docs(skill): narrow the ISO claim and correct the grep description

Review fixes. The bolded lead read as an absolute while the body reported 363
DD-MM-YYYY headings and told you to match the file — it now says "most", and
says outright that a DD-MM-YYYY file stays DD-MM-YYYY. The counts are stamped
as of 2026-08-25 so a future reader knows they are a snapshot.

CodeRabbit is right that `grep -q "^## ${version} ("` is not an exact-version
check. Reproduced: with version 5.1.1.2 the pattern matches a heading reading
`## 5X1Y1Z2 (`, because BRE dots match any character; `grep -qF` does not.
Described as an unescaped BRE instead. The conclusion is unchanged, since the
date is not in the pattern either way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/SKILL.md

@@ -169,7 +169,9 @@ CI gates on a PR: **`CHANGELOG.md` updated** (hard fail), the **HA add-on linter
 (`frenck/action-addon-linter`, blocking — not the weekly Super-Linter, which is non-blocking), and
 the **add-on image build**. Bump `version` anyway (`X.Y.Z.N`, never `X.Y.Z-N`, see
 `references/traps.md#versioning`) — Supervisor won't offer a rebuild without it. Update
-`README.md` if you added options; match the CHANGELOG heading format `## X.Y (DD-MM-YYYY)`.
+`README.md` if you added options; write the CHANGELOG heading as `## <version> (<date>)`,
+matching the date format already in that file — almost always ISO `YYYY-MM-DD`, see
+`references/traps.md#ci-and-review-bots`.
 
 Write the body to a file, `gh pr create --body-file`: state what was measured, what changed,
 **what is not verified**, and how to roll back the riskiest hunk alone.

.claude/skills/hassio-addon-workflow/references/traps.md

@@ -241,6 +241,18 @@ account. Note it and move on rather than guessing.
 **Resolving a review thread requires GraphQL** (`resolveReviewThread`); the REST API cannot do it.
 `scripts/pr_review.sh` wraps fetch / reply / resolve.
 
+**Most CHANGELOG heading dates are ISO, whatever the bots' defaults say.** Match the format
+already in the add-on's file — a `DD-MM-YYYY` file stays `DD-MM-YYYY`. Where you have no
+precedent, ISO is the house style: as of 2026-08-25, `## <version> (YYYY-MM-DD)` accounts for
+7705 dated headings against 363 in `DD-MM-YYYY`, and the newest entry is ISO in 125 of 135
+add-ons. Copilot flags an ISO file that gets a `DD-MM-YYYY` entry (#3019). `DD-MM-YYYY` is not
+invented — it is what `onpush_builder.yaml` writes with `date '+%d-%m-%Y'` when it has to insert
+a heading you forgot, and what the addons_updater bot writes when its `date_iso8601` option is
+off (`99-run.sh`; it is on in production here) — but neither is a reason to write it yourself.
+The builder's duplicate check is `grep -q "^## ${version} ("` — an unescaped BRE, so the dots in
+a version match any character, and it does not look at the date at all. Either way an ISO heading
+you wrote yourself still suppresses the bot's insertion.
+
 **The repo's `.markdownlint.yaml` does not disable MD022/MD032**, so a CHANGELOG will show
 dozens of pre-existing heading/list findings. They are noise because lint is `continue-on-error`,
 not because the config exempts them — don't cite the config as a reason to ignore a finding.

sabnzbd/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 5.1.1.2 (2026-08-25)
+- Ingress is now enabled: the WebUI opens directly in the Home Assistant sidebar, and the "Open Web UI" button now goes there. Access by ip:port is unchanged, but has to be typed rather than clicked, as Home Assistant does not allow an add-on to offer both.
+- Note for users who set a "Host verification" whitelist in SABnzbd: ingress sends `Host: 127.0.0.1:8080` upstream, because SABnzbd rejects any Host that is not an IP literal. That whitelist therefore no longer filters the ingress route, which is gated by Home Assistant authentication instead. Direct ip:port access is unchanged and still filtered.
+
 ## 5.1.1 (2026-08-22)
 - Update to latest version from linuxserver/docker-sabnzbd (changelog : https://github.com/linuxserver/docker-sabnzbd/releases)
  

