Compare commits

..

4 Commits

Author SHA1 Message Date
alexbelgium
94f59489f0 fix(elasticsearch): stay root at runtime, fix upgrade permission failure
Reported: on upgrade from an existing 7.17.9 install, the add-on failed
to start with "mv: cannot move '/data/config' to
'/data/config.bak-7.17.9': Permission denied".

Root cause: a previous fix in this same release restored `USER 1000:0`
at the end of the Dockerfile to match the upstream base image's own
final USER directive. But the upstream 8.19 entrypoint no longer drops
privileges itself (confirmed: it execs elasticsearch directly, no
gosu/chroot dance), and existing installs have /data owned by root
(7.17.9's default image variant runs fully as root). A non-root
container can never chown or move that data.

Revert to root at runtime, matching how this add-on always ran and
matching its own AppArmor profile (chown, setuid, setgid, sys_chroot,
mount capabilities — all meaningless for a non-root process anyway).
Root stays required for the build-time entrypoint patch too, unchanged
from the prior fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-14 12:11:26 +02:00
alexbelgium
cc427f0c20 fix(elasticsearch): treat HTTP 401 as healthy in the migration marker check
curl -f treated any 4xx as failure, including 401. Users who enable
xpack.security (a supported override via ES_SETTING_XPACK_SECURITY_ENABLED)
got 401 on the unauthenticated healthcheck request, so the version marker
was never written and every restart re-logged the one-time migration
notice. Read the HTTP status directly and accept 200 or 401.

Reviewed and skipped: the cp -rn merge-into-existing-directory concern —
verified empirically (both locally and against the image's Debian/GNU
coreutils base) that GNU cp merges correctly into a pre-existing
same-named destination without nesting; the existing test suite already
exercises this exact path (legacy 7.x data preserved during migration).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-14 11:26:43 +02:00
alexbelgium
68120a84da fix(elasticsearch): address review — build user, env_vars validation
- The 8.19.18 base image ends the build as USER 1000:0 with a
  root-owned, read-only (0555) entrypoint, so the sed patch and later
  chmod/package-install steps failed. Switch to root for the build and
  restore the Elasticsearch user before runtime.
- Tighten the env_vars name check to require a leading letter/underscore
  (shell identifier rules) instead of allowing a leading digit, which
  made `export "$name"=...` fail and abort startup under `set -e`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 11:18:49 +02:00
alexbelgium
776d063161 fix(elasticsearch): upgrade to 8.19.18 with automatic data migration
The add-on reported version 8.14.3 but the shipped image was still
Elasticsearch 7.17.9 — the Dockerfile BUILD_UPSTREAM was never bumped,
and the builder uses that ARG. The homeassistant-elasticsearch
integration requires 8.14+, so configuration failed (#2849).

- Upgrade to Elasticsearch 8.19.18 (latest 8.x; 9.x cannot read indices
  created in 7.x)
- Add automatic 7.x -> 8.x data migration with a guard that aborts on
  unsupported paths (downgrade, or data more than one major behind).
  The version marker is written only after ES answers on 9200, so a
  failed upgrade never masks the true on-disk data lineage
- Default xpack.security.enabled=false to preserve plain-HTTP behavior
  the HA component expects; override via ES_SETTING_XPACK_SECURITY_ENABLED
- Fix the env_vars option, which never worked (the image has no
  s6-overlay, so the cont-init stack never ran)
- Remove the ingest-attachment plugin install (bundled since ES 8.0,
  which broke the 8.x build)
- Replace line-number-based entrypoint patching with a proper init
  script sourced via a pattern-anchored injection
- Add updater.json pinned to the 8.19 line to prevent version drift and
  accidental 9.x jumps

Fixes #2849

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 11:07:24 +02:00
42 changed files with 320 additions and 154 deletions

