Merge pull request #2315 from Quentec/master

fix: PROTECTION MODE IS ENABLED error when protection mode is OFF

.github/workflows/onpush_builder.yaml

@@ -170,16 +170,6 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }} 
-      - name: Free disk space (runner)
-        uses: endersonmenezes/free-disk-space@v3
-        with:
-          remove_android: true
-          remove_dotnet: true
-          remove_haskell: true
-          remove_tool_cache: true
-          remove_swap: true
-          rm_cmd: "rmz"
-          rmz_version: "3.1.1"       
       - name: Build ${{ matrix.addon }} add-on (attempt 1)
         id: builderstep1
         if: steps.check.outputs.build_arch == 'true' && steps.dockerfile_check.outputs.has_dockerfile == 'true'

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 117
+- In the repository : 118
 - Installed : 76650
 
 ### Top 3
@@ -253,6 +253,14 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
+✓ ![image](https://api.iconify.design/mdi/file-search.svg) [FileBrowser Quantum](filebrowser_quantum/) : FileBrowser Quantum provides a modern, responsive file manager with multi-source support, advanced authentication options, and realtime indexing for your Home Assistant files.
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Ffilebrowser_quantum%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Ffilebrowser_quantum%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/file-search.svg) [Filebrowser (10195x)](filebrowser/) : filebrowser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit your files
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Ffilebrowser%2Fconfig.yaml)
@@ -809,6 +817,13 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
+✓  [Vaultwarden](bitwarden/) : Open source password management solution
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbitwarden%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbitwarden%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/monitor.svg) [Webtop KDE](webtop_kde/) : Full linux desktop environment accessible via any modern web browser
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fwebtop_kde%2Fconfig.yaml)
@@ -900,13 +915,6 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
-✓  [zzz_archived - Vaultwarden](zzz_archived_bitwarden/) : Deprecated - please use community version
-
-  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzzz_archived_bitwarden%2Fconfig.yaml)
-![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzzz_archived_bitwarden%2Fupdater.json)
-![aarch64][aarch64-badge]
-![amd64][amd64-badge]
-
 ✓  [zzz_archived : Code-server (VScode)](zzz_archived_code-server/) : Deprecated : Code-server is VS Code running on a remote server, accessible through the browser
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzzz_archived_code-server%2Fconfig.yaml)

bitwarden/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 1.35.0-6 (28-12-2025)
+- Minor bugs fixed
+## 1.35.0-4 (28-12-2025)
+- Minor bugs fixed
+## 1.35.0-2 (28-12-2025)
+- Minor bugs fixed
+## description: Deprecated - please use community version 1.35.0 (28-12-2025)
+- Minor bugs fixed
+
+## 1.35.0 (28-12-2025)
+- Update to latest version from dani-garcia/bitwarden_rs (changelog : https://github.com/dani-garcia/bitwarden_rs/releases)
 - The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
 
 - Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.

bitwarden/Dockerfile

@@ -14,18 +14,40 @@
 # 1 Build Image #
 #################
 
-ARG BUILD_FROM=ghcr.io/hassio-addons/debian-base/amd64:7.1.0
-ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="1.34.3"
-FROM "vaultwarden/server:${BUILD_UPSTREAM}" as vaultwarden
+ARG BUILD_FROM=ghcr.io/hassio-addons/debian-base:9.1.0
+###############################################################################
+# Get prebuild containers from Vaultwarden
+###############################################################################
+FROM "vaultwarden/server:latest" AS vaultwarden
+
+###############################################################################
+# Build the actual add-on.
+###############################################################################
+# hadolint ignore=DL3006
 FROM ${BUILD_FROM}
+
+# Set shell
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Get the Bitwarden from official images
 COPY --from=vaultwarden /vaultwarden /opt/vaultwarden
-#COPY --from=vaultwarden /Rocket.toml /opt/Rocket.toml
 COPY --from=vaultwarden /web-vault /opt/web-vault
 
+RUN \
+    apt-get update \
+    \
+    && apt-get install -y --no-install-recommends \
+        libmariadb-dev-compat \
+        libpq5 \
+        nginx \
+        sqlite3 \
+    && apt-get clean \
+    && rm -f -r \
+        /etc/nginx \
+    \
+    && mkdir -p /var/log/nginx \
+    && touch /var/log/nginx/error.log
+
 ##################
 # 2 Modify Image #
 ##################
@@ -42,23 +64,22 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
 # Add rootfs
 COPY rootfs/ /
 
