fix: guard addon config symlink creation

refactor: simplify addon config symlink setup
fix: harden addon config migration
2026-06-20 06:19:14 +02:00 · 2026-06-03 06:19:02 +00:00 · 2026-06-03 06:18:23 +00:00 · 2026-06-03 06:17:39 +00:00 · 2026-06-03 06:17:00 +00:00 · 2026-06-03 05:19:00 +00:00
19 changed files with 321 additions and 297 deletions
--- a/README.md
+++ b/README.md
@@ -321,7 +321,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]

-&#10003; ![image](https://api.iconify.design/mdi/file-search.svg) [FileBrowser Quantum](filebrowser_quantum/) : FileBrowser Quantum provides a modern, responsive file manager with multi-source support, advanced authentication options, and realtime indexing for your Home Assistant files
+&#10003; ![image](https://api.iconify.design/mdi/file-search.svg) [FileBrowser Quantum](filebrowser_quantum/) : FileBrowser Quantum provides a modern, responsive file manager with multi-source support, advanced authentication options, and realtime indexing for your Home Assistant files.

 &emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Ffilebrowser_quantum%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Ffilebrowser_quantum%2Fupdater.json)
--- a/birdnet-go/CHANGELOG.md
+++ b/birdnet-go/CHANGELOG.md
@@ -1,5 +1,3 @@
-## nightly-20260601-2 (03-06-2026)
- Minor bugs fixed
 ## nightly-20260601 (2026-06-01)
 - Update to latest version from tphakala/birdnet-go (changelog : https://github.com/tphakala/birdnet-go/releases)
 ## nightly-20260524 (2026-05-30)
--- a/birdnet-go/config.yaml
+++ b/birdnet-go/config.yaml
@@ -126,4 +126,4 @@ slug: birdnet-go
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-go
 usb: true
-version: "nightly-20260601-2"
+version: "nightly-20260601"
--- a/birdnet-go/rootfs/etc/cont-init.d/99-run.sh
+++ b/birdnet-go/rootfs/etc/cont-init.d/99-run.sh
@@ -38,7 +38,7 @@ fi

 bashio::log.info "Starting app..."
 # shellcheck disable=SC2086
-/usr/bin/entrypoint.sh /usr/bin/startup-wrapper.sh birdnet-go realtime &
+/usr/bin/entrypoint.sh birdnet-go realtime &
 true

 # Wait for app to become available to start nginx
--- a/ente/CHANGELOG.md
+++ b/ente/CHANGELOG.md
@@ -1,31 +1,3 @@
-## 4.4.22-7 (04-06-2026)
- Disable the per-account storage limit by default via the new NO_STORAGE_LIMIT
-  option (default true). Grants every account 100 TB and ~100 years validity,
-  equivalent to `ente admin update-subscription --no-limit`. Set to false to
-  keep Ente's default storage limits.
-## 4.4.22-6 (04-06-2026)
- Fix SIGPIPE (exit 141) on startup: tr piped to head -c against /dev/urandom
-  now suppresses the expected SIGPIPE under set -o pipefail
-## 4.4.22-5 (04-06-2026)
- Fix AppArmor profile name (was copied from qbittorrent, could collide with that add-on)
- Expose Accounts (3001), Auth (3003) and Cast (3004) ports so the login/2FA web apps are reachable
- Default external Postgres port to 5432 when DB_PORT is left blank
- Write the correct DB host/port to museum.yaml when using an external database
- Exclude minio-data and postgres folders from Home Assistant backups
-## 4.4.22-4 (04-06-2026)
- Minor bugs fixed
-## 4.4.22-3 (04-06-2026)
- Remove DISABLE_WEB_UI option, web UI is now always enabled
- Make MinIO internal-only (127.0.0.1) since museum proxies S3 operations
- Fix web UI API origin: use ENTE_ENDPOINT_URL so browsers can reach the API
- Hardcode MinIO credentials internally (no longer user-configurable)
- Remove dead options: MINIO_DATA_LOCATION, MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
-
-## 4.4.22-2 (04-06-2026)
- Minor bugs fixed
-
-## 4.4.23 (2026-06-03)
- Fix nginx rewrite loop on /index.html causing 500 Internal Server Error in Web UI

 ## 4.4.22 (2026-05-16)
 - Update to latest version from ente-io/ente (changelog : https://github.com/ente-io/ente/releases)
--- a/ente/Dockerfile
+++ b/ente/Dockerfile
@@ -6,7 +6,7 @@
 ########################################################
 # 0) Build the ente-web static front-end (multi-stage) #
 ########################################################
-FROM node:24 AS web-builder
+FROM node:22-bookworm-slim AS web-builder

 # Build-time selector; set `--build-arg ENTE_WEB_TAG=vX.Y.Z` if you want a specific release
 ARG ENTE_WEB_TAG=main
@@ -15,7 +15,7 @@ ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

-# Tools needed to build (git, rust for ente-wasm)
+# Tools needed to build (git, rust, wasm-pack, yarn classic)
 RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
@@ -23,10 +23,17 @@ RUN set -eux; \
      curl \
      ca-certificates \
      build-essential \
+      pkg-config \
+      python3 \
    ; \
    rm -rf /var/lib/apt/lists/*; \
    \
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --target wasm32-unknown-unknown
+    curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable; \
+    rustup target add wasm32-unknown-unknown; \
+    \
+    corepack enable; \
+    corepack prepare yarn@1.22.22 --activate; \
+    npm install -g wasm-pack@0.13.1

 # Pull the web source
 WORKDIR /src
@@ -34,20 +41,16 @@ RUN git clone --depth 1 --branch "${ENTE_WEB_TAG}" https://github.com/ente-io/en

