fix(komga): ship an apparmor profile so local disks can be mounted

Without apparmor.txt Supervisor adds no apparmor security_opt, so Docker's
default profile applies and denies mount() and raw block device access:
mount reported 'cannot mount /dev/sda1 read-only' and the kernel logged
'/dev/disk/by-label/NAS: Can't open blockdev'.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/onpr_check-pr.yaml

@@ -91,7 +91,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: 🔎 Run Home Assistant Add-on Lint
-        uses: frenck/action-addon-linter@v2
+        uses: frenck/action-addon-linter@f6bef06a4cee6c67924b0a70be643aacb8500a43
         with:
           path: "./${{ matrix.addon }}"
 
@@ -193,15 +193,15 @@ jobs:
 
       - name: 💽 Create addon build-args
         id: build_args
+        shell: bash
         run: |
-          build_file="${{ steps.information.outputs.build }}"
-          case "$build_file" in
-            *.yaml|*.yml) build_json="$(yq -o=json '.' "$build_file")" ;;
-            *)            build_json="$(cat "$build_file")" ;;
-          esac
-          for arch in armhf armv7 aarch64 amd64 i386; do
-            echo "${arch}=BUILD_FROM=$(printf '%s' "$build_json" | jq -r --arg a "$arch" '.build_from[$a] // empty')"
-          done >> "$GITHUB_OUTPUT"
+          {
+            echo "armhf=BUILD_FROM=$(jq -r .build_from.armhf // empty ${{ steps.information.outputs.build }})"
+            echo "armv7=BUILD_FROM=$(jq -r .build_from.armv7 // empty ${{ steps.information.outputs.build }})"
+            echo "aarch64=BUILD_FROM=$(jq -r .build_from.aarch64 // empty ${{ steps.information.outputs.build }})"
+            echo "amd64=BUILD_FROM=$(jq -r .build_from.amd64 // empty ${{ steps.information.outputs.build }})"
+            echo "i386=BUILD_FROM=$(jq -r .build_from.i386 // empty ${{ steps.information.outputs.build }})"
+          } >> "$GITHUB_OUTPUT"
 
       - name: 🏗️ Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/onpush_builder.yaml

@@ -114,7 +114,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
       - name: Run Home Assistant Add-on Lint
-        uses: frenck/action-addon-linter@v2
+        uses: frenck/action-addon-linter@f6bef06a4cee6c67924b0a70be643aacb8500a43
         with:
           path: "./${{ matrix.addon }}"
 

.templates/ha_entrypoint.sh

@@ -173,13 +173,9 @@ fi
 ####################################
 
 BASHIO_LIB=""
-BASHIO_LIB_FULL=false
 for f in /usr/lib/bashio/bashio.sh /usr/lib/bashio/lib.sh /usr/src/bashio/bashio.sh /usr/local/lib/bashio/bashio.sh; do
   if [ -f "$f" ]; then
     BASHIO_LIB="$f"
-    # The real library, which talks to the Supervisor. The standalone shim below only reads
-    # environment variables, which matters to wait_for_supervisor().
-    BASHIO_LIB_FULL=true
     break
   fi
 done
@@ -192,83 +188,6 @@ if [ -z "$BASHIO_LIB" ]; then
   done
 fi
 