+RUN chmod +x /etc/s6-overlay/s6-rc.d/*/run
+
 # Uses /bin for compatibility purposes
 # hadolint ignore=DL4005
 RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
     if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
 
 # Modules
-ARG MODULES="00-banner.sh 01-custom_script.sh 00-deprecated.sh"
+ARG MODULES="00-banner.sh 01-custom_script.sh"
 
 # Automatic modules download
 ADD "https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates/ha_automodules.sh" "/ha_automodules.sh"
 RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
 
 # Manual apps
-ENV PACKAGES="libmariadb-dev-compat \
-    libpq5 \
-    nginx \
-    sqlite3"
+ENV PACKAGES=""
 
 # Automatic apps & bashio
 ADD "https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates/ha_autoapps.sh" "/ha_autoapps.sh"

bitwarden/build.yaml

@@ -0,0 +1,4 @@
+---
+build_from:
+  aarch64: ghcr.io/hassio-addons/debian-base/aarch64:9.1.0
+  amd64: ghcr.io/hassio-addons/debian-base/amd64:9.1.0

bitwarden/config.yaml

@@ -1,12 +1,12 @@
 arch:
   - aarch64
   - amd64
-description: Deprecated - please use community version
+description: Open source password management solution
 image: ghcr.io/alexbelgium/vaultwarden-{arch}
 init: false
 map:
   - ssl
-name: zzz_archived - Vaultwarden
+name: Vaultwarden
 options:
   env_vars: []
   certfile: fullchain.pem
@@ -26,8 +26,7 @@ schema:
   request_size_limit: int?
   ssl: bool
 slug: bitwarden
-stage: deprecated
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/bitwarden
-version: 1.34.3
+version: 1.35.0-6
 webui: "[PROTO:ssl]://[HOST]:[PORT:7277]"

bitwarden/rootfs/etc/nginx/includes/server_params.conf

@@ -4,5 +4,3 @@ server_name     $hostname;
 add_header X-Content-Type-Options nosniff;
 add_header X-XSS-Protection "1; mode=block";
 add_header X-Robots-Tag none;
-
-client_max_body_size %%max_body_size%%;

bitwarden/rootfs/etc/nginx/includes/ssl_params.conf

@@ -0,0 +1,8 @@
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;

bitwarden/rootfs/etc/nginx/includes/upstream.conf

@@ -0,0 +1,3 @@
+upstream backend {
+    server 127.0.0.1:80;
+}

bitwarden/rootfs/etc/nginx/nginx.conf

@@ -27,11 +27,7 @@ events {
 http {
     include /etc/nginx/includes/mime.types;
 
-    log_format homeassistant '[$time_local] $status '
-                             '$http_x_forwarded_for($remote_addr) '
-                             '$request ($http_user_agent)';
-
-    access_log              /proc/1/fd/1 homeassistant;
+    access_log              off;
     client_max_body_size    4G;
     default_type            application/octet-stream;
     gzip                    on;

bitwarden/rootfs/etc/nginx/servers/direct-ssl.disabled

@@ -12,12 +12,4 @@ server {
         proxy_pass http://backend;
     }
 
-    location /notifications/hub {
-        proxy_pass http://wsbackend;
-    }
-
-    location /notifications/hub/negotiate {
-        proxy_pass http://backend;
-    }
-
 }

bitwarden/rootfs/etc/nginx/servers/direct.disabled

@@ -8,12 +8,4 @@ server {
         proxy_pass http://backend;
     }
 
-    location /notifications/hub {
-        proxy_pass http://wsbackend;
-    }
-
-    location /notifications/hub/negotiate {
-        proxy_pass http://backend;
-    }
-
 }