 # Build web workspace (lives in ./web)
 WORKDIR /src/web
-ENV NEXT_PUBLIC_ENTE_ENDPOINT=ENTE_API_ORIGIN_PLACEHOLDER
-ENV NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=ENTE_ALBUMS_ORIGIN_PLACEHOLDER
+ENV NEXT_PUBLIC_ENTE_ENDPOINT=ENTE_API_ORIGIN_PLACEHOLDER \
+    NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT=ENTE_ALBUMS_ORIGIN_PLACEHOLDER

-RUN npm ci
-RUN npm run build:photos
-RUN npm run build:albums
-RUN npm run build:accounts
-RUN npm run build:auth
-RUN npm run build:cast
-RUN npm run build:share
-RUN npm run build:embed
-RUN npm run build:paste
-RUN npm run build:locker
-RUN npm run build:memories
+RUN set -eux; \
+    yarn config set network-timeout 900000 -g; \
+    yarn install --frozen-lockfile; \
+    yarn build:photos; \
+    yarn build:accounts; \
+    yarn build:auth; \
+    yarn build:cast

 #################
 # 1) Base image #
@@ -91,15 +94,9 @@ RUN apk add --no-cache nginx

 # Static files built in the previous stage
 COPY --from=web-builder /src/web/apps/photos/out    /www/photos
-COPY --from=web-builder /src/web/apps/albums/out    /www/albums
 COPY --from=web-builder /src/web/apps/accounts/out  /www/accounts
 COPY --from=web-builder /src/web/apps/auth/out      /www/auth
 COPY --from=web-builder /src/web/apps/cast/out      /www/cast
-COPY --from=web-builder /src/web/apps/share/out     /www/share
-COPY --from=web-builder /src/web/apps/embed/out     /www/embed
-COPY --from=web-builder /src/web/apps/paste/out     /www/paste
-COPY --from=web-builder /src/web/apps/locker/out    /www/locker
-COPY --from=web-builder /src/web/apps/memories/out  /www/memories

 ############################
 # 3) Install add-on helpers #
@@ -154,4 +151,4 @@ LABEL \
 #################
 # 6) Finish line
 #################
-EXPOSE 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009
+EXPOSE 3000 3001 3002 3003 3004
--- a/ente/README.md
+++ b/ente/README.md
@@ -53,9 +53,12 @@ Webui can be found at <http://homeassistant:PORT>.

 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
-| `ENTE_ENDPOINT_URL` | str | `http://homeassistant.local:8280` | The URL where Ente API will be accessible (used by web UI) |
+| `ENTE_ENDPOINT_URL` | str | `http://homeassistant.local:8280` | The URL where Ente API will be accessible |
+| `MINIO_ROOT_USER` | str | `minioadmin` | MinIO root username |
+| `MINIO_ROOT_PASSWORD` | str | `minioadmin` | MinIO root password |
+| `MINIO_DATA_LOCATION` | str | `/config/minio-data` | Path where MinIO stores data |
 | `DB_PASSWORD` | str | `ente` | Database password for internal PostgreSQL |
-| `NO_STORAGE_LIMIT` | bool | `true` | Remove the per-account storage limit (grants every account 100 TB and ~100 years validity, equivalent to `ente admin update-subscription --no-limit`). Set to `false` to keep the default Ente storage limits. |
+| `DISABLE_WEB_UI` | bool | `true` | Disable the web UI (use mobile/desktop apps) |
 | `USE_EXTERNAL_DB` | bool | `false` | Use external PostgreSQL database |
 | `TZ` | str | `Europe/Paris` | Timezone setting |

@@ -74,7 +77,11 @@ If you want to use an external PostgreSQL database, set `USE_EXTERNAL_DB: true`

 ```yaml
 ENTE_ENDPOINT_URL: "http://homeassistant.local:8280"
+MINIO_ROOT_USER: "myuser"
+MINIO_ROOT_PASSWORD: "mypassword"
+MINIO_DATA_LOCATION: "/config/ente-storage"
 DB_PASSWORD: "securepassword"
+DISABLE_WEB_UI: false
 TZ: "America/New_York"
 ```

@@ -130,21 +137,11 @@ After starting the addon for the first time:

 ## Ports

-The addon exposes the following ports:
+The addon exposes three ports:

- **8300** (3000/tcp): Ente web UI
- **8301** (3001/tcp): Ente Accounts
- **8302** (3002/tcp): Ente Albums
- **8303** (3003/tcp): Ente Auth
- **8304** (3004/tcp): Ente Cast
- **8305** (3005/tcp): Ente Share
- **8306** (3006/tcp): Ente Embed
- **8307** (3007/tcp): Ente Paste
- **8308** (3008/tcp): Ente Locker
- **8309** (3009/tcp): Ente Memories
+- **8300** (3000/tcp): Ente web UI (if enabled)
 - **8280** (8080/tcp): Ente API server (museum) - Main endpoint for apps
-
-MinIO S3 is internal-only (127.0.0.1:3200) and not exposed externally since museum proxies all S3 operations.
+- **8320** (3200/tcp): MinIO S3 endpoint (for storage backend)

 ## Data Storage

--- a/ente/apparmor.txt
+++ b/ente/apparmor.txt
@@ -1,6 +1,6 @@
 #include <tunables/global>