View File

@@ -162,7 +162,6 @@ DARKNAGAN,France
DDanii,
DMurzNN,
DUC750,
DY-hub,
DaFlowah,
DaJonas94,
Daafip,Netherlands
@@ -239,7 +238,6 @@ EtienneMD,
Evel270,
Everestlion,
EvertJob,
Exlatis,
Extrunder,
F0264,
F4bsi,Germany
@@ -565,7 +563,6 @@ PhoenixTwoFive,Germany
PhysShell,
PierreNa,France
PietroSpina,
Pingmin,
PiotrKrzyzek,United States
PiratesGhost,
Pixelzeus,
@@ -900,12 +897,10 @@ antorimba,
antx-code,
anyezhe,
aorosora,
araminimichael,
arbal,United States
ardemk,
ared469,
arethefreshest,
arozoire,
arpit-mehra,
artemave,France
artemdanielov,
@@ -1161,7 +1156,6 @@ danbruno,
danctrl,Germany
danez,United States
danieldotnl,Netherlands
danishru,
dannybeeckman,
dannybloomfield,United States
danveitch76,
@@ -1750,7 +1744,6 @@ ljsquare,
llabourdeth,
llewy,
llfjahn,
llugo,
lmalmoreno,Brazil
lnrdmx,
loc4t3llix,
@@ -2057,7 +2050,6 @@ pedrolicassali,
pedromfa,
pedrware,Portugal
peeetek,
peggleg,
pejannl,
pem884,United States
pepelatc,
@@ -2281,7 +2273,6 @@ skalingclouds,United States
skamaleo,
skavieller,
skipper00,
skoducks,United States
skylidefr,
skynet-network,
slimehands,
@@ -2541,7 +2532,6 @@ williamcorsel,Netherlands
willigenburggihaux,
willnewcombe,United Kingdom
wimb0,
wingerasc,
witold-gren,Poland
wonderfulhuber,
wonkygecko,United States
1 username country
162 DDanii
163 DMurzNN
164 DUC750
DY-hub
165 DaFlowah
166 DaJonas94
167 Daafip Netherlands
238 Evel270
239 Everestlion
240 EvertJob
Exlatis
241 Extrunder
242 F0264
243 F4bsi Germany
563 PhysShell
564 PierreNa France
565 PietroSpina
Pingmin
566 PiotrKrzyzek United States
567 PiratesGhost
568 Pixelzeus
897 antx-code
898 anyezhe
899 aorosora
araminimichael
900 arbal United States
901 ardemk
902 ared469
903 arethefreshest
arozoire
904 arpit-mehra
905 artemave France
906 artemdanielov
1156 danctrl Germany
1157 danez United States
1158 danieldotnl Netherlands
danishru
1159 dannybeeckman
1160 dannybloomfield United States
1161 danveitch76
1744 llabourdeth
1745 llewy
1746 llfjahn
llugo
1747 lmalmoreno Brazil
1748 lnrdmx
1749 loc4t3llix
2050 pedromfa
2051 pedrware Portugal
2052 peeetek
peggleg
2053 pejannl
2054 pem884 United States
2055 pepelatc
2273 skamaleo
2274 skavieller
2275 skipper00
skoducks United States
2276 skylidefr
2277 skynet-network
2278 slimehands
2532 willigenburggihaux
2533 willnewcombe United Kingdom
2534 wimb0
wingerasc
2535 witold-gren Poland
2536 wonderfulhuber
2537 wonkygecko United States

Binary file not shown.

Before

Width:  |  Height:  |  Size: 331 KiB

After

Width:  |  Height:  |  Size: 63 KiB

View File

@@ -35,7 +35,6 @@ jobs:
git fetch origin "${{ github.event.before }}" || true
changed_changelog_files=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" | grep -iE '^([^/]+/)?changelog\.(md|txt|ya?ml|json)$' || true)
echo "$changed_changelog_files"
echo "changelogs_files=$changed_changelog_files" >> "$GITHUB_OUTPUT"
changed_config_files=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" | grep -E '^[^/]+/config\.(json|ya?ml)$' || true)
echo "$changed_config_files"
all_changed_files=$(echo -e "$changed_config_files\n$changed_changelog_files" | sort -u)
@@ -209,7 +208,6 @@ jobs:
uses: docker/build-push-action@v7
with:
context: ${{ matrix.addon }}
platforms: linux/arm64
push: false
load: true
file: ${{ matrix.addon }}/Dockerfile

51
.github/workflows/pr2841-diagnostic.yml vendored Normal file
View File

@@ -0,0 +1,51 @@
---
name: Claude Add-on Build Diagnostic
on:
pull_request:
branches:
- master
jobs:
diagnose:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Gather add-on information
id: information
uses: frenck/action-addon-information@v1.4
with:
path: ./claude_desktop/
- name: Set up QEMU
uses: docker/setup-qemu-action@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Build aarch64 and capture tail
shell: bash
run: |
set +e
BUILD_FROM="$(jq -r '.build_from.aarch64 // empty' '${{ steps.information.outputs.build }}')"
docker buildx build \
--platform linux/arm64 \
--progress=plain \
--build-arg "BUILD_FROM=${BUILD_FROM}" \
--file claude_desktop/Dockerfile \
claude_desktop >build.log 2>&1
status=$?
tail -n 300 build.log >build-tail.log
printf 'build_status=%s\n' "$status" >build-status.txt
exit 0
- name: Upload diagnostic log
uses: actions/upload-artifact@v4
with:
name: claude-aarch64-build-log
path: |
build-tail.log
build-status.txt
retention-days: 1