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -1,13 +1,11 @@
 #!/command/with-contenv bashio
 # shellcheck shell=bash
-set -e
 # ==============================================================================
-# Home Assistant Community Add-on: Bitwarden
-# This file configures nginx
+# Home Assistant Community Add-on: Vaultwarden
+# This file configures NGINX
 # ==============================================================================
 declare certfile
 declare keyfile
-declare max_body_size
 
 bashio::config.require.ssl
 
@@ -21,11 +19,3 @@ if bashio::config.true 'ssl'; then
 else
     mv /etc/nginx/servers/direct.disabled /etc/nginx/servers/direct.conf
 fi
-
-max_body_size="10M"
-# Increase body size to match config
-if bashio::config.has_value 'request_size_limit'; then
-    max_body_size=$(bashio::config 'request_size_limit')
-fi
-sed -i "s/%%max_body_size%%/${max_body_size}/g" \
-    /etc/nginx/includes/server_params.conf

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/init-nginx/type

@@ -0,0 +1 @@
+oneshot

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/init-nginx/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-nginx/run

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/nginx/finish

@@ -0,0 +1,26 @@
+#!/command/with-contenv bashio
+# ==============================================================================
+# Home Assistant Community Add-on: Vaultwarden
+# Take down the S6 supervision tree when Nginx fails
+# ==============================================================================
+declare exit_code
+readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
+readonly exit_code_service="${1}"
+readonly exit_code_signal="${2}"
+readonly service="NGINX"
+
+bashio::log.info \
+  "Service ${service} exited with code ${exit_code_service}" \
+  "(by signal ${exit_code_signal})"
+
+if [[ "${exit_code_service}" -eq 256 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo $((128 + $exit_code_signal)) > /run/s6-linux-init-container-results/exitcode
+  fi
+  [[ "${exit_code_signal}" -eq 15 ]] && exec /run/s6/basedir/bin/halt
+elif [[ "${exit_code_service}" -ne 0 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo "${exit_code_service}" > /run/s6-linux-init-container-results/exitcode
+  fi
+  exec /run/s6/basedir/bin/halt
+fi

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -1,8 +1,6 @@
-#!/usr/bin/with-contenv bashio
-# shellcheck shell=bash
-set -e
+#!/command/with-contenv bashio
 # ==============================================================================
-# Home Assistant Community Add-on: Bitwarden
+# Home Assistant Community Add-on: Vaultwarden
 # Runs the Nginx daemon
 # ==============================================================================
 bashio::net.wait_for 80

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/nginx/type

@@ -0,0 +1 @@
+longrun

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/vaultwarden/finish

@@ -0,0 +1,27 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Home Assistant Community Add-on: Vaultwarden
+# Take down the S6 supervision tree when the server fails
+# ==============================================================================
+declare exit_code
+readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
+readonly exit_code_service="${1}"
+readonly exit_code_signal="${2}"
+readonly service="Vaultwarden"
+
+bashio::log.info \
+  "Service ${service} exited with code ${exit_code_service}" \
+  "(by signal ${exit_code_signal})"
+
+if [[ "${exit_code_service}" -eq 256 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo $((128 + $exit_code_signal)) > /run/s6-linux-init-container-results/exitcode
+  fi
+  [[ "${exit_code_signal}" -eq 15 ]] && exec /run/s6/basedir/bin/halt
+elif [[ "${exit_code_service}" -ne 0 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo "${exit_code_service}" > /run/s6-linux-init-container-results/exitcode
+  fi
+  exec /run/s6/basedir/bin/halt
+fi

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/vaultwarden/run

@@ -1,8 +1,7 @@
 #!/command/with-contenv bashio
 # shellcheck shell=bash
-set -e
 # ==============================================================================
-# Home Assistant Community Add-on: Bitwarden
+# Home Assistant Community Add-on: Vaultwarden
 # Runs the Vaultwarden server
 # ==============================================================================
 declare admin_token
@@ -22,19 +21,19 @@ export ROCKET_SECRET_KEY="${secret_key}"
 # Find the matching log level
 if bashio::config.has_value 'log_level'; then
     case "$(bashio::string.lower "$(bashio::config 'log_level')")" in
-        all | trace)
+        all|trace)
             log_level="trace"
             ;;
         debug)
             log_level="debug"
             ;;
-        info | notice)
+        info|notice)
             log_level="info"
             ;;
         warning)
             log_level="warn"
             ;;
-        error | fatal)
+        error|fatal)
             log_level="error"
             ;;
         off)
@@ -46,7 +45,7 @@ if bashio::config.has_value 'log_level'; then
 fi
 