-profile ente_addon flags=(attach_disconnected,mediate_deleted) {
+profile db21ed7f_qbittorrent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

  capability chown,
@@ -43,6 +43,7 @@ profile ente_addon flags=(attach_disconnected,mediate_deleted) {
  /init rix,
  /var/run/** mrwkl,
  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
  # Files required
  /dev/fuse mrwkl,
  /dev/sda1 mrwkl,
--- a/ente/build.json
+++ b/ente/build.json
@@ -1,6 +1,6 @@
 {
  "build_from": {
-    "aarch64": "ghcr.io/ente-io/server:927c6a316f181c7901446311f0085593b346b336",
-    "amd64": "ghcr.io/ente-io/server:927c6a316f181c7901446311f0085593b346b336"
+    "aarch64": "ghcr.io/ente-io/server:latest",
+    "amd64": "ghcr.io/ente-io/server:latest"
  }
 }
--- a/ente/config.yaml
+++ b/ente/config.yaml
@@ -1,9 +1,6 @@
 arch:
  - aarch64
  - amd64
-backup_exclude:
-  - "**/minio-data/**"
-  - "**/postgres/**"
 description:
  Self-hosted, end-to-end-encrypted photo & video storage (Ente server
  + MinIO)
@@ -81,33 +78,20 @@ name: Ente
 options:
  env_vars: []
  DB_PASSWORD: ente
+  DISABLE_WEB_UI: true
  ENTE_ENDPOINT_URL: http://homeassistant.local:8280
-  NO_STORAGE_LIMIT: true
+  MINIO_DATA_LOCATION: /config/minio-data
+  MINIO_ROOT_PASSWORD: minioadmin
+  MINIO_ROOT_USER: minioadmin
  TZ: Europe/Paris
  USE_EXTERNAL_DB: false
 ports:
  3000/tcp: 8300
-  3001/tcp: 8301
-  3002/tcp: 8302
-  3003/tcp: 8303
-  3004/tcp: 8304
-  3005/tcp: 8305
-  3006/tcp: 8306
-  3007/tcp: 8307
-  3008/tcp: 8308
-  3009/tcp: 8309
+  3200/tcp: 8320
  8080/tcp: 8280
 ports_description:
  3000/tcp: Ente web UI
-  3001/tcp: Ente Accounts
-  3002/tcp: Ente Albums
-  3003/tcp: Ente Auth
-  3004/tcp: Ente Cast
-  3005/tcp: Ente Share
-  3006/tcp: Ente Embed
-  3007/tcp: Ente Paste
-  3008/tcp: Ente Locker
-  3009/tcp: Ente Memories
+  3200/tcp: MinIO S3 endpoint
  8080/tcp: Ente API (museum)
 privileged:
  - SYS_ADMIN
@@ -121,8 +105,11 @@ schema:
  DB_PASSWORD: str
  DB_PORT: int?
  DB_USERNAME: str?
+  DISABLE_WEB_UI: bool?
  ENTE_ENDPOINT_URL: str
-  NO_STORAGE_LIMIT: bool?
+  MINIO_DATA_LOCATION: str
+  MINIO_ROOT_PASSWORD: str
+  MINIO_ROOT_USER: str
  TZ: str?
  USE_EXTERNAL_DB: bool?
  cifsdomain: str?
@@ -133,6 +120,6 @@ schema:
 slug: ente
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "4.4.22-7"
+version: "4.4.22"
 video: true
 webui: http://[HOST]:[PORT:3000]
--- a/ente/rootfs/etc/cont-init.d/99-run.sh
+++ b/ente/rootfs/etc/cont-init.d/99-run.sh
@@ -2,32 +2,14 @@
 # shellcheck shell=bash
 set -euo pipefail

-# Internal MinIO credentials (not user-configurable; MinIO is 127.0.0.1 only)
-MINIO_CRED_FILE="/config/minio-creds"
-if [ -f "$MINIO_CRED_FILE" ]; then
-    # Reuse persisted credentials across restarts
-    MINIO_USER="$(sed -n '1p' "$MINIO_CRED_FILE")"
-    MINIO_PASS="$(sed -n '2p' "$MINIO_CRED_FILE")"
-    # Regenerate if file is corrupted
-    if [ -z "$MINIO_USER" ] || [ -z "$MINIO_PASS" ]; then
-        MINIO_USER="minio_$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 8 || true)"
-        MINIO_PASS="$(head -c 24 /dev/urandom | base64 | tr -d '\n')"
-        printf '%s\n%s\n' "$MINIO_USER" "$MINIO_PASS" > "$MINIO_CRED_FILE"
-        chmod 600 "$MINIO_CRED_FILE"
-    fi
-else
-    # Generate random credentials on first run
-    MINIO_USER="minio_$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 8 || true)"
-    MINIO_PASS="$(head -c 24 /dev/urandom | base64 | tr -d '\n')"
-    printf '%s\n%s\n' "$MINIO_USER" "$MINIO_PASS" > "$MINIO_CRED_FILE"
-    chmod 600 "$MINIO_CRED_FILE"
-fi
+MINIO_USER="$(bashio::config 'MINIO_ROOT_USER')"
+MINIO_PASS="$(bashio::config 'MINIO_ROOT_PASSWORD')"
 S3_BUCKET="b2-eu-cen"

 export ENTE_S3_ARE_LOCAL_BUCKETS=true
 export ENTE_S3_B2_EU_CEN_KEY="$MINIO_USER"
 export ENTE_S3_B2_EU_CEN_SECRET="$MINIO_PASS"
-export ENTE_S3_B2_EU_CEN_ENDPOINT="http://127.0.0.1:3200"
+export ENTE_S3_B2_EU_CEN_ENDPOINT="http://192.168.178.23:$(bashio::addon.port "3200")"
 export ENTE_S3_B2_EU_CEN_REGION=eu-central-2
 export ENTE_S3_B2_EU_CEN_BUCKET="$S3_BUCKET"

@@ -51,8 +33,6 @@ DB_PASS="$(bashio::config 'DB_PASSWORD' || echo ente)"
 # External DB opts (may be blank)
 DB_HOST_EXT="$(bashio::config 'DB_HOSTNAME' || echo '')"
 DB_PORT_EXT="$(bashio::config 'DB_PORT' || echo '')"
-# Default external Postgres port when unset
-[ -z "$DB_PORT_EXT" ] && DB_PORT_EXT=5432