sabnzbd/config.yaml

@@ -70,7 +70,7 @@ environment:
   PGID: "0"
   PUID: "0"
 image: ghcr.io/alexbelgium/sabnzbd-{arch}
-ingress_entry: sabnzbd
+ingress: true
 init: false
 map:
   - addon_config:rw
@@ -106,5 +106,4 @@ schema:
 slug: sabnzbd
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.1.1"
-webui: http://[HOST]:[PORT:8080]
+version: "5.1.1.2"

sabnzbd/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -1,21 +1,14 @@
 #!/usr/bin/with-contenv bashio
 # shellcheck shell=bash
-# shellcheck disable=SC2317
 set -e
 
 #################
 # NGINX SETTING #
 #################
 
-exit 0
-
 ingress_port=$(bashio::addon.ingress_port)
 ingress_interface=$(bashio::addon.ip_address)
+ingress_entry=$(bashio::addon.ingress_entry)
 sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf
 sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf
-
-# Allows serving js
-sed -i 's/<!-- %if-not-debug% -->/<!-- %if-not-debug%  /g' /app/sabnzbd/webui/index.html
-sed -i 's/<!-- %end% -->/   %end% -->/g' /app/sabnzbd/webui/index.html
-sed -i 's/<!-- %if-debug%/<!-- %if-debug% -->/g' /app/sabnzbd/webui/index.html
-sed -i 's/	%end% -->/<!-- 	%end% -->/g' /app/sabnzbd/webui/index.html
+sed -i "s|%%ingress_entry%%|${ingress_entry}|g" /etc/nginx/servers/ingress.conf

sabnzbd/rootfs/etc/nginx/servers/ingress.conf

@@ -2,22 +2,34 @@ server {
     listen %%interface%%:%%port%% default_server;
 
     include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
 
     client_max_body_size 0;
 
-   location / {
-       add_header Access-Control-Allow-Origin *;
-       proxy_connect_timeout 30m;
-       proxy_send_timeout 30m;
-       proxy_read_timeout 30m;
-       proxy_pass         http://127.0.0.1:8080;
+    location / {
+        proxy_pass http://127.0.0.1:8080;
 
-       proxy_set_header Accept-Encoding "";
-      # Correct url without port when using https
-      sub_filter_once off;
-      sub_filter_types *;
-      sub_filter /sabnzbd %%ingress_entry%%/sabnzbd;
-  }
+        # SABnzbd refuses any request whose Host is not an IP literal
+        # ("Access denied - Hostname verification failed"), so send the
+        # upstream socket rather than the browser's host. X-Forwarded-For is
+        # the only other header it reads (for its verify_xff_header option).
+        proxy_set_header Host            $proxy_host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
+        # The interface itself only emits relative links, so no body
+        # rewriting is needed. Redirects are the exception: Raiser() emits
+        # a path under url_base, so prefix them with the ingress entry.
+        # absolute_redirect must stay off, or nginx expands the rewritten
+        # Location into http://<browser host>:<ingress port>/..., a port the
+        # browser cannot reach.
+        proxy_redirect    / %%ingress_entry%%/;
+        absolute_redirect off;
+
+        # The login cookie is hardcoded to Path=/, which on the ingress
+        # origin would send it to every other add-on's ingress path too.
+        proxy_cookie_path / %%ingress_entry%%/;
+
+        proxy_http_version 1.1;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
 }

sabnzbd/rootfs/etc/services.d/nginx/finish

@@ -0,0 +1,9 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Stop the container when Nginx fails, so ingress does not silently go dead
+# ==============================================================================
+if [[ "$1" -ne 0 && "$1" -ne 256 ]]; then
+    bashio::log.error "Nginx exited with code $1"
+    kill -15 1
+fi

sabnzbd/rootfs/etc/services.d/nginx/run

@@ -0,0 +1,11 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+# Wait for sabnzbd to become available
+bashio::net.wait_for 8080 localhost 900
+
+bashio::log.info "Starting NGinx..."
+
+exec nginx