View File

@@ -56,19 +56,19 @@ If you want to do add the repository manually, please follow the procedure highl
### Number of addons
- In the repository : 136
- Installed : 626324
- In the repository : 135
- Installed : 508490
### Top 3
1. Arpspoof (86665x)
2. Sponsorblockcast (82801x)
3. Jellyfin (71957x)
1. Arpspoof (59486x)
2. Sponsorblockcast (55582x)
3. Flaresolverr (44486x)
### Architectures used
- amd64: 90%
- aarch64: 10%
- amd64: 88%
- aarch64: 12%
### Stars evolution
@@ -77,7 +77,7 @@ If you want to do add the repository manually, please follow the procedure highl
## Add-ons provided by this repository
%%ADDONS_LIST%%
&#10003; [Arpspoof (86665x)](arpspoof/) : block internet connection for local network devices
&#10003; [Arpspoof (59486x)](arpspoof/) : block internet connection for local network devices
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Farpspoof%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Farpspoof%2Fupdater.json)
@@ -143,17 +143,6 @@ If you want to do add the repository manually, please follow the procedure highl
![amd64][amd64-badge]
![ingress][ingress-badge]
&#10003; ![image](https://api.iconify.design/mdi/bird.svg) [BirdNET-Pi (zach7036)](birdnet-pi-zach/) : Realtime acoustic bird classification system
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pi-zach%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pi-zach%2Fupdater.json)
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![mqtt][mqtt-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
&#10003; ![image](https://api.iconify.design/mdi/bird.svg) [BirdNET-PiPy](birdnet-pipy/) : BirdNET-PiPy bird detection with a modern web dashboard
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pipy%2Fconfig.yaml)
@@ -258,7 +247,7 @@ If you want to do add the repository manually, please follow the procedure highl
![amd64][amd64-badge]
![ingress][ingress-badge]
&#10003; ![image](https://api.iconify.design/mdi/robot-happy.svg) [Claude Desktop](claude_desktop/) : Claude Desktop and a persistent Claude Code web terminal
&#10003; ![image](https://api.iconify.design/mdi/robot-happy.svg) [Claude Desktop](claude_desktop/) : Claude Desktop streamed through a browser with LinuxServer Selkies
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fupdater.json)
@@ -519,7 +508,7 @@ If you want to do add the repository manually, please follow the procedure highl
![smb][smb-badge]
![localdisks][localdisks-badge]
&#10003; ![image](https://api.iconify.design/mdi/billiards-rack.svg) [Jellyfin (71957x) NAS](jellyfin/) : A free Software Media System that puts you in control of managing and streaming your media
&#10003; ![image](https://api.iconify.design/mdi/billiards-rack.svg) [Jellyfin NAS](jellyfin/) : A free Software Media System that puts you in control of managing and streaming your media
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjellyfin%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjellyfin%2Fupdater.json)
@@ -582,7 +571,7 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![amd64][amd64-badge]
&#10003; ![image](https://api.iconify.design/mdi/movie-search.svg) [Maintainerr](maintainerr/) : Rule-based media cleanup tool for Plex, Jellyfin (71957x) and Emby. Creates collections and optionally deletes unwatched content.
&#10003; ![image](https://api.iconify.design/mdi/movie-search.svg) [Maintainerr](maintainerr/) : Rule-based media cleanup tool for Plex, Jellyfin and Emby. Creates collections and optionally deletes unwatched content.
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fmaintainerr%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fmaintainerr%2Fupdater.json)
@@ -896,7 +885,7 @@ If you want to do add the repository manually, please follow the procedure highl
![smb][smb-badge]
![localdisks][localdisks-badge]
&#10003; ![image](https://api.iconify.design/mdi/movie-search.svg) [Seerr](seerr/) : Open-source media request and discovery manager for Jellyfin (71957x), Plex, and Emby
&#10003; ![image](https://api.iconify.design/mdi/movie-search.svg) [Seerr](seerr/) : Open-source media request and discovery manager for Jellyfin, Plex, and Emby
&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fseerr%2Fconfig.yaml)
![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fseerr%2Fupdater.json)

View File

@@ -1,7 +1,4 @@
## 1.76.52 (2026-07-11)
- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
## 1.76.51 (2026-06-17)
- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
## 1.76.49 (2026-06-05)

View File

@@ -1,5 +1,5 @@
name: Aurral
version: "1.76.52"
version: "1.76.51"
slug: aurral
description: >-
Self-hosted music discovery, request management, flows, and playlist

View File

@@ -1,9 +1,9 @@
{
"last_update": "2026-07-11",
"last_update": "2026-06-17",
"repository": "alexbelgium/hassio-addons",
"slug": "aurral",
"source": "github",
"upstream_repo": "lklynet/aurral",
"upstream_version": "1.76.52",
"upstream_version": "1.76.51",
"github_beta": false
}

View File

@@ -1,7 +1,4 @@
## 0.8.3 (2026-07-11)
- Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
## 0.8.2.1 (2026-07-05)
- Re-tag of 0.8.2-1 with no content change. Home Assistant compares add-on versions with semver semantics, where a `-N` suffix counts as a *pre-release* and sorts **below** the base version — so users already on 0.8.2 saw the 0.8.2-1 nginx fix as "Up-to-date" with the Update button disabled. Four-segment `0.8.2.1` sorts above both `0.8.2` and `0.8.2-1` (and below the next upstream `0.8.3`), so the update becomes installable everywhere.

View File

@@ -96,4 +96,4 @@ schema:
ssl: bool?
slug: birdnet-pipy
url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
version: "0.8.3"
version: "0.8.2.1"

View File

@@ -1,8 +1,8 @@
{
"last_update": "2026-07-11",
"last_update": "2026-07-04",
"repository": "alexbelgium/hassio-addons",
"slug": "birdnet-pipy",
"source": "github",
"upstream_repo": "Suncuss/BirdNET-PiPy",
"upstream_version": "0.8.3"
"upstream_version": "0.8.2"
}

View File

@@ -1,7 +1,4 @@
## 1.92.139-ls112 (2026-07-11)
- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
## 1.92.134-ls109 (2026-07-04)
- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)