 USE_EXTERNAL_DB=false
 if bashio::config.true 'USE_EXTERNAL_DB'; then
@@ -62,11 +42,9 @@ else
    bashio::log.info "Using internal Postgres."
 fi

-# Disable per-account storage limits by default (mirrors `ente admin
-# update-subscription --no-limit`). Set NO_STORAGE_LIMIT=false to keep limits.
-NO_STORAGE_LIMIT=true
-if bashio::config.false 'NO_STORAGE_LIMIT'; then
-    NO_STORAGE_LIMIT=false
+DISABLE_WEB_UI=false
+if bashio::config.true 'DISABLE_WEB_UI'; then
+    DISABLE_WEB_UI=true
 fi

 # Active DB connection target (may be overridden below)
@@ -117,8 +95,8 @@ jwt:
  secret: $(_rand_b64url 32)

 db:
-  host:     ${DB_HOST}
-  port:     ${DB_PORT}
+  host:     ${DB_HOST_INTERNAL}
+  port:     ${DB_PORT_INTERNAL}
  name:     ${DB_NAME}
  user:     ${DB_USER}
  password: ${DB_PASS}
@@ -208,11 +186,9 @@ bootstrap_internal_db() {
 # MinIO
 ############################################
 start_minio() {
-    bashio::log.info "Starting MinIO (127.0.0.1:3200)..."
+    bashio::log.info "Starting MinIO (:3200)..."
    mkdir -p /config/minio-data
-    export MINIO_ROOT_USER="$MINIO_USER"
-    export MINIO_ROOT_PASSWORD="$MINIO_PASS"
-    "$MINIO_BIN" server /config/minio-data --address "127.0.0.1:3200" --console-address "127.0.0.1:9001" &
+    "$MINIO_BIN" server /config/minio-data --address ":3200" &
    MINIO_PID=$!
 }

@@ -230,10 +206,13 @@ wait_minio_ready_and_bucket() {
 # Web (static nginx bundle)
 ############################################
 start_web() {
-    ENTE_API_ORIGIN="$(bashio::config 'ENTE_ENDPOINT_URL')"
-    # Derive albums origin from the same host as the API endpoint, mapped to port 8302
-    ENTE_ALBUMS_HOST="$(echo "$ENTE_API_ORIGIN" | sed -E 's#(https?://[^:/]+).*#\1#')"
-    ENTE_ALBUMS_ORIGIN="${ENTE_ALBUMS_HOST}:8302"
+    if $DISABLE_WEB_UI; then
+        bashio::log.info "Web UI disabled."
+        return 0
+    fi
+
+    ENTE_API_ORIGIN=http://localhost:8080
+    ENTE_ALBUMS_ORIGIN=http://localhost:3002
    export ENTE_API_ORIGIN ENTE_ALBUMS_ORIGIN

    # Running ente-web-prepare
@@ -243,53 +222,14 @@ start_web() {

    mkdir -p /run/nginx /var/log/nginx

-    # Set nginx (idempotent: only move if .bak still exists)
-    if [ -f /etc/nginx/http.d/web.bak ]; then
-        mv /etc/nginx/http.d/web.bak /etc/nginx/http.d/web.conf
-    fi
+    # Set nginx
+    mv /etc/nginx/http.d/web.bak /etc/nginx/http.d/web.conf

-    bashio::log.info "Starting Ente web (nginx, ports 3000‑3009)..."
-    nginx -g 'daemon off;' &
+    bashio::log.info "Starting Ente web (nginx, ports 3000‑3004)..."
+    exec nginx -g 'daemon off;' &
    WEB_PID=$!
 }

-############################################
-# Storage limit (no-limit) reconcile
-############################################
-# Equivalent of `ente admin update-subscription --no-limit`: grant every
-# account 100 TB of storage and ~100 years of validity. The Ente CLI only
-# supports this per-user and interactively, so to make it the default for all
-# current and future accounts we reconcile the museum `subscriptions` table
-# directly (the method documented by the Ente maintainers). Runs in the
-# background and re-applies periodically so newly registered users are covered.
-NO_LIMIT_STORAGE_BYTES=109951162777600 # 100 * 1024^4 (100 TiB)
-NO_LIMIT_EXPIRY_SQL="(extract(epoch from now() + interval '100 years') * 1000000)::bigint"
-
-reconcile_no_limit() {
-    export PGPASSWORD="$DB_PASS"
-    while true; do
-        # Storage is the limit that actually enforces quota; apply it first and
-        # independently so a schema change to other columns can't block it.
-        psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" \
-            -c "UPDATE subscriptions SET storage = ${NO_LIMIT_STORAGE_BYTES} WHERE storage < ${NO_LIMIT_STORAGE_BYTES};" \
-            > /dev/null 2>&1 || true
-        psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" \
-            -c "UPDATE subscriptions SET expiry_time = ${NO_LIMIT_EXPIRY_SQL} WHERE expiry_time < ${NO_LIMIT_EXPIRY_SQL};" \
-            > /dev/null 2>&1 || true
-        sleep 60
-    done
-}
-
-start_no_limit_reconcile() {
-    if ! $NO_STORAGE_LIMIT; then
-        bashio::log.info "NO_STORAGE_LIMIT disabled; per-account storage limits stay in effect."
-        return 0
-    fi
-    bashio::log.info "NO_STORAGE_LIMIT enabled; granting unlimited storage to all accounts."
-    reconcile_no_limit &
-    NO_LIMIT_PID=$!
-}
-
 ############################################
 # Museum (API)
 ############################################
@@ -340,7 +280,5 @@ wait_minio_ready_and_bucket

