GitHub bot : README updated

Reported from a remote session: ingress answered
`403 External internet access denied - https://sabnzbd.org/access-denied`.

Root cause is `check_access()` in `sabnzbd/interface.py`:

    # Never check the XFF header unless access would have been granted
    # based on the remote IP alone!
    if is_allowed and cfg.verify_xff_header() and (xff_ips := ...):
        is_allowed = all(is_local_addr(ip) or is_loopback_addr(ip)
                         for ip in xff_ips)

nginx's own address is loopback, so the first test passes, and then every
address in X-Forwarded-For has to be local too. Supervisor puts the browser's
address in that header, so anyone reaching Home Assistant from outside the LAN
is refused. `verify_xff_header` defaults to on (`cfg.py:531`), so this is not a
configuration a user opted into.

Reproduced against the running add-on, `GET /config/general/`:

    no X-Forwarded-For                    200
    X-Forwarded-For: 81.164.12.7          403  External internet access denied
    X-Forwarded-For: 81.164.12.7, 172.30.32.2  403
    X-Forwarded-For: 192.168.1.44         200

which is why it worked on the LAN and not from outside. Verified the fix the
same way, running the shipped nginx.conf and ingress.conf in front of the live
add-on with both variants side by side: the current config 403s on a public
address, the fixed one answers 200 for all three chains, and redirects, static
roots and the API are unaffected. That instance has an empty `url_base`, so the
pass-through routing is now confirmed for both `url_base` values.

The header was forwarded because SABnzbd reads it — the wrong test, since what
it does with it is reject. Clearing it leaves SABnzbd looking at nginx's
loopback address, which is what it saw before the header was added; ingress is
gated by Home Assistant authentication before reaching this proxy either way.

The evidence.md entry records the methodology error, per the skill's own
feed-the-skill rule.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/SKILL.md

@@ -169,7 +169,9 @@ CI gates on a PR: **`CHANGELOG.md` updated** (hard fail), the **HA add-on linter
 (`frenck/action-addon-linter`, blocking — not the weekly Super-Linter, which is non-blocking), and
 the **add-on image build**. Bump `version` anyway (`X.Y.Z.N`, never `X.Y.Z-N`, see
 `references/traps.md#versioning`) — Supervisor won't offer a rebuild without it. Update
-`README.md` if you added options; match the CHANGELOG heading format `## X.Y (DD-MM-YYYY)`.
+`README.md` if you added options; write the CHANGELOG heading as `## <version> (<date>)`,
+matching the date format already in that file — almost always ISO `YYYY-MM-DD`, see
+`references/traps.md#ci-and-review-bots`.
 
 Write the body to a file, `gh pr create --body-file`: state what was measured, what changed,
 **what is not verified**, and how to roll back the riskiest hunk alone.

.claude/skills/hassio-addon-workflow/references/evidence.md

@@ -34,6 +34,12 @@ then generalising it to all hosts.**
   would have deleted a user's hand-written configuration.
 - A GPU probe created a hardware context — but that proved the driver worked, not that Chromium's
   GPU path did.
+- SABnzbd's source was grepped to see which proxy headers it reads, and `X-Forwarded-For` was
+  forwarded because it reads that one — but `verify_xff_header` is on by default and makes it
+  *reject* every address in the chain that is not local, so ingress answered 403 for anyone
+  reaching Home Assistant from outside the LAN (#3019, fixed in #3023). Every check ran from
+  inside the container, where no such header exists. **That an app reads a header is not a reason
+  to send it — find out what it does with it, and exercise the path a remote user takes.**
 
 The pattern is always *inference standing in for detection*. Before changing a default, ask what
 this is like on a host unlike yours. Prefer detecting the condition at runtime over asserting it.

.claude/skills/hassio-addon-workflow/references/traps.md

@@ -241,6 +241,16 @@ account. Note it and move on rather than guessing.
 **Resolving a review thread requires GraphQL** (`resolveReviewThread`); the REST API cannot do it.
 `scripts/pr_review.sh` wraps fetch / reply / resolve.
 
+**CHANGELOG heading dates are ISO, whatever the bots' defaults say.** Match the format already in
+the add-on's file. Repo-wide that is `## <version> (YYYY-MM-DD)`: 7705 dated headings against 363
+in `DD-MM-YYYY`, and the newest entry is ISO in 125 of 135 add-ons. Copilot flags an ISO file that
+gets a `DD-MM-YYYY` entry (#3019). `DD-MM-YYYY` is not invented — it is what `onpush_builder.yaml`
+writes with `date '+%d-%m-%Y'` when it has to insert a heading you forgot, and what the
+addons_updater bot writes when its `date_iso8601` option is off (`99-run.sh`; it is on in
+production here) — but neither is a reason to write it yourself. The builder's duplicate check is
+`grep -q "^## ${version} ("`, keyed on the exact `config.yaml` version and blind to the date, so
+an ISO heading you wrote yourself still suppresses the bot's insertion.
+
 **The repo's `.markdownlint.yaml` does not disable MD022/MD032**, so a CHANGELOG will show
 dozens of pre-existing heading/list findings. They are noise because lint is `continue-on-error`,
 not because the config exempts them — don't cite the config as a reason to ignore a finding.