View File

@@ -69,5 +69,5 @@ slug: brave
tmpfs: true
udev: true
url: https://github.com/alexbelgium/hassio-addons
version: "1.92.139-ls112"
version: "1.92.134-ls109"
video: true

View File

@@ -1,9 +1,9 @@
{
"github_fulltag": "true",
"last_update": "2026-07-11",
"last_update": "2026-07-04",
"repository": "alexbelgium/hassio-addons",
"slug": "brave",
"source": "github",
"upstream_repo": "linuxserver/docker-brave",
"upstream_version": "1.92.139-ls112"
"upstream_version": "1.92.134-ls109"
}

View File

@@ -1,7 +1,4 @@
## version-30a7c401 (2026-07-11)
- Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
## version-7148c2a3 (2026-07-04)
- Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)

View File

@@ -71,5 +71,5 @@ slug: chromium
tmpfs: true
udev: true
url: https://github.com/alexbelgium/hassio-addons
version: "version-30a7c401"
version: "version-7148c2a3"
video: true

View File

@@ -1,9 +1,9 @@
{
"github_fulltag": "true",
"last_update": "2026-07-11",
"last_update": "2026-07-04",
"repository": "alexbelgium/hassio-addons",
"slug": "chromium",
"source": "github",
"upstream_repo": "linuxserver/docker-chromium",
"upstream_version": "version-30a7c401"
"upstream_version": "version-7148c2a3"
}

View File

@@ -1,12 +1,3 @@
## 1.14 (10-07-2026)
- Build pinned RTK 0.43.0 source on Debian Bookworm for both architectures instead of installing the upstream arm64 release binary, which requires GLIBC 2.39 and cannot run in the add-on image.
- Execute `rtk --version` inside the final image during the Docker build so future ABI incompatibilities fail CI instead of surfacing at runtime.
- Validate the final Bookworm-built RTK binary in a native aarch64 image build.
- Correct the repository PR checks so changed changelog paths are exported and aarch64 images are built explicitly for `linux/arm64`.
## debiantrixie-version-c55d3809 (2026-07-11)
- Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
## 1.13 (10-07-2026)
- Add the official Claude Code stable package, `tmux`, `ripgrep`, and a pinned upstream `ttyd` binary for both supported architectures.

View File

@@ -9,22 +9,6 @@
ARG BUILD_FROM
ARG BUILD_VERSION
ARG RTK_VERSION="v0.43.0"
ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
# The upstream aarch64 release is cross-built on ubuntu-latest and requires
# GLIBC 2.39. Build the pinned source on Bookworm instead so it is compatible
# with the add-on runtime on both supported architectures.
FROM rust:1.91-bookworm AS rtk-builder
ARG RTK_VERSION
ARG RTK_COMMIT
RUN git clone --depth 1 --branch "${RTK_VERSION}" https://github.com/rtk-ai/rtk.git /src/rtk && \
test "$(git -C /src/rtk rev-parse HEAD)" = "${RTK_COMMIT}" && \
cd /src/rtk && \
cargo build --release --locked && \
install -D -m 0755 target/release/rtk /out/rtk && \
/out/rtk --version
FROM ${BUILD_FROM}
##################
@@ -45,7 +29,7 @@ VOLUME [ "/sys/fs/cgroup" ]
# hadolint ignore=SC2015,DL4006,SC2013,SC2086
RUN \
usermod --home /data/data abc && \
if [[ -d /etc/services.d ]] && ls /etc/services.d/*/run 1> /dev/"debiantrixie-version-c55d3809" 2>&1; then sed -i "1a set +e" /etc/services.d/*/run; fi
if [[ -d /etc/services.d ]] && ls /etc/services.d/*/run 1> /dev/null 2>&1; then sed -i "1a set +e" /etc/services.d/*/run; fi
ARG TEMPLATE_BASE_URL="https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates"
@@ -105,15 +89,15 @@ RUN set -eux; \
chmod 0755 /usr/local/bin/ttyd; \
/usr/local/bin/ttyd --version
# Copy the pinned Bookworm-built RTK binary and execute it in the final image.
# This makes an ABI mismatch fail the image build instead of surfacing at runtime.
COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
RUN /usr/local/bin/rtk --version
# Install only the Headroom proxy, code-compression, and MCP features used by this add-on.
RUN apt-get update && \
apt-get install -y --no-install-recommends nodejs && \
pip3 install --break-system-packages "headroom-ai[proxy,code,mcp]" && \
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh -o /tmp/rtk-install.sh && \
HOME=/root sh /tmp/rtk-install.sh && \
rm /tmp/rtk-install.sh && \
if [ -x /root/.local/bin/rtk ] && [ ! -x /usr/local/bin/rtk ]; then mv /root/.local/bin/rtk /usr/local/bin/rtk; fi && \
if [ -x /usr/local/bin/rtk ]; then chmod +x /usr/local/bin/rtk; else echo "rtk binary was not installed on PATH"; exit 1; fi && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* /root/.cache