 # Show admin token in the log, if config does not exist.
-if ! bashio::fs.file_exists '/data/config.yaml'; then
+if ! bashio::fs.file_exists '/data/config.json'; then
     admin_token=$(openssl rand -base64 48)
     export ADMIN_TOKEN="${admin_token}"
 
@@ -73,10 +72,6 @@ if bashio::config.has_value 'request_size_limit'; then
     export ROCKET_LIMITS="{json=${request_size_limit}}"
 fi
 
-# Always enable Websockets
-export WEBSOCKET_ENABLED=true
-export WEBSOCKET_PORT=8080
-
 # Run the Bitwarden server
 bashio::log.info 'Starting the Vaultwarden server...'
 cd /opt || bashio::exit.nok

bitwarden/rootfs/etc/s6-overlay/s6-rc.d/vaultwarden/type

@@ -0,0 +1 @@
+longrun

bitwarden/updater.json

@@ -1,9 +1,9 @@
 {
-  "last_update": "01-08-2025",
+  "last_update": "28-12-2025",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "bitwarden",
   "source": "github",
   "upstream_repo": "dani-garcia/bitwarden_rs",
-  "upstream_version": "1.34.3"
+  "upstream_version": "1.35.0"
 }

filebrowser_quantum/CHANGELOG.md

@@ -1,3 +1,6 @@
+
+## 1.2.0 (28-12-2025)
+- Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
 # Changelog
 
 ## 1.1.0

filebrowser_quantum/config.yaml

@@ -110,4 +110,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: 1.1.0
+version: "1.2.0"

filebrowser_quantum/updater.json

@@ -1,10 +1,10 @@
 {
   "github_beta": "true",
-  "last_update": "20-12-2025",
+  "last_update": "28-12-2025",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "filebrowser_quantum",
   "source": "github",
   "upstream_repo": "gtsteffaniak/filebrowser",
-  "upstream_version": "1.1.0-stable"
+  "upstream_version": "1.2.0"
 }

immich_cuda/CHANGELOG.md

@@ -1,3 +1,6 @@
+
+## 2.4.1 (28-12-2025)
+- Update to latest version from imagegenius/docker-immich (changelog : https://github.com/imagegenius/docker-immich/releases)
 ## 2.4.1 (27-12-2025)
 - Minor bugs fixed
 

immich_cuda/config.yaml

@@ -139,6 +139,6 @@ slug: immich_cuda
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
 usb: true
-version: 2.4.1
+version: "2.4.1"
 video: true
 webui: http://[HOST]:[PORT:8080]

immich_cuda/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "false",
-  "last_update": "22-11-2025",
+  "last_update": "28-12-2025",
   "repository": "alexbelgium/hassio-addons",
   "slug": "immich",
   "source": "github",
   "upstream_repo": "imagegenius/docker-immich",
-  "upstream_version": "2.3.1"
+  "upstream_version": "2.4.1"
 }

jackett/CHANGELOG.md

@@ -1,4 +1,7 @@
 
+## 0.24.590 (28-12-2025)
+- Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
+
 ## 0.24.569 (27-12-2025)
 - Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
 

jackett/config.yaml

@@ -106,5 +106,5 @@ schema:
 slug: jackett_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/jackett
-version: "0.24.569"
+version: "0.24.590"
 webui: http://[HOST]:[PORT:9117]

jackett/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "27-12-2025",
+  "last_update": "28-12-2025",
   "repository": "alexbelgium/hassio-addons",
   "slug": "jackett",
   "source": "github",
   "upstream_repo": "linuxserver/docker-jackett",
-  "upstream_version": "0.24.569"
+  "upstream_version": "0.24.590"
 }

joplin/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 3.5.2-2 (28-12-2025)
+- Minor bugs fixed
 
 ## 3.5.2 (20-12-2025)
 - Update to latest version from etechonomy/joplin-server (changelog : https://github.com/etechonomy/joplin-server/releases)

joplin/config.yaml

@@ -104,5 +104,5 @@ schema:
 slug: joplin
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "3.5.2"
+version: 3.5.2-2
 webui: "[PROTO:ssl]://[HOST]:[PORT:22300]"

joplin/rootfs/etc/cont-init.d/99-run.sh

@@ -1,7 +1,6 @@
-#!/usr/bin/env bashio
+#!/command/with-contenv bashio
 # shellcheck shell=bash
-# shellcheck disable=SC2155
-set -e
+set -euo pipefail
 
 bashio::log.warning "Warning - minimum configuration recommended : 2 cpu cores and 4 GB of memory. Otherwise the system will become unresponsive and crash."
 