 start_web

-start_no_limit_reconcile
-
 # Foreground — keeps container alive
 start_museum_foreground
--- a/ente/rootfs/etc/nginx/http.d/web.bak
+++ b/ente/rootfs/etc/nginx/http.d/web.bak
@@ -1,40 +1,20 @@
 server {
    listen 3000; root /www/photos;
-    location / { try_files $uri $uri.html /index.html =404; }
+    location / { try_files \$uri \$uri.html /index.html; }
 }
 server {
    listen 3001; root /www/accounts;
-    location / { try_files $uri $uri.html /index.html =404; }
+    location / { try_files \$uri \$uri.html /index.html; }
 }
 server {
-    listen 3002; root /www/albums;
-    location / { try_files $uri $uri.html /index.html =404; }
+    listen 3002; root /www/photos;
+    location / { try_files \$uri \$uri.html /index.html; }
 }
 server {
    listen 3003; root /www/auth;
-    location / { try_files $uri $uri.html /index.html =404; }
+    location / { try_files \$uri \$uri.html /index.html; }
 }
 server {
    listen 3004; root /www/cast;
-    location / { try_files $uri $uri.html /index.html =404; }
-}
-server {
-    listen 3005; root /www/share;
-    location / { try_files $uri $uri.html /index.html =404; }
-}
-server {
-    listen 3006; root /www/embed;
-    location / { try_files $uri $uri.html /index.html =404; }
-}
-server {
-    listen 3007; root /www/paste;
-    location / { try_files $uri $uri.html /index.html =404; }
-}
-server {
-    listen 3008; root /www/locker;
-    location / { try_files $uri $uri.html /index.html =404; }
-}
-server {
-    listen 3009; root /www/memories;
-    location / { try_files $uri $uri.html /index.html =404; }
+    location / { try_files \$uri \$uri.html /index.html; }
 }
--- a/filebrowser_quantum/CHANGELOG.md
+++ b/filebrowser_quantum/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.3.3-8 (2026-06-03)
- Add `default_user_scope` option: sets the FileBrowser source path and default user scope (must be an existing absolute directory path, defaults to `/`)
-
- Allow config persistence

 ## 1.3.3 (2026-05-19)
 - Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
--- a/filebrowser_quantum/Dockerfile
+++ b/filebrowser_quantum/Dockerfile
@@ -52,7 +52,7 @@ RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_auto
 # Manual apps
 ENV PACKAGES="bind-tools \
    nginx \
-    python3 yq"
+    python3"

 # Automatic apps & bashio
 COPY ha_autoapps.sh /ha_autoapps.sh
@@ -71,8 +71,7 @@ RUN chmod 777 /ha_entrypoint.sh
 COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
 RUN chmod 0755 /usr/local/lib/bashio-standalone.sh

-RUN sed -i "s|/command/with-contenv|/usr/bin/env|g" "/ha_entrypoint.sh" && \
-    [[ -f /etc/cont-init.d/01-config_yaml.sh ]] && rm -r /etc/cont-init.d/01-config_yaml.sh
+RUN sed -i "s|/command/with-contenv|/usr/bin/env|g" "/ha_entrypoint.sh"

 VOLUME [ "/data" ]
 WORKDIR /
@@ -115,4 +114,27 @@ LABEL \
 # 6 Healthcheck #
 #################

-# Upstream
+# Avoid spamming logs
+# hadolint ignore=SC2016
+RUN \
+    # Handle Apache configuration
+    if [ -d /etc/apache2/sites-available ]; then \
+        for file in /etc/apache2/sites-*/*.conf; do \
+            sed -i '/<VirtualHost/a \ \n    # Match requests with the custom User-Agent "HealthCheck" \n    SetEnvIf User-Agent "HealthCheck" dontlog \n    # Exclude matching requests from access logs \n    CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog' "$file"; \
+        done; \
+    fi && \
+    \
+    # Handle Nginx configuration
+    if [ -f /etc/nginx/nginx.conf ]; then \
+        awk '/http \{/{print; print "map $http_user_agent $dontlog {\n  default 0;\n  \"~*HealthCheck\" 1;\n}\naccess_log /var/log/nginx/access.log combined if=$dontlog;"; next}1' /etc/nginx/nginx.conf > /etc/nginx/nginx.conf.new && \
+        mv /etc/nginx/nginx.conf.new /etc/nginx/nginx.conf; \
+    fi
+
+ENV HEALTH_PORT="8080" \
+    HEALTH_URL=""
+HEALTHCHECK \
+    --interval=5s \
+    --retries=5 \
+    --start-period=30s \
+    --timeout=25s \
+    CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || curl -k --fail "https://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
--- a/filebrowser_quantum/README.md
+++ b/filebrowser_quantum/README.md
@@ -1,7 +1,9 @@
 # Home assistant add-on: FileBrowser Quantum


-I maintain this and other Home Assistant add-ons in my free time: keeping up with upstream changes, HA changes, and testing on real hardware takes a lot of time (and some money). I use around 5-10 hours a week for this. If this add-on saves you time or makes your setup easier, I would be very grateful for your support!
+I maintain this and other Home Assistant add-ons in my free time: keeping up with upstream changes, HA changes, and testing on real hardware takes a lot of time (and some money). I use around 5-10 of my >110 addons so regularly I install test machines (and purchase some test services such as vpn) that I don't use myself to troubleshoot and improve the addons
+
+If this add-on saves you time or makes your setup easier, I would be very grateful for your support!

 [![Buy me a coffee][donation-badge]](https://www.buymeacoffee.com/alexbelgium)
 [![Donate via PayPal][paypal-badge]](https://www.paypal.com/donate/?hosted_button_id=DZFULJZTP3UQA)
@@ -27,7 +29,7 @@ _Thanks to everyone having starred my repo! To star it click on the image below,

 ## About

-FileBrowser Quantum is a modern, responsive, multi-source file manager with realtime indexing, advanced sharing, and expanded authentication options (password, proxy, OIDC, or no-auth). It is a maintained fork of the original FileBrowser project.
+FileBrowser Quantum is a modern, responsive, multi-source file manager with realtime indexing, advanced sharing, and expanded authentication options (password, proxy, OIDC, or no-auth). It is a major fork of the original Filebrowser project, designed for faster browsing and richer previews.