View File

@@ -2,7 +2,7 @@ arch:
- aarch64
- amd64
audio: true
description: Claude Desktop and a persistent Claude Code web terminal
description: Claude Desktop with a persistent Claude Code web terminal in one add-on
devices:
- /dev/dri
- /dev/dri/card0
@@ -57,12 +57,12 @@ options:
panel_admin: false
panel_icon: mdi:robot-happy
ports:
3001/tcp: "debiantrixie-version-c55d3809"
7681/tcp: "debiantrixie-version-c55d3809"
3001/tcp: null
7681/tcp: null
8787/tcp: 8787
ports_description:
3001/tcp: Claude Desktop web interface
7681/tcp: Claude Code web terminal over HTTP Basic auth (no TLS)
7681/tcp: HTTP Basic-auth Claude Code terminal (no TLS)
8787/tcp: Headroom dashboard and proxy
privileged:
- SYS_ADMIN
@@ -100,5 +100,5 @@ slug: claude_desktop
tmpfs: true
udev: true
url: https://github.com/alexbelgium/hassio-addons
version: "1.14"
version: "1.13"
video: true

View File

@@ -3,7 +3,5 @@
"upstream_repo": "linuxserver/docker-baseimage-selkies",
"github_fulltag": true,
"slug": "claude_desktop",
"paused": false,
"upstream_version": "debiantrixie-version-c55d3809",
"last_update": "2026-07-11"
"paused": false
}

View File

@@ -1,7 +1,4 @@
## 2.9.16 (2026-07-11)
- Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
## 2.9.14 (2026-06-20)
- Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)

View File

@@ -11,7 +11,7 @@
#=== Home Assistant Addon ===#
# ARGs used in FROM must be declared before any FROM instruction
ARG BUILD_UPSTREAM="2.9.16"
ARG BUILD_UPSTREAM="2.9.14"
#################
# 1 Build Image #

View File

@@ -91,5 +91,5 @@ schema:
TZ: str?
slug: cleanuparr
url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
version: "2.9.16"
version: "2.9.14"
webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"

View File

@@ -1,8 +1,8 @@
{
"last_update": "2026-07-11",
"last_update": "2026-06-20",
"repository": "alexbelgium/hassio-addons",
"slug": "cleanuparr",
"source": "github",
"upstream_repo": "Cleanuparr/Cleanuparr",
"upstream_version": "2.9.16"
"upstream_version": "2.9.14"
}

View File

@@ -1,7 +1,4 @@
## 2.1.2 (2026-07-11)
- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
## 2.1.0 (2026-07-04)
- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)

View File

@@ -101,4 +101,4 @@ schema:
slug: codex
udev: true
url: https://github.com/alexbelgium/hassio-addons
version: "2.1.2"
version: "2.1.0"

View File

@@ -1,9 +1,9 @@
{
"github_beta": "true",
"last_update": "2026-07-11",
"last_update": "2026-07-04",
"repository": "alexbelgium/hassio-addons",
"slug": "codex",
"source": "github",
"upstream_repo": "ajslater/codex",
"upstream_version": "2.1.2"
"upstream_version": "2.1.0"
}

View File

@@ -1,3 +1,17 @@
## 8.19.18 (2026-07-14)
- Upgrade to Elasticsearch 8.19.18 (#2849). Note: despite the previous add-on version reading `8.14.3`, the shipped image was still Elasticsearch 7.17.9 — the Dockerfile upstream version was never bumped. This release actually delivers 8.x, making the add-on compatible with the `homeassistant-elasticsearch` integration (requires 8.14+).
- Automatic data migration: existing 7.17 data is upgraded in place by Elasticsearch on first start (one-way; can take a while on large datasets). A migration guard aborts with a clear message on unsupported paths (downgrades, or data more than one major version old). Take a Home Assistant backup before updating.
- The previous bundled config directory is archived to `/data/config.bak-<old-version>` during major upgrades; re-apply custom settings to the new config if needed.
- Security (`xpack.security.enabled`) defaults to `false` to preserve the previous plain-HTTP behavior. Override by adding `ES_SETTING_XPACK_SECURITY_ENABLED` (or any `ES_SETTING_XPACK_SECURITY_*` variable) in the add-on's `env_vars` option.
- Fixed the `env_vars` add-on option, which previously had no effect: variables are now exported before Elasticsearch starts.
- Removed the `ingest-attachment` plugin install: it is a bundled module since Elasticsearch 8.0.
- Startup persistence logic rewritten as a proper init script (`/usr/local/bin/addon-init.sh`) instead of line-number-based entrypoint patching.
- Added `updater.json` so upstream 8.19.x releases are tracked automatically (pinned to the 8.19 line: 9.x cannot read indices created in 7.x).
- The upstream 8.x image ends the build as a non-root user with a read-only entrypoint; the Dockerfile now switches to root for the build steps that patch/install into it. The image stays root at runtime too (unchanged from 7.17.9): the upstream entrypoint no longer drops privileges itself, and `addon-init.sh` needs to chown/move pre-existing `/data` content that may be owned by root from earlier installs.
- `env_vars` names starting with a digit are now rejected before export instead of crashing the entrypoint.
- Fixed a startup failure (`mv: cannot move '/data/config' ... Permission denied`) on upgrade from an existing 7.17.9 install, caused by an earlier fix in this same release that switched the runtime user to non-root before this fix was in place.
## 8.14.3-3 (2026-06-19)
- Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)
- Fix AppArmor profile name (was `inadyn_addon`, colliding with several other add-ons); renamed to `elasticsearch_addon`