@@ -10,108 +9,135 @@ unlock_sqlite_migrations() {
 
     if ! command -v sqlite3 >/dev/null 2>&1; then
         bashio::log.warning "sqlite3 not available; skipping SQLite migration lock check."
-        return
+        return 0
     fi
 
-    if ! sqlite3 "$db_path" "SELECT name FROM sqlite_master WHERE type='table' AND name='knex_migrations_lock';" | grep -q "knex_migrations_lock"; then
-        return
+    # Only proceed if the DB file exists
+    if [[ ! -f "$db_path" ]]; then
+        bashio::log.warning "SQLite DB not found at $db_path; skipping migration unlock."
+        return 0
     fi
 
+    # If the lock table doesn't exist yet, nothing to unlock
+    local has_table
+    has_table="$(sqlite3 "$db_path" "SELECT 1 FROM sqlite_master WHERE type='table' AND name='knex_migrations_lock' LIMIT 1;" 2>/dev/null || true)"
+    [[ "$has_table" == "1" ]] || return 0
+
+    # Ensure the lock row exists (Knex expects one row)
+    # Typical schema: (index INTEGER PRIMARY KEY, is_locked INTEGER)
+    sqlite3 "$db_path" "
+        PRAGMA busy_timeout=5000;
+        INSERT OR IGNORE INTO knex_migrations_lock(\"index\", is_locked) VALUES (1, 0);
+    " >/dev/null 2>&1 || true
+
     local is_locked
-    is_locked=$(sqlite3 "$db_path" "SELECT is_locked FROM knex_migrations_lock LIMIT 1;" 2>/dev/null || true)
+    is_locked="$(sqlite3 "$db_path" "PRAGMA busy_timeout=5000; SELECT is_locked FROM knex_migrations_lock WHERE \"index\"=1 LIMIT 1;" 2>/dev/null || true)"
 
     if [[ "$is_locked" == "1" ]]; then
         bashio::log.warning "Locked SQLite migration table detected, attempting to unlock."
-        sqlite3 "$db_path" "UPDATE knex_migrations_lock SET is_locked = 0;" || bashio::log.warning "Failed to clear SQLite migration lock."
+        sqlite3 "$db_path" "
+            PRAGMA busy_timeout=5000;
+            UPDATE knex_migrations_lock SET is_locked = 0 WHERE \"index\"=1 AND is_locked=1;
+        " >/dev/null 2>&1 || bashio::log.warning "Failed to clear SQLite migration lock."
     fi
 }
 
 unlock_postgres_migrations() {
     if ! command -v psql >/dev/null 2>&1; then
         bashio::log.warning "psql not available; skipping PostgreSQL migration lock check."
-        return
+        return 0
     fi
 
     if [[ -z "${POSTGRES_DATABASE:-}" || -z "${POSTGRES_USER:-}" || -z "${POSTGRES_HOST:-}" ]]; then
         bashio::log.warning "PostgreSQL configuration incomplete; skipping migration lock check."
-        return
+        return 0
     fi
 
     local pg_port="${POSTGRES_PORT:-5432}"
     export PGPASSWORD="${POSTGRES_PASSWORD:-}"
 
+    # If table doesn't exist, skip
+    local has_table
+    has_table="$(psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc \
+        "SELECT 1 FROM information_schema.tables WHERE table_name='knex_migrations_lock' LIMIT 1;" 2>/dev/null || true)"
+    [[ "$has_table" == "1" ]] || { unset PGPASSWORD; return 0; }
+
+    # Ensure row exists
+    psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc \
+        "INSERT INTO knex_migrations_lock(\"index\", is_locked) VALUES (1, 0) ON CONFLICT (\"index\") DO NOTHING;" \
+        >/dev/null 2>&1 || true
+
     local is_locked
-    is_locked=$(psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc "SELECT is_locked FROM knex_migrations_lock LIMIT 1;" 2>/dev/null || true)
+    is_locked="$(psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc \
+        "SELECT is_locked FROM knex_migrations_lock WHERE \"index\"=1 LIMIT 1;" 2>/dev/null || true)"
 