README.md

@@ -934,6 +934,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fsabnzbd%2Fupdater.json)
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
+![ingress][ingress-badge]
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 

sabnzbd/CHANGELOG.md

@@ -1,4 +1,11 @@
  
+## 5.1.1.3 (2026-08-25)
+- Fixed ingress returning `403 External internet access denied` when Home Assistant is reached from outside the local network. SABnzbd's `verify_xff_header` option, which is on by default, refuses any request whose `X-Forwarded-For` chain contains a non-local address, so the proxy no longer forwards that header.
+
+## 5.1.1.2 (2026-08-25)
+- Ingress is now enabled: the WebUI opens directly in the Home Assistant sidebar, and the "Open Web UI" button now goes there. Access by ip:port is unchanged, but has to be typed rather than clicked, as Home Assistant does not allow an add-on to offer both.
+- Note for users who set a "Host verification" whitelist in SABnzbd: ingress sends `Host: 127.0.0.1:8080` upstream, because SABnzbd rejects any Host that is not an IP literal. That whitelist therefore no longer filters the ingress route, which is gated by Home Assistant authentication instead. Direct ip:port access is unchanged and still filtered.
+
 ## 5.1.1 (2026-08-22)
 - Update to latest version from linuxserver/docker-sabnzbd (changelog : https://github.com/linuxserver/docker-sabnzbd/releases)
  

sabnzbd/config.yaml

@@ -70,7 +70,7 @@ environment:
   PGID: "0"
   PUID: "0"
 image: ghcr.io/alexbelgium/sabnzbd-{arch}
-ingress_entry: sabnzbd
+ingress: true
 init: false
 map:
   - addon_config:rw
@@ -106,5 +106,4 @@ schema:
 slug: sabnzbd
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.1.1"
-webui: http://[HOST]:[PORT:8080]
+version: "5.1.1.3"

sabnzbd/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -1,21 +1,14 @@
 #!/usr/bin/with-contenv bashio
 # shellcheck shell=bash
-# shellcheck disable=SC2317
 set -e
 
 #################
 # NGINX SETTING #
 #################
 
-exit 0
-
 ingress_port=$(bashio::addon.ingress_port)
 ingress_interface=$(bashio::addon.ip_address)
+ingress_entry=$(bashio::addon.ingress_entry)
 sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf
 sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf
-
-# Allows serving js
-sed -i 's/<!-- %if-not-debug% -->/<!-- %if-not-debug%  /g' /app/sabnzbd/webui/index.html
-sed -i 's/<!-- %end% -->/   %end% -->/g' /app/sabnzbd/webui/index.html
-sed -i 's/<!-- %if-debug%/<!-- %if-debug% -->/g' /app/sabnzbd/webui/index.html
-sed -i 's/	%end% -->/<!-- 	%end% -->/g' /app/sabnzbd/webui/index.html
+sed -i "s|%%ingress_entry%%|${ingress_entry}|g" /etc/nginx/servers/ingress.conf

sabnzbd/rootfs/etc/nginx/servers/ingress.conf

@@ -2,22 +2,41 @@ server {
     listen %%interface%%:%%port%% default_server;
 
     include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
 
     client_max_body_size 0;
 
-   location / {
-       add_header Access-Control-Allow-Origin *;
-       proxy_connect_timeout 30m;
-       proxy_send_timeout 30m;
-       proxy_read_timeout 30m;
-       proxy_pass         http://127.0.0.1:8080;
+    location / {
+        proxy_pass http://127.0.0.1:8080;
 
-       proxy_set_header Accept-Encoding "";
-      # Correct url without port when using https
-      sub_filter_once off;
-      sub_filter_types *;
-      sub_filter /sabnzbd %%ingress_entry%%/sabnzbd;
-  }
+        # SABnzbd refuses any request whose Host is not an IP literal
+        # ("Access denied - Hostname verification failed"), so send the
+        # upstream socket rather than the browser's host.
+        proxy_set_header Host            $proxy_host;
 
+        # X-Forwarded-For must NOT be forwarded. verify_xff_header defaults to
+        # on, and check_access() then requires every address in the header to
+        # be local, so Supervisor's copy of the browser's public address makes
+        # SABnzbd answer 403 "External internet access denied" for anyone
+        # reaching Home Assistant from outside the LAN. Clearing it leaves
+        # SABnzbd looking at nginx's own loopback address. Access is gated by
+        # Home Assistant authentication before it ever reaches this proxy.
+        proxy_set_header X-Forwarded-For "";
+
+        # The interface itself only emits relative links, so no body
+        # rewriting is needed. Redirects are the exception: Raiser() emits
+        # a path under url_base, so prefix them with the ingress entry.
+        # absolute_redirect must stay off, or nginx expands the rewritten
+        # Location into http://<browser host>:<ingress port>/..., a port the
+        # browser cannot reach.
+        proxy_redirect    / %%ingress_entry%%/;
+        absolute_redirect off;
+
+        # The login cookie is hardcoded to Path=/, which on the ingress
+        # origin would send it to every other add-on's ingress path too.
+        proxy_cookie_path / %%ingress_entry%%/;
+
+        proxy_http_version 1.1;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
 }

sabnzbd/rootfs/etc/services.d/nginx/finish

@@ -0,0 +1,9 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Stop the container when Nginx fails, so ingress does not silently go dead
+# ==============================================================================
+if [[ "$1" -ne 0 && "$1" -ne 256 ]]; then
+    bashio::log.error "Nginx exited with code $1"
+    kill -15 1
+fi

sabnzbd/rootfs/etc/services.d/nginx/run

@@ -0,0 +1,11 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+# Wait for sabnzbd to become available
+bashio::net.wait_for 8080 localhost 900
+
+bashio::log.info "Starting NGinx..."
+
+exec nginx