View File

@@ -14,9 +14,14 @@
# 1 Build Image #
#################
ARG BUILD_UPSTREAM="7.17.9"
ARG BUILD_UPSTREAM="8.19.18"
FROM elasticsearch:$BUILD_UPSTREAM
# The base image ends as USER 1000:0 with a root-owned, read-only (0555)
# entrypoint; switch back to root for the remaining build steps (entrypoint
# patch, package install, chmod), then restore the Elasticsearch user below
USER root
##################
# 2 Modify Image #
##################
@@ -26,20 +31,15 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
S6_SERVICES_GRACETIME=0
# Expose the upstream version to the add-on init script (migration guard)
ARG BUILD_UPSTREAM
ENV UPSTREAM_VERSION="$BUILD_UPSTREAM"
# Data persistence
# hadolint ignore=SC2016
RUN sed -i '5a echo "Data location moved. Please wait while elasticsearch starts..."' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a chown -R $(id -u):$(id -g) $HOME' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a done' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a ln -s $NEWHOME/$file /usr/share/elasticsearch || true' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a rm -r /usr/share/elasticsearch/$file || true' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a cp -rn /usr/share/elasticsearch/$file $NEWHOME || true' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a for file in "data" "config"; do' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a mkdir -p $NEWHOME' /usr/local/bin/docker-entrypoint.sh \
&& sed -i '5a NEWHOME="/data"' /usr/local/bin/docker-entrypoint.sh \
# Install plugins
&& /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch ingest-attachment
# Data persistence & migration: source the add-on init script at the top of
# the official entrypoint (pattern-anchored; ingest-attachment is bundled
# since ES 8.0 so no plugin install is needed anymore)
RUN sed -i '/^set -e$/a . /usr/local/bin/addon-init.sh' /usr/local/bin/docker-entrypoint.sh \
&& grep -q "addon-init.sh" /usr/local/bin/docker-entrypoint.sh
##################
# 3 Install apps #
@@ -62,7 +62,7 @@ COPY ha_automodules.sh /ha_automodules.sh
RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
# Manual apps
ENV PACKAGES=""
ENV PACKAGES="jq"
# Automatic apps & bashio
COPY ha_autoapps.sh /ha_autoapps.sh
@@ -140,3 +140,10 @@ HEALTHCHECK \
--start-period=30s \
--timeout=25s \
CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
# Stay root at runtime: addon-init.sh must chown/mv pre-existing /data
# content that may be owned by root from earlier installs, and the upstream
# entrypoint no longer drops privileges itself, so a non-root container
# can't touch that data at all. This matches the addon's own AppArmor
# profile (chown, setuid, setgid, sys_chroot, mount capabilities), which
# assumes a root process.

View File

@@ -91,6 +91,22 @@ Connect other applications to Elasticsearch using:
Use the add-on `env_vars` option to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
Elasticsearch settings can be set through variables named `ES_SETTING_<SETTING_WITH_UNDERSCORES>`; for example `ES_SETTING_XPACK_SECURITY_ENABLED` maps to `xpack.security.enabled`.
### Security
To preserve the plain-HTTP behavior of previous versions (and compatibility with the Home Assistant Elasticsearch integration), `xpack.security.enabled` defaults to `false`. To enable Elasticsearch security, add `ES_SETTING_XPACK_SECURITY_ENABLED` with value `true` in `env_vars`.
## Upgrading from 7.x
The upgrade to Elasticsearch 8.x is automatic and **one-way**:
1. Take a Home Assistant backup of the add-on before updating.
2. Update the add-on and start it. Elasticsearch upgrades the existing indices in place on first start — this can take a while on large datasets; do **not** stop the add-on during the first start.
3. The previous bundled config directory is archived to `/data/config.bak-<old-version>`; re-apply any custom settings to the new config.
Downgrading afterwards is not supported by Elasticsearch — restore the backup instead.
## Integration with HA
Component : https://community.home-assistant.io/t/elasticsearch-component-publish-home-assistant-events-to-elasticsearch/66877

View File

@@ -90,4 +90,4 @@ slug: elasticsearch
startup: services
udev: true
url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
version: 8.14.3-3
version: 8.19.18