     if [[ "$is_locked" == "1" ]]; then
         bashio::log.warning "Locked PostgreSQL migration table detected, attempting to unlock."
-        psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc "UPDATE knex_migrations_lock SET is_locked = 0;" || bashio::log.warning "Failed to clear PostgreSQL migration lock."
+        psql -h "$POSTGRES_HOST" -p "$pg_port" -U "$POSTGRES_USER" -d "$POSTGRES_DATABASE" -Atqc \
+            "UPDATE knex_migrations_lock SET is_locked = 0 WHERE \"index\"=1 AND is_locked=1;" \
+            >/dev/null 2>&1 || bashio::log.warning "Failed to clear PostgreSQL migration lock."
     fi
 
     unset PGPASSWORD
 }
 
-# Check data location
-LOCATION=$(bashio::config 'data_location')
-if [[ "$LOCATION" = "null" || -z "$LOCATION" ]]; then
-    # Default location
+# -------------------
+# Data location
+# -------------------
+LOCATION="$(bashio::config 'data_location')"
+if [[ "$LOCATION" == "null" || -z "$LOCATION" ]]; then
     LOCATION="/config/addons_config/joplin"
 else
     bashio::log.warning "Warning : a custom data location was selected, but the previous folder will NOT be copied. You need to do it manually"
 fi
 
-# Create folder
-if [ ! -d "$LOCATION" ]; then
-    echo "Creating $LOCATION"
-    mkdir -p "$LOCATION"
+install -d -m 0755 -o joplin -g joplin "$LOCATION" "$LOCATION/resources"
+
+# Ensure DB exists (touch does not truncate)
+if [[ ! -f "$LOCATION/database.sqlite" ]]; then
+    install -m 0644 -o joplin -g joplin /dev/null "$LOCATION/database.sqlite"
 fi
 
-touch "$LOCATION"/database.sqlite
+# Link resources into server dir
+ln -sfn "$LOCATION/resources" /home/joplin/packages/server/resources
 
-if [ ! -d "$LOCATION"/resources ]; then
-    mkdir -p "$LOCATION"/resources
-fi
-ln -s "$LOCATION"/resources /home/joplin/packages/server
-
-chown -R joplin:joplin "$LOCATION"
-chmod -R 777 "$LOCATION"
-chmod 755 "$LOCATION/database.sqlite"
 export SQLITE_DATABASE="$LOCATION/database.sqlite"
 
+# -------------------
+# DB selection + unlock
+# -------------------
 if bashio::config.has_value 'POSTGRES_DATABASE'; then
     bashio::log.info "Using postgres"
 
-    bashio::config.has_value 'DB_CLIENT' && export DB_CLIENT=$(bashio::config 'DB_CLIENT') && bashio::log.info 'Database client set'
-    bashio::config.has_value 'POSTGRES_PASSWORD' && export POSTGRES_PASSWORD=$(bashio::config 'POSTGRES_PASSWORD') && bashio::log.info 'Postgrep Password set'
-    bashio::config.has_value 'POSTGRES_DATABASE' && export POSTGRES_DATABASE=$(bashio::config 'POSTGRES_DATABASE') && bashio::log.info 'Postgrep Database set'
-    bashio::config.has_value 'POSTGRES_USER' && export POSTGRES_USER=$(bashio::config 'POSTGRES_USER') && bashio::log.info 'Postgrep User set'
-    bashio::config.has_value 'POSTGRES_PORT' && export POSTGRES_PORT=$(bashio::config 'POSTGRES_PORT') && bashio::log.info 'Postgrep Port set'
-    bashio::config.has_value 'POSTGRES_HOST' && export POSTGRES_HOST=$(bashio::config 'POSTGRES_HOST') && bashio::log.info 'Postgrep Host set'
+    bashio::config.has_value 'DB_CLIENT' && export DB_CLIENT="$(bashio::config 'DB_CLIENT')"
+    bashio::config.has_value 'POSTGRES_PASSWORD' && export POSTGRES_PASSWORD="$(bashio::config 'POSTGRES_PASSWORD')"
+    bashio::config.has_value 'POSTGRES_DATABASE' && export POSTGRES_DATABASE="$(bashio::config 'POSTGRES_DATABASE')"
+    bashio::config.has_value 'POSTGRES_USER' && export POSTGRES_USER="$(bashio::config 'POSTGRES_USER')"
+    bashio::config.has_value 'POSTGRES_PORT' && export POSTGRES_PORT="$(bashio::config 'POSTGRES_PORT')"
+    bashio::config.has_value 'POSTGRES_HOST' && export POSTGRES_HOST="$(bashio::config 'POSTGRES_HOST')"
+
     unlock_postgres_migrations
 else
-
     bashio::log.info "Using sqlite"
     unlock_sqlite_migrations "$SQLITE_DATABASE"
-
 fi
 
