:
-  20211/tcp: WebUI port
+  20211/tcp: NetAlertX WebUI port
-  20212/tcp: GraphQL port
+  20212/tcp: GraphQL & MCP port
 privileged:
   - NET_ADMIN
   - NET_RAW
+environment:
+  PUID: "20211"
+  PGID: "20211"
+  TZ: Europe/Berlin
+  NETALERTX_DATA: /config
+  NETALERTX_CONFIG: /config/config
+  NETALERTX_CONFIG_FILE: /config/config/app.conf
+  NETALERTX_DB: /config/db
+  NETALERTX_DB_FILE: /config/db/app.db
+  TMP_DIR: /tmp/tmp
+  SKIP_STARTUP_CHECKS: excessive capabilities.sh,appliance integrity.sh
 schema:
-  env_vars:
-    - name: match(^[A-Za-z0-9_]+$)
-      value: str?
-  APP_CONF_OVERRIDE: str?
   TZ: str?
 services:
   - mqtt:want
@@ -50,4 +41,4 @@ slug: netalertx
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "26.2.6-4"
+version: "26.3.16-3"

netalertx/rootfs/etc/cont-init.d/91-configure.sh

@@ -6,12 +6,11 @@ set -e
 # Update structure #
 ####################
 
-APP_UID=20211
 
 # 1. Fix the directories
-for folder in /tmp/run/tmp /tmp/api /tmp/log /tmp/run /tmp/nginx/active-config "$TMP_DIR" "$NETALERTX_DATA" "$NETALERTX_DB" "$NETALERTX_CONFIG"; do
+for folder in /tmp/run/tmp /tmp/api /tmp/log /tmp/run /tmp/nginx/active-config "${TMP_DIR:-/tmp}" "${NETALERTX_DATA:-/data}" "${NETALERTX_DB:-/data/db}" "${NETALERTX_CONFIG:-/data/config}"; do
     mkdir -p "$folder"
-    chown -R $APP_UID:$APP_UID "$folder"
+    chown -R "${PUID}":"${PGID}" "$folder"
     chmod -R 755 "$folder"
 done
 
@@ -22,13 +21,17 @@ chmod 666 /dev/stdout /dev/stderr
 
 # 3. Pre-create and chown log files
 touch /tmp/log/app.php_errors.log /tmp/log/cron.log /tmp/log/stdout.log /tmp/log/stderr.log
-chown $APP_UID:$APP_UID /tmp/log/*.log
+chown "${PUID}":"${PGID}" /tmp/log/*.log
 
 # 4. Create Symlinks
 for item in db config; do
+    # ADD THESE TWO LINES: Ensure the target exists and is owned by 20211
+    mkdir -p "/config/$item"
+    chown -R "${PUID}":"${PGID}" "/config/$item"
+
     rm -rf "/data/$item"
     ln -sf "/config/$item" "/data/$item"
-    chown -R $APP_UID:$APP_UID "/data/$item"
+    chown -R "${PUID}":"${PGID}" "/data/$item"
     chmod -R 755 "/data/$item"
 done
 

netalertx/rootfs/etc/cont-init.d/99-run.sh

@@ -3,4 +3,4 @@
 set -e
 
 bashio::log.info "Starting upstream app"
-gosu netalertx /entrypoint.sh
+/root-entrypoint.sh

nextcloud/apparmor.txt

@@ -3,7 +3,13 @@
 profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile nextcloud_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

nzbget/apparmor.txt

@@ -3,7 +3,13 @@
 profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile nzbget_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

omni-tools/apparmor.txt

@@ -4,7 +4,11 @@ profile omni-tools flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   # Capabilities
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal (send) set=(kill,term,int,hup,cont),
 

openproject/apparmor.txt

@@ -3,7 +3,11 @@
 profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile openproject_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

organizr/apparmor.txt

@@ -3,7 +3,11 @@
 profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,8 +22,6 @@ profile organizr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

photoprism/apparmor.txt

@@ -3,7 +3,14 @@
 profile photoprism flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_rawio,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile photoprism flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability dac_override,
-  capability sys_admin,
-  capability dac_read_search,
-  capability sys_rawio,
 
 # S6-Overlay
   /init ix,

piwigo/apparmor.txt

@@ -3,7 +3,13 @@
 profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile piwigo_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

plex/apparmor.txt

@@ -3,7 +3,13 @@
 profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile addon_db21ed7f_plex_nas flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

portainer/apparmor.txt

@@ -3,7 +3,11 @@
 profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile portainer_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

postgres_15/apparmor.txt

@@ -3,7 +3,11 @@
 profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile postgres_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

prowlarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile prowlarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

qbittorrent/apparmor.txt

@@ -3,7 +3,14 @@
 profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,16 +25,6 @@ profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability chown,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability net_admin,
-  capability dac_override,
-  capability net_bind_service,
-  capability net_broadcast,
-  capability sys_rawio,
 
 # S6-Overlay
   /init ix,

radarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile radarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

readarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile readarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

requestrr/apparmor.txt

@@ -3,7 +3,13 @@
 profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile requestrr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

resiliosync/apparmor.txt

@@ -3,7 +3,14 @@
 profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile resiliosync_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

sabnzbd/apparmor.txt

@@ -3,7 +3,13 @@
 profile sabnzbd_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile sabnzbd_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

scrutiny/apparmor.txt

@@ -3,7 +3,14 @@
 profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_rawio,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile db21ed7f_scrutiny flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability dac_override,
-  capability sys_admin,
-  capability dac_read_search,
-  capability sys_rawio,
 
 # S6-Overlay
   /init ix,

seafile/apparmor.txt

@@ -3,7 +3,14 @@
 profile seafile_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile seafile_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

seerr/apparmor.txt

@@ -3,7 +3,11 @@
 profile seerr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile seerr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

social_to_mealie/apparmor.txt

@@ -3,7 +3,11 @@
 profile social_to_mealie_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -18,12 +22,6 @@ profile social_to_mealie_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

sonarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile sonarr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

spotweb/apparmor.txt

@@ -3,7 +3,11 @@
 profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile spotweb_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

tandoor_recipes/apparmor.txt

@@ -3,7 +3,11 @@
 profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile tandoor_recipes_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

tdarr/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_tdarr flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_tdarr flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

teamspeak/apparmor.txt

@@ -3,7 +3,11 @@
 profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
   file,
   signal,
   mount,
@@ -17,8 +21,6 @@ profile teamspeak_addon flags=(attach_disconnected,mediate_deleted) {
   network inet6,
   network netlink raw,
   network unix dgram,
-  capability setgid,
-  capability setuid,
 
 
 # S6-Overlay

transmission/apparmor.txt

@@ -3,7 +3,13 @@
 profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile db21ed7f_transmission flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

transmission_openvpn/apparmor.txt

@@ -3,7 +3,14 @@
 profile db21ed7f_transmission_openvpn flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +25,6 @@ profile db21ed7f_transmission_openvpn flags=(attach_disconnected,mediate_deleted
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

ubooquity/apparmor.txt

@@ -3,7 +3,13 @@
 profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile ubooquity_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

unpackerr/apparmor.txt

@@ -3,7 +3,13 @@
 profile unpackerr_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile unpackerr_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  # capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,

webtop_kde/apparmor.txt

@@ -3,7 +3,13 @@
 profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  capability,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
   file,
   signal,
   mount,
@@ -18,12 +24,6 @@ profile webtop_addon flags=(attach_disconnected,mediate_deleted) {
   network netlink raw,
   network unix dgram,
 
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability dac_read_search,
-  capability dac_override,
-  # capability sys_rawio,
 
 # S6-Overlay
   /init ix,