 This addon is based on the [docker image](https://hub.docker.com/r/gtstef/filebrowser) from the FileBrowser Quantum project.

@@ -59,7 +61,6 @@ The web UI can be found at `<your-ip>:8071` or through the Home Assistant sideba
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
 | `auth_method` | list | `password` | Authentication method (`password`, `noauth`, `proxy`, `oidc`) |
-| `default_user_scope` | str | `/` | The root filesystem path used as the FileBrowser source and as the default scope for all users. Must be an existing absolute directory path (e.g. `/share`, `/media`). |
 | `localdisks` | str | _(optional)_ | Local drives to mount (e.g., `sda1,sdb1,MYNAS`) |
 | `networkdisks` | str | _(optional)_ | SMB shares to mount (e.g., `//SERVER/SHARE`) |
 | `cifsusername` | str | _(optional)_ | SMB username for network shares |
@@ -88,7 +89,7 @@ This addon supports mounting both local drives and remote SMB shares:
 This addon supports custom scripts and environment variables through the `addon_config` mapping:

 - **Custom scripts**: See [Running Custom Scripts in Addons](https://github.com/alexbelgium/hassio-addons/wiki/Running-custom-scripts-in-Addons)
- **env_vars option**: Use the add-on `env_vars` option to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-add-ons
+- **env_vars option**: Use the add-on `env_vars` option to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.

 ## Support

@@ -98,3 +99,4 @@ Create an issue on GitHub, or ask on the [Home Assistant Community thread](https
 [aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
 [amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
 [armv7-shield]: https://img.shields.io/badge/armv7-yes-green.svg
+
--- a/filebrowser_quantum/config.yaml
+++ b/filebrowser_quantum/config.yaml
@@ -4,7 +4,7 @@ arch:
 description:
  FileBrowser Quantum provides a modern, responsive file manager with multi-source
  support, advanced authentication options, and realtime indexing for your Home
-  Assistant files
+  Assistant files.
 devices:
  - /dev/dri
  - /dev/dri/card0
@@ -73,8 +73,6 @@ devices:
  - /dev/md3
 environment:
  FB_BASEURL: /filebrowser_quantum
-  FILEBROWSER_CONFIG: "/config/config.yaml"
-  FILEBROWSER_DATABASE: "/config/database.db"
  PGID: "0"
  PUID: "0"
 image: ghcr.io/alexbelgium/filebrowser_quantum-{arch}
@@ -94,7 +92,6 @@ name: FileBrowser Quantum
 options:
  env_vars: []
  auth_method: noauth
-  default_user_scope: "/"
 panel_admin: false
 panel_icon: mdi:file-search
 privileged:
@@ -105,7 +102,6 @@ schema:
    - name: match(^[A-Za-z0-9_]+$)
      value: str?
  auth_method: list(password|noauth|proxy|oidc)
-  default_user_scope: str
  cifsdomain: str?
  cifspassword: str?
  cifsusername: str?
@@ -114,4 +110,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.3.3-8"
+version: "1.3.3"
--- a/filebrowser_quantum/rootfs/etc/cont-init.d/20-folders.sh
+++ b/filebrowser_quantum/rootfs/etc/cont-init.d/20-folders.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+####################
+# Migrate database #
+####################
+
+if [ -f /homeassistant/addons_config/filebrowser_quantum/filebrowser_quantum.db ]; then
+    echo "Moving database from legacy addons_config location to /config"
+    cp -rnf /homeassistant/addons_config/filebrowser_quantum/* /config/
+    rm -r /homeassistant/addons_config/filebrowser_quantum
+fi
+
+if [ ! -f /config/filebrowser_quantum.db ] && [ -d /addon_configs ]; then
+    shopt -s nullglob
+    for addon_config_dir in /addon_configs/*_filebrowser_quantum; do
+        if [ -f "$addon_config_dir/filebrowser_quantum.db" ]; then
+            echo "Moving database from addon_configs location to /config"
+            cp -rnf "$addon_config_dir"/. /config/
+            break
+        fi
+    done
+    shopt -u nullglob
+fi
+
+######################
+# Link addon folders #
+######################
+
+# Clean symlinks
+find /config -maxdepth 1 -type l -delete
+if [ -d /homeassistant/addons_config ]; then
+    find /homeassistant/addons_config -maxdepth 1 -type l -delete
+fi
+# Remove erroneous folders
+if [ -d /homeassistant ]; then
+    if [ -d /config/addons_config ]; then
+        rm -r /config/addons_config
+    fi
+    if [ -d /config/addon_configs ]; then
+        rm -r /config/addon_configs
+    fi
+    if [ -d /config/addons_autoscripts ]; then
+        rm -r /config/addons_autoscripts
+    fi
+fi
+
+# Create symlinks with legacy folders
+addon_configs_symlink_dir=""
+if [ -d /homeassistant/addons_config ]; then
+    ln -s /homeassistant/addons_config /config
+    addon_configs_symlink_dir="/config/addons_config"
+elif [ -d /addon_configs ]; then
+    mkdir -p /config/addon_configs
+    addon_configs_symlink_dir="/config/addon_configs"
+fi
+if [ -n "$addon_configs_symlink_dir" ] && [ -d /addon_configs ]; then
+    find /addon_configs/ -maxdepth 1 -mindepth 1 -type d -not -name "*filebrowser_quantum*" -exec ln -s {} "$addon_configs_symlink_dir"/ \;
+fi
+if [ -d /homeassistant/addons_autoscripts ]; then
+    ln -s /homeassistant/addons_autoscripts /config
+fi
--- a/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh
+++ b/filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh
@@ -65,80 +65,163 @@ mkdir -p /var/log/nginx && touch /var/log/nginx/error.log
 # FILEBROWSER CONFIGURATION #
 ############################

