Portainer Agent: use alpine-sts upstream image (#3011)

* fix(portainer-agent): use alpine-sts upstream image

* fix(portainer-agent): align STS updater versioning

calibre_web/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 0.6.27.2 (2026-08-23)
+- Fix: trust the whole supervisor network range for the ingress auth header instead of the addon's own address, which changes across restarts. The list is only written when that range is missing, so an entry added in the calibre-web admin page is no longer erased on every start (https://github.com/alexbelgium/hassio-addons/pull/3010)
+
 ## 0.6.27.1 (2026-08-23)
 - Fix: Ingress login was rejected since 0.6.27, which only accepts the reverse proxy auth header from trusted source addresses. The addon now adds its own ip to that list (https://github.com/alexbelgium/hassio-addons/issues/3003)
 

calibre_web/config.yaml

@@ -116,5 +116,5 @@ schema:
 slug: calibre-web
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/calibre_web
-version: "0.6.27.1"
+version: "0.6.27.2"
 video: true

calibre_web/rootfs/etc/cont-init.d/80-configuration.sh

@@ -19,25 +19,19 @@ if [ ! -f /config/app.db ]; then
 else
     sqlite3 /config/app.db 'update settings set config_reverse_proxy_login_header_name="X-WebAuth-User",config_allow_reverse_proxy_header_login=1'
 
-    # Calibre-web 0.6.27 only accepts the ingress auth header from a trusted source address, and
+    # Calibre-web 0.6.27 only accepts that header from a trusted source address, and defaults the
-    # defaults that list to "127.0.0.1,::1". Nginx binds its upstream socket to the addon ip
+    # list to "127.0.0.1,::1". Ingress reaches calibre-web from the addon's own address on the
-    # (proxy_bind $server_addr in ingress.conf) and calibre-web listens dual-stack, so it sees
+    # supervisor network (proxy_bind $server_addr in ingress.conf) and calibre-web listens
-    # ::ffff:<addon ip> and drops the header. Both the plain and the ipv4-mapped forms are listed
+    # dual-stack, so it sees ::ffff:<addon ip> and drops the header. The supervisor range is
-    # because an ipv4 entry never matches an ipv6-mapped address on the calibre-web side.
+    # listed in both forms because an ipv4 entry never matches an ipv4-mapped address.
-    # The column only exists once calibre-web 0.6.27+ has migrated app.db, so a failure here is
+    # Prepended to whatever is already there, and only when the mapped form is missing : that form
-    # not fatal : the next start applies it.
+    # is the one ingress needs and the one nobody types by hand, so it doubles as the marker that
-    addon_ip=$(bashio::addon.ip_address)
+    # this already ran. Anything the user added is kept, the statement runs at most once, and the
-    trusted_ips="127.0.0.1,::1,::ffff:127.0.0.1"
+    # duplicates it can leave behind are entries calibre-web skips or already trusts.
-    if bashio::var.has_value "${addon_ip}"; then
+    # The column only exists once calibre-web 0.6.27+ has migrated app.db and cont-init runs
-        trusted_ips="${trusted_ips},${addon_ip},::ffff:${addon_ip}"
+    # before calibre-web, so a failure here is not fatal : the next start applies it.
-    fi
+    trusted_ips_error=$(sqlite3 /config/app.db "update settings set config_reverse_proxy_trusted_ips='127.0.0.1,::1,::ffff:127.0.0.1,172.30.32.0/23,::ffff:172.30.32.0/119,'||coalesce(config_reverse_proxy_trusted_ips,'') where coalesce(config_reverse_proxy_trusted_ips,'') not like '%::ffff:172.30.32.0/119%'" 2>&1) ||
-    trusted_ips_error=$(sqlite3 /config/app.db "update settings set config_reverse_proxy_trusted_ips='${trusted_ips}'" 2>&1) || {
+        bashio::log.warning "Could not set the ingress trusted ip list, it will be applied at next start (${trusted_ips_error})"
-        if echo "${trusted_ips_error}" | grep -q "no such column"; then
-            bashio::log.warning "Could not set the ingress trusted ip list, it will be applied at next start"
-        else
-            bashio::log.warning "Could not set the ingress trusted ip list: ${trusted_ips_error}"
-        fi
-    }
 fi
 
 bashio::log.info "Default username:password is admin:admin123"

portainer_agent/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.44.0 (2026-08-23)
+
+- Fix: Use `portainer/agent:alpine-sts` to match the STS release channel configured in `updater.json`
+- Fix: Align add-on versioning with Portainer STS releases
+
 ## 2025.12.7 (2026-08-23)
 
 - Fix: Docker reported the addon as `unhealthy` in Portainer. The healthcheck script could never run because its shebang required the s6-overlay environment, which this addon's entrypoint does not set up (https://github.com/alexbelgium/hassio-addons/issues/3002)

portainer_agent/Dockerfile

@@ -18,7 +18,7 @@
 ARG BUILD_FROM
 
 # Get agent
-FROM portainer/agent:alpine as original_agent
+FROM portainer/agent:alpine-sts as original_agent
 ENV PORTAINER_AGENT_ARGS=""
 
 # Build using base

portainer_agent/config.yaml

@@ -41,4 +41,4 @@ schema:
 slug: portainer_agent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2025.12.7"
+version: "2.44.0"

portainer_agent/updater.json

@@ -1,6 +1,6 @@
 {
-  "github_tagfilter": "alpine",
+  "github_tagfilter": "sts",
-  "last_update": "24-12-2025",
+  "last_update": "23-08-2026",
   "repository": "alexbelgium/hassio-addons",
   "slug": "portainer_agent",
   "source": "dockerhub",