View File

@@ -1 +0,0 @@
#!/bin/bash

View File

@@ -0,0 +1,143 @@
#!/bin/bash
# shellcheck shell=bash
# Sourced by /usr/local/bin/docker-entrypoint.sh (right after "set -e"),
# before Elasticsearch starts. Runs as root (the image stays root at
# runtime - see Dockerfile); the official entrypoint does not drop
# privileges itself, and Elasticsearch ends up running as root too.
#
# Responsibilities:
# 1. Export user env_vars from /data/options.json
# 2. Default xpack.security.enabled=false (7.x behavior) unless user overrides
# 3. Relocate data & config to /data for persistence (idempotent)
# 4. Guard major-version data migrations (7.x -> 8.x is automatic)
echo "-----------------------------------------------------------"
echo " Add-on: Elasticsearch server"
echo " Upstream version: ${UPSTREAM_VERSION:-unknown}"
echo "-----------------------------------------------------------"
ES_HOME="/usr/share/elasticsearch"
PERSISTENT_HOME="/data"
VERSION_MARKER="$PERSISTENT_HOME/.addon-upstream-version"
OPTIONS_JSON="/data/options.json"
############################
# 1 Export user env_vars #
############################
if [ -f "$OPTIONS_JSON" ] && command -v jq >/dev/null 2>&1; then
while IFS= read -r pair; do
name=$(jq -r '.name // empty' <<<"$pair")
value=$(jq -r '.value // empty' <<<"$pair")
if [[ $name =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
echo "Setting env variable from options: $name"
export "$name"="$value"
elif [ -n "$name" ]; then
echo "WARNING: ignoring invalid env_vars name: $name"
fi
done < <(jq -c '.env_vars[]?' "$OPTIONS_JSON" 2>/dev/null || true)
fi
##################################
# 2 Security default (7.x parity)#
##################################
# ES 8+ enables security + TLS by default, which breaks plain-http clients
# such as the homeassistant-elasticsearch component. Keep the previous 7.x
# behavior unless the user explicitly configures xpack.security themselves
# (either as a dotted setting or via the ES_SETTING_* translation).
if ! env | grep -qiE '^(xpack\.security\.|ES_SETTING_XPACK_SECURITY_)'; then
export ES_SETTING_XPACK_SECURITY_ENABLED=false
echo "Security: xpack.security.enabled=false (default; override by setting ES_SETTING_XPACK_SECURITY_ENABLED in env_vars)"
fi
############################
# 3 Migration guard #
############################
current_version="${UPSTREAM_VERSION:-0.0.0}"
current_major="${current_version%%.*}"
data_version=""
if [ -f "$VERSION_MARKER" ]; then
data_version="$(head -n 1 "$VERSION_MARKER" | tr -cd '0-9.')"
elif [ -d "$PERSISTENT_HOME/data" ] && [ -n "$(ls -A "$PERSISTENT_HOME/data" 2>/dev/null)" ]; then
# Existing data without a marker: only 7.17.9 was ever shipped before markers
data_version="7.17.9"
fi
if [ -n "$data_version" ] && [[ $current_major =~ ^[0-9]+$ ]]; then
data_major="${data_version%%.*}"
if [ "$data_major" -gt "$current_major" ]; then
echo "FATAL: existing data was written by Elasticsearch $data_version but this add-on runs $current_version."
echo "Downgrading Elasticsearch data is not supported. Restore a Home Assistant snapshot taken with the newer version, or delete the add-on data to start fresh."
exit 1
elif [ "$((current_major - data_major))" -gt 1 ]; then
echo "FATAL: existing data was written by Elasticsearch $data_version, which is more than one major version behind $current_version."
echo "Elasticsearch can only upgrade data from the previous major version. Upgrade stepwise (e.g. $data_major.x -> $((data_major + 1)).x -> ...) or delete the add-on data to start fresh."
exit 1
elif [ "$data_major" -lt "$current_major" ]; then
echo "NOTICE: one-time automatic data migration from Elasticsearch $data_version to $current_version."
echo "NOTICE: indices are upgraded automatically on startup. This can take a while on large datasets - do NOT stop the add-on during the first start."
# The bundled config from the old major is stale (jvm.options, log4j2,
# security settings). Archive it so a fresh one is seeded below.
if [ -d "$PERSISTENT_HOME/config" ] && [ ! -L "$PERSISTENT_HOME/config" ]; then
config_backup="$PERSISTENT_HOME/config.bak-$data_version"
if [ ! -e "$config_backup" ]; then
mv "$PERSISTENT_HOME/config" "$config_backup"
echo "NOTICE: previous config archived to $config_backup. Re-apply any custom settings to the new config."
fi
fi
# The container config dir may still symlink to the archived config
if [ -L "$ES_HOME/config" ]; then
rm -f "$ES_HOME/config"
fi
fi
fi
############################
# 4 Data persistence #
############################
mkdir -p "$PERSISTENT_HOME"
for dir in "data" "config"; do
if [ ! -L "$ES_HOME/$dir" ]; then
if [ -d "$ES_HOME/$dir" ]; then
cp -rn "$ES_HOME/$dir" "$PERSISTENT_HOME" 2>/dev/null || true
rm -rf "${ES_HOME:?}/$dir"
fi
mkdir -p "$PERSISTENT_HOME/$dir"
ln -s "$PERSISTENT_HOME/$dir" "$ES_HOME/$dir"
fi
done
# Make the persisted files usable by the elasticsearch user (uid 1000),
# which the official entrypoint drops to when started as root
if [ "$(id -u)" -eq 0 ]; then
chown -R 1000:0 "$PERSISTENT_HOME/data" "$PERSISTENT_HOME/config" 2>/dev/null || true
fi
echo "Data location: $PERSISTENT_HOME (persistent). Please wait while elasticsearch starts..."
############################
# 5 Record data version #
############################
# Only record the running version once ES is confirmed healthy, so a failed
# upgrade attempt never masks the true on-disk data lineage
if [ "$data_version" != "$current_version" ]; then
(
for _ in $(seq 1 180); do
# Check the HTTP status directly instead of curl -f: a 401 means
# Elasticsearch is up and answering (security just requires
# auth), so it must count as healthy too, not as a failure.
status=$(curl -A "HealthCheck: Docker/1.0" -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:9200" 2>/dev/null || true)
if [ "$status" = "200" ] || [ "$status" = "401" ]; then
echo "$current_version" >"$VERSION_MARKER"
echo "Elasticsearch $current_version started successfully; data version recorded."
exit 0
fi
sleep 10
done
) &
fi