+CONFIG_PATH="/config/filebrowser_quantum.yaml"
 mkdir -p /config /cache

-# Copy default config if not existing
-if [ ! -f "$FILEBROWSER_CONFIG" ]; then
-    cp /home/filebrowser/data/config.yaml "$FILEBROWSER_CONFIG"
-fi
+export FILEBROWSER_CONFIG="${CONFIG_PATH}"

-bashio::log.info "Updating FileBrowser config..."
+python3 - <<'PY'
+import json
+import os

-# --- Server (hardcoded values) ---
-bashio::log.info "... set server"
-yq e -i ".server.port = 8080"            "$FILEBROWSER_CONFIG"
-yq e -i ".server.listen = \"0.0.0.0\""  "$FILEBROWSER_CONFIG"
-yq e -i ".server.database = \"/config/database.db\"" "$FILEBROWSER_CONFIG"
-yq e -i ".server.cacheDir = \"/cache\""  "$FILEBROWSER_CONFIG"
+options_path = "/data/options.json"
+config_path = os.environ["FILEBROWSER_CONFIG"]

-# --- Default user scope / source path ---
-bashio::log.info "... set default user scope"
-DEFAULT_USER_SCOPE=$(bashio::config 'default_user_scope' '/')
+with open(options_path, "r", encoding="utf-8") as f:
+    options = json.load(f)

-# Validate: must start with /
-if [[ "$DEFAULT_USER_SCOPE" != /* ]]; then
-    bashio::log.fatal "default_user_scope '${DEFAULT_USER_SCOPE}' is not a valid absolute path (must start with /). Stopping."
-    exit 1
-fi
+base_url = options.get("base_url") or os.environ.get("FB_BASEURL") or "/"

-# Validate: path must exist
-if [ ! -d "$DEFAULT_USER_SCOPE" ]; then
-    bashio::log.fatal "default_user_scope '${DEFAULT_USER_SCOPE}' does not exist or is not a directory. Stopping."
-    exit 1
-fi
+def bool_or_none(value):
+    return value if isinstance(value, bool) else None

-bashio::log.info "... set source path and defaultUserScope to ${DEFAULT_USER_SCOPE}"
-yq e -i ".server.sources[0].path = \"${DEFAULT_USER_SCOPE}\""  "$FILEBROWSER_CONFIG"
-yq e -i ".server.sources[0].name = \"Default\""                "$FILEBROWSER_CONFIG"
-yq e -i ".server.sources[0].config.defaultUserScope = \"${DEFAULT_USER_SCOPE}\"" "$FILEBROWSER_CONFIG"
+sources = []
+for source in options.get("sources") or [{"path": "/", "name": "Root", "default_enabled": True}]:
+    entry = {"path": source.get("path", "/")}
+    if source.get("name"):
+        entry["name"] = source["name"]

-# --- Base URL (from env or config) ---
-bashio::log.info "... set base URL to allow ingress"
-BASE_URL=$(bashio::config 'base_url' "${FB_BASEURL:-/}")
-yq e -i ".server.baseURL = \"${BASE_URL}\"" "$FILEBROWSER_CONFIG"
+    source_config = {}
+    config_mappings = {
+        "default_enabled": "defaultEnabled",
+        "default_user_scope": "defaultUserScope",
+        "create_user_dir": "createUserDir",
+        "disable_indexing": "disableIndexing",
+        "deny_by_default": "denyByDefault",
+        "private": "private",
+        "indexing_interval_minutes": "indexingIntervalMinutes",
+    }
+    for option_key, config_key in config_mappings.items():
+        if option_key in source and source[option_key] not in (None, ""):
+            value = source[option_key]
+            if option_key == "indexing_interval_minutes" and not value:
+                continue
+            source_config[config_key] = value