-##############
-# LAUNCH APP #
-##############
+# -------------------
+# App env
+# -------------------
+bashio::config.has_value 'MAILER_HOST' && export MAILER_HOST="$(bashio::config 'MAILER_HOST')"
+bashio::config.has_value 'MAILER_PORT' && export MAILER_PORT="$(bashio::config 'MAILER_PORT')"
+bashio::config.has_value 'MAILER_SECURITY' && export MAILER_SECURITY="$(bashio::config 'MAILER_SECURITY')"
+bashio::config.has_value 'MAILER_AUTH_USER' && export MAILER_AUTH_USER="$(bashio::config 'MAILER_AUTH_USER')"
+bashio::config.has_value 'MAILER_AUTH_PASSWORD' && export MAILER_AUTH_PASSWORD="$(bashio::config 'MAILER_AUTH_PASSWORD')"
+bashio::config.has_value 'MAILER_NOREPLY_NAME' && export MAILER_NOREPLY_NAME="$(bashio::config 'MAILER_NOREPLY_NAME')"
+bashio::config.has_value 'MAILER_NOREPLY_EMAIL' && export MAILER_NOREPLY_EMAIL="$(bashio::config 'MAILER_NOREPLY_EMAIL')"
+bashio::config.has_value 'MAILER_ENABLED' && export MAILER_ENABLED="$(bashio::config 'MAILER_ENABLED')"
 
-# Configure app
-bashio::config.has_value 'MAILER_HOST' && export MAILER_HOST=$(bashio::config 'MAILER_HOST') && bashio::log.info 'Mailer Host set'
-bashio::config.has_value 'MAILER_PORT' && export MAILER_PORT=$(bashio::config 'MAILER_PORT') && bashio::log.info 'Mailer Port set'
-bashio::config.has_value 'MAILER_SECURITY' && export MAILER_SECURITY=$(bashio::config 'MAILER_SECURITY') && bashio::log.info 'Mailer Security set'
-bashio::config.has_value 'MAILER_AUTH_USER' && export MAILER_AUTH_USER=$(bashio::config 'MAILER_AUTH_USER') && bashio::log.info 'Mailer User set'
-bashio::config.has_value 'MAILER_AUTH_PASSWORD' && export MAILER_AUTH_PASSWORD=$(bashio::config 'MAILER_AUTH_PASSWORD') && bashio::log.info 'Mailer Password set'
-bashio::config.has_value 'MAILER_NOREPLY_NAME' && export MAILER_NOREPLY_NAME=$(bashio::config 'MAILER_NOREPLY_NAME') && bashio::log.info 'Mailer Noreply Name set'
-bashio::config.has_value 'MAILER_NOREPLY_EMAIL' && export MAILER_NOREPLY_EMAIL=$(bashio::config 'MAILER_NOREPLY_EMAIL') && bashio::log.info 'Mailer Noreply Email set'
-bashio::config.has_value 'MAILER_ENABLED' && export MAILER_ENABLED=$(bashio::config 'MAILER_ENABLED') && bashio::log.info 'Mailer Enabled set'
-export APP_BASE_URL=$(bashio::config 'APP_BASE_URL')
+export APP_BASE_URL="$(bashio::config 'APP_BASE_URL')"
 export ALLOWED_HOSTS="*"
 
 bashio::log.info 'Starting Joplin. Initial user is "admin@localhost" with password "admin"'
 
-cd /home/joplin || true
-npm --prefix packages/server start
+cd /home/joplin || exit 1
+exec npm --prefix packages/server start