View File

@@ -0,0 +1,10 @@
{
"github_fulltag": false,
"github_tagfilter": "v8.19",
"last_update": "14-07-2026",
"repository": "alexbelgium/hassio-addons",
"slug": "elasticsearch",
"source": "github",
"upstream_repo": "elastic/elasticsearch",
"upstream_version": "8.19.18"
}

View File

@@ -1,7 +1,4 @@
## 4.10.0.18 (2026-07-11)
- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
## 4.10.0.17 (2026-07-04)
- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)

View File

@@ -16,7 +16,7 @@
ARG BUILD_FROM
ARG BUILD_VERSION
ARG BUILD_UPSTREAM="4.10.0.18"
ARG BUILD_UPSTREAM="4.10.0.17"
FROM ${BUILD_FROM}
##################

View File

@@ -122,5 +122,5 @@ schema:
slug: emby_nas
udev: true
url: https://github.com/alexbelgium/hassio-addons/tree/master/emby
version: "4.10.0.18"
version: "4.10.0.17"
video: true

View File

@@ -1,9 +1,9 @@
{
"github_beta": "true",
"last_update": "2026-07-11",
"last_update": "2026-07-04",
"repository": "alexbelgium/hassio-addons",
"slug": "emby",
"source": "github",
"upstream_repo": "linuxserver/docker-emby",
"upstream_version": "4.10.0.18"
"upstream_version": "4.10.0.17"
}

View File

@@ -1,13 +1,15 @@
## 2.14.1 (19-06-2026)
- Minor bugs fixed
# Changelog
## 2.14.1-1 (11-07-2026)
- Persist Let's Encrypt certificates across restarts by symlinking /etc/letsencrypt to /data/letsencrypt (#2828) — thanks to @crazyrokr for reporting and suggesting the fix
## 2.14.1 (19-06-2026)
## 2.14.1
- Fix startup failure on aarch64/HAos: "/usr/bin/env: 'bash': Permission denied" (#2777)
- Add s6-overlay/env/with-contenv exec rules to AppArmor profile
## 2.14.0 (01-05-2026)
## 2.14.0
- Minor bugs fixed
## 2.14.0
- Initial release wrapping jc21/nginx-proxy-manager:latest
- NPM Admin UI on port 81; HTTP on port 80; HTTPS on port 443
- Configurable static file server via NPM's default_host nginx config

View File

@@ -1,13 +1,14 @@
name: "Nginx Proxy Manager + Static Web Server"
slug: nginx_webserver_proxy
description: "Nginx Proxy Manager with a built-in configurable static file server. Manage reverse proxies via NPM UI on port 81 while serving files from HA storage on port 80."
version: "2.14.1-1"
version: "2.14.1"
url: "https://github.com/alexbelgium/hassio-addons/tree/master/nginx_webserver_proxy"
arch:
- amd64
- aarch64
startup: services
init: false
ports:
80/tcp: 80
81/tcp: 81
@@ -16,19 +17,24 @@ ports_description:
80/tcp: "HTTP (static site + NPM proxy hosts)"
81/tcp: "NPM Admin Web UI"
443/tcp: "HTTPS (NPM proxy hosts)"
webui: "http://[HOST]:[PORT:81]"
map:
- addon_config:rw
- share:rw
- media:rw
options:
static_site_enabled: true
static_site_root: "/share/www"
static_site_prefix: "/"
log_level: "info"
schema:
static_site_enabled: bool
static_site_root: str
static_site_prefix: str
log_level: list(info|debug|warn|error)
image: "ghcr.io/alexbelgium/nginx_webserver_proxy-{arch}"

View File

@@ -111,19 +111,8 @@ fi
# ---------------------------------------------------------------------------
log "static_site_root=${STATIC_ROOT} prefix=${STATIC_PREFIX} log_level=${LOG_LEVEL}"
# NPM's prepare service requires /etc/letsencrypt to exist.
# Symlink /etc/letsencrypt to /data/letsencrypt for persistence across restarts.
# Supervisor persists /data as a Docker volume; /etc/letsencrypt would otherwise be ephemeral.
if [ ! -L /etc/letsencrypt ]; then
if [ -d /etc/letsencrypt ] && [ "$(ls -A /etc/letsencrypt 2> /dev/null)" ]; then
# Abort migration on copy failure so we never rm -rf certs that weren't copied.
mkdir -p /data/letsencrypt
cp -a /etc/letsencrypt/. /data/letsencrypt/ \
|| die "Failed to migrate /etc/letsencrypt to /data/letsencrypt; leaving existing certs intact"
fi
rm -rf /etc/letsencrypt
ln -sf /data/letsencrypt /etc/letsencrypt
fi
mkdir -p /data/letsencrypt
# HA Supervisor maps the ssl volume there automatically; for other environments create it.
mkdir -p /etc/letsencrypt
log "Handing off to NPM: exec /init"
exec /init