-# --- Auth method ---
-AUTH_METHOD=$(bashio::config 'auth_method' 'password')
-bashio::log.info "... authentication method set to $AUTH_METHOD"
-case "$AUTH_METHOD" in
-    noauth)
-        yq e -i ".auth.methods.noauth = true"            "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.password.enabled = false" "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.proxy.enabled = false"    "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.oidc.enabled = false"     "$FILEBROWSER_CONFIG"
-        ;;
-    password)
-        yq e -i ".auth.methods.noauth = false"           "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.password.enabled = true"  "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.proxy.enabled = false"    "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.oidc.enabled = false"     "$FILEBROWSER_CONFIG"
-        ;;
-    proxy)
-        yq e -i ".auth.methods.noauth = false"           "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.password.enabled = false" "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.proxy.enabled = true"     "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.oidc.enabled = false"     "$FILEBROWSER_CONFIG"
-        ;;
-    oidc)
-        yq e -i ".auth.methods.noauth = false"           "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.password.enabled = false" "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.proxy.enabled = false"    "$FILEBROWSER_CONFIG"
-        yq e -i ".auth.methods.oidc.enabled = true"      "$FILEBROWSER_CONFIG"
-        ;;
-    *)
-        bashio::log.fatal "Unknown auth_method: $AUTH_METHOD"
-        ;;
-esac
+    conditionals = {}
+    if "ignore_hidden" in source:
+        value = bool_or_none(source.get("ignore_hidden"))
+        if value is not None:
+            conditionals["ignoreHidden"] = value
+    if "ignore_zero_size_folders" in source:
+        value = bool_or_none(source.get("ignore_zero_size_folders"))
+        if value is not None:
+            conditionals["ignoreZeroSizeFolders"] = value
+    if conditionals:
+        source_config["conditionals"] = conditionals
+
+    if source_config:
+        entry["config"] = source_config
+    sources.append(entry)
+
+server = {
+    "port": 8080,
+    "listen": "0.0.0.0",
+    "baseURL": base_url,
+    "logging": [
+        {
+            "levels": options.get("log_levels", "info|warning|error"),
+        }
+    ],
+    "database": "/config/filebrowser_quantum.db",
+    "cacheDir": "/cache",
+    "cacheDirCleanup": options.get("cache_dir_cleanup", True),
+    "disablePreviews": options.get("disable_previews", False),
+    "disablePreviewResize": options.get("disable_preview_resize", False),
+    "disableTypeDetectionByHeader": options.get("disable_type_detection_by_header", False),
+    "disableUpdateCheck": options.get("disable_update_check", False),
+    "sources": sources,
+}
+
+if options.get("external_url"):
+    server["externalUrl"] = options["external_url"]
+if options.get("internal_url"):
+    server["internalUrl"] = options["internal_url"]
+if options.get("max_archive_size_gb"):
+    server["maxArchiveSize"] = options["max_archive_size_gb"]
+
+certfile = os.environ.get("CERTFILE")
+keyfile = os.environ.get("KEYFILE")
+if certfile and keyfile:
+    server["tlsCert"] = certfile
+    server["tlsKey"] = keyfile
+
+auth_method = options.get("auth_method", "password")
+
+password_config = {
+    "enabled": auth_method == "password",
+    "minLength": options.get("password_min_length", 5),
+    "signup": options.get("password_signup", False),
+    "enforcedOtp": options.get("password_enforced_otp", False),
+}
+
+proxy_config = {
+    "enabled": auth_method == "proxy",
+}
+if options.get("proxy_auth_header"):
+    proxy_config["header"] = options["proxy_auth_header"]
+proxy_config["createUser"] = options.get("proxy_auth_create_user", False)
+if options.get("proxy_auth_logout_redirect_url"):
+    proxy_config["logoutRedirectUrl"] = options["proxy_auth_logout_redirect_url"]
+
+oidc_config = {
+    "enabled": auth_method == "oidc",
+}
+if options.get("oidc_client_id"):
+    oidc_config["clientId"] = options["oidc_client_id"]
+if options.get("oidc_client_secret"):
+    oidc_config["clientSecret"] = options["oidc_client_secret"]
+if options.get("oidc_issuer_url"):
+    oidc_config["issuerUrl"] = options["oidc_issuer_url"]
+if options.get("oidc_scopes"):
+    oidc_config["scopes"] = options["oidc_scopes"]
+if options.get("oidc_user_identifier"):
+    oidc_config["userIdentifier"] = options["oidc_user_identifier"]
+if options.get("oidc_admin_group"):
+    oidc_config["adminGroup"] = options["oidc_admin_group"]
+if options.get("oidc_groups_claim"):
+    oidc_config["groupsClaim"] = options["oidc_groups_claim"]
+if options.get("oidc_logout_redirect_url"):
+    oidc_config["logoutRedirectUrl"] = options["oidc_logout_redirect_url"]
+oidc_config["createUser"] = options.get("oidc_create_user", False)
+oidc_config["disableVerifyTLS"] = options.get("oidc_disable_verify_tls", False)
+
+auth = {
+    "tokenExpirationHours": options.get("token_expiration_hours", 2),
+    "adminUsername": options.get("admin_username", "admin"),
+    "adminPassword": options.get("admin_password", "admin"),
+    "methods": {
+        "noauth": auth_method == "noauth",
+        "password": password_config,
+        "proxy": proxy_config,
+        "oidc": oidc_config,
+    },
+}
+
+frontend = {
+    "name": "FileBrowser Quantum",
+}
+
+config = {
+    "server": server,
+    "auth": auth,
+    "frontend": frontend,
+}
+
+with open(config_path, "w", encoding="utf-8") as f:
+    json.dump(config, f, indent=2)
+    f.write("\n")
+PY

 ######################
 # LAUNCH FILEBROWSER #
--- a/filebrowser_quantum/rootfs/etc/nginx/servers/health.conf
+++ b/filebrowser_quantum/rootfs/etc/nginx/servers/health.conf
@@ -1,8 +0,0 @@
-server {
-    listen 127.0.0.1:3001;
-    access_log off;
-
-    location /health {
-        return 200 'OK';
-    }
-}
Author	SHA1	Message	Date
copilot-swe-agent[bot]	ed59a7140d	fix: guard addon config symlink creation	2026-06-03 06:19:02 +00:00
copilot-swe-agent[bot]	a158621de9	refactor: simplify addon config symlink setup	2026-06-03 06:18:23 +00:00
copilot-swe-agent[bot]	c95c53eb63	fix: harden addon config migration	2026-06-03 06:17:39 +00:00
copilot-swe-agent[bot]	d9b525b464	fix: address filebrowser quantum review feedback	2026-06-03 06:17:00 +00:00
copilot-swe-agent[bot]	b48899b5bf	Fix FileBrowser Quantum database migration path to use correct addon_configs directory The migration code was checking `/homeassistant/addons_config/filebrowser_quantum/` but the actual HA addon config path is `/homeassistant/addon_configs/db21ed7f_filebrowser_quantum/`. Changes: - Add migration check for the correct addon_configs path with slug prefix - Handle the standard `addon_configs` directory for symlink operations - Keep legacy `addons_config` path support for backward compatibility Fixes: Configuration doesn't survive over restarts	2026-06-03 05:19:00 +00:00
copilot-swe-agent[bot]	830c6cebec	Initial plan	2026-06-03 05:13:10 +00:00