-##############################
-# Wait for the Supervisor API #
-##############################
-
-# Many cont-init scripts build their nginx ingress config out of bashio::addon.ip_address and
-# bashio::addon.ingress_port. Both come from one GET /addons/self/info, and when that is answered
-# before the Supervisor is ready bashio prints nothing: the add-on then either writes
-# "listen : default_server;" -- which nginx rejects with `invalid port in ":"` -- or aborts under
-# set -e and leaves the %%port%% placeholders in place. Either way the add-on cannot serve ingress.
-# Ask for the same values here, through the same bashio calls, until they come back usable --
-# rather than making 48 add-ons defend themselves against the same empty answer.
-#
-# Going through bashio rather than curl is what makes this reliable rather than merely likely:
-# bashio caches a successful /addons/self/info under ${CACHE_DIR:-/tmp/.bashio}, so once this
-# returns, every later bashio::addon.* call in every cont-init script reads that file instead of
-# asking the Supervisor again. A probe that only proved the API was up a moment ago would leave
-# the very next call free to fail.
-#
-# Bounded and never fatal: an add-on with no SUPERVISOR_TOKEN, or a Supervisor that stays
-# unreachable, still has to start. HA_SUPERVISOR_WAIT (seconds, default 30) sets the ceiling; 0
-# skips the wait. When the Supervisor is already up -- the normal case -- this costs one request.
-
-wait_for_supervisor() {
-  local max="${HA_SUPERVISOR_WAIT:-30}"
-  local started deadline remaining attempt announced=0
-
-  # Nothing to wait for without a token. The standalone shim is excluded too: it answers these
-  # calls from environment variables and never contacts the Supervisor, so it can never satisfy
-  # the probe and would burn the whole ceiling on every boot.
-  [ -n "${SUPERVISOR_TOKEN:-}" ] || return 0
-  [ "${BASHIO_LIB_FULL:-false}" = "true" ] || return 0
-  # bashio's own curl carries no --max-time, so each attempt is bounded from the outside.
-  command -v timeout >/dev/null 2>&1 || return 0
-  # Digits only, then forced to base 10: `test -gt` accepts a zero-padded override like 08, but
-  # arithmetic expansion reads it as octal and fails, which would leave the deadline empty and
-  # spin the loop below forever.
-  case "$max" in '' | *[!0-9]*) return 0 ;; esac
-  max=$((10#$max))
-  [ "$max" -gt 0 ] || return 0
-
-  started=$SECONDS
-  deadline=$((started + max))
-
-  while :; do
-    remaining=$((deadline - SECONDS))
-    if [ "$remaining" -le 0 ]; then
-      echo -e "\e[38;5;214m$(date) WARNING: Supervisor API did not report this add-on's network details within ${max}s, continuing anyway\e[0m"
-      return 0
-    fi
-
-    # No single attempt may outlive the ceiling it is bounded by.
-    attempt=5
-    [ "$remaining" -lt "$attempt" ] && attempt="$remaining"
-
-    # One call is enough to settle all of them: bashio fetches the whole /addons/self/info object
-    # and caches it, so a populated ip_address means ingress_port and the rest are cached too.
-    # Run in a child shell so bashio's globals and traps stay out of the entrypoint; its own error
-    # logging is dropped because a failed attempt here is expected, not news.
-    # shellcheck disable=SC2016
-    if timeout "$attempt" bash -c '. "$1" && [ -n "$(bashio::addon.ip_address)" ]' \
-      _ "$BASHIO_LIB" >/dev/null 2>&1; then
-      [ "$announced" -eq 0 ] || echo "Supervisor API ready after $((SECONDS - started))s"
-      return 0
-    fi
-
-    if [ "$announced" -eq 0 ]; then
-      echo "Waiting for the Supervisor API to report this add-on's network details..."
-      announced=1
-    fi
-
-    # Skipped when the attempt already consumed what was left, so the sleep cannot overshoot.
-    [ "$((deadline - SECONDS))" -gt 0 ] && sleep 1
-  done
-}
-
-wait_for_supervisor
-
 ####################
 # Starting scripts #
 ####################

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 138
+- In the repository : 137
 - Installed : 325872
 
 ### Top 3
@@ -567,16 +567,6 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
-✓ ![image](https://api.iconify.design/mdi/book-open-page-variant.svg) [Komga](komga/) : Free and open source comics/mangas media server
-
-  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fkomga%2Fconfig.yaml)
-![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fkomga%2Fupdater.json)
-![aarch64][aarch64-badge]
-![amd64][amd64-badge]
-![ingress][ingress-badge]
-![smb][smb-badge]
-![localdisks][localdisks-badge]
-
 ✓ ![image](https://api.iconify.design/mdi/speedometer.svg) [LibreSpeed](librespeed/) : A very lightweight speed test implemented in Javascript, using XMLHttpRequest and Web Workers
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Flibrespeed%2Fconfig.yaml)

komga/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 1.26.1.4 (12-08-2026)
-- Minor bugs fixed
-## 1.26.1.3 (2026-08-12)
-
-- Fix : 401 errors after a successful login through ingress. Komga scopes its session cookies to its servlet context path (`Path=/komga`), which the browser never sends back from the ingress url, so every request after the login was anonymous. Nginx now rewrites the cookie path onto the ingress entry
-
 ## 1.26.1.2 (2026-08-12)
 
 - Fix : local disks (`localdisks`) and SMB shares failed to mount with `cannot mount /dev/sdX read-only`. Without an `apparmor.txt` the add-on ran under Docker's default AppArmor profile, which denies `mount` and raw block device access. Ships the same profile as the other add-ons that mount disks

komga/apparmor.txt

@@ -62,7 +62,7 @@ profile komga_addon flags=(attach_disconnected,mediate_deleted) {
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
 
-  # docker daemon confinement requires explicit allow rule for signal
+  # docker daemon confinement requires explict allow rule for signal
   signal (receive) set=(kill,term) peer=/usr/bin/docker,
 
 }

komga/build.json

@@ -1,6 +1,6 @@
 {
   "build_from": {
-    "aarch64": "gotson/komga:latest",
-    "amd64": "gotson/komga:latest"
+    "aarch64": "gotson/komga:1.26.1",
+    "amd64": "gotson/komga:1.26.1"
   }
 }

komga/config.yaml

@@ -66,7 +66,7 @@ devices:
   - /dev/nvme2
 image: ghcr.io/alexbelgium/komga-{arch}
 ingress: true
-ingress_entry: komga/next
+ingress_entry: komga
 init: false
 map:
   - addon_config:rw
@@ -101,4 +101,4 @@ schema:
 slug: komga
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/komga
-version: "1.26.1.4"
+version: "1.26.1.2"

komga/rootfs/etc/nginx/servers/ingress.conf

@@ -33,13 +33,6 @@ server {
         proxy_redirect http://127.0.0.1:25600/ %%ingress_entry%%/;
         proxy_redirect / %%ingress_entry%%/;
 
-        # Komga scopes its cookies to the servlet context path
-        # (Set-Cookie: ...; Path=/komga). The browser lives under the ingress
-        # entry, so such a cookie is never sent back : login succeeds, then
-        # every following request arrives anonymous and Komga answers 401.
-        proxy_cookie_path /komga %%ingress_entry%%/komga;
-        proxy_cookie_path / %%ingress_entry%%/;
-
         # Komga renders its index page with Thymeleaf @{...} link expressions,
         # so every asset url and window.resourceBaseUrl carry the context path
         # (/komga). Ingress strips its own prefix before forwarding, so the

qbittorrent/CHANGELOG.md

@@ -1,8 +1,4 @@
 
-## 5.2.3.2 (2026-08-12)
-
-- Fix : ingress could fail permanently with `nginx: [emerg] invalid port in ":"`. `30-nginx.sh` pastes `bashio::addon.ip_address` and `bashio::addon.ingress_port` straight into the nginx config; when the Supervisor answers before it is ready both come back empty and the config gets `listen : default_server;`. The add-on entrypoint now waits (up to 30s, tunable with `HA_SUPERVISOR_WAIT`) for the Supervisor to report the add-on's network details before any startup script runs
-
 ## 5.2.3-1 (2026-07-09)
 
 - Rebuild images after VueTorrent download path fix

qbittorrent/config.yaml

@@ -143,4 +143,4 @@ schema:
 slug: qbittorrent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.2.3.2"
+version: "5.2.3.1"

zzz_archived_tor/README.md

@@ -1,4 +1,4 @@
-## ⚠ Open Issue : [✨ [REQUEST] qbittorrent (opened 2025-10-11)](https://github.com/alexbelgium/hassio-addons/issues/2139) by [@nyok92](https://github.com/nyok92)
+## ⚠ Open Request : [✨ [REQUEST] qbittorrent (opened 2025-10-11)](https://github.com/alexbelgium/hassio-addons/issues/2139) by [@nyok92](https://github.com/nyok92)
 ## ⚠ Open Request : [✨ [REQUEST] transmission, document where torrent files are stored (opened 2026-07-14)](https://github.com/alexbelgium/hassio-addons/issues/2852) by [@bilogic](https://github.com/bilogic)
 # Hass.io Add-ons: Tor with bridges