fix(seafile): address code review follow-ups (log safety, mktemp, deduplication)

Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/741d1aa4-9ead-4fa7-9d53-5af2697a8379

Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 127
+- In the repository : 128
 - Installed : 195429
 
 ### Top 3
@@ -648,6 +648,12 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
+✓  [Nginx Proxy Manager + Static Web Server](nginx_webserver_proxy/) : Nginx Proxy Manager with a built-in configurable static file server. Manage reverse proxies via NPM UI on port 81 while serving files from HA storage on port 80.
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fnginx_webserver_proxy%2Fconfig.yaml)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/arrow-down-bold-circle-outline.svg) [Nzbget](nzbget/) : usenet downloader
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fnzbget%2Fconfig.yaml)

mealie/CHANGELOG.md

@@ -1,4 +1,7 @@
 
+## v3.17.0-1 (2026-05-10)
+- Fix sidebar panel not visible to non-admin HA users (remove duplicate panel_admin key, keep panel_admin: false)
+
 ## v3.17.0 (2026-05-09)
 - Update to latest version from mealie-recipes/mealie (changelog : https://github.com/mealie-recipes/mealie/releases)
 

mealie/config.yaml

@@ -94,7 +94,6 @@ options:
   ssl: false
 panel_admin: false
 panel_icon: mdi:silverware-fork-knife
-panel_admin: false
 ports:
   9001/tcp: 9090
 ports_description:
@@ -115,4 +114,4 @@ schema:
 slug: mealie
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "v3.17.0"
+version: "v3.17.0-1"

qbittorrent/CHANGELOG.md

@@ -1,4 +1,7 @@
 
+## 5.2.0-2 (2026-05-10)
+- Fix startup loop on aarch64: drop s6-notifyoncheck wrapper so s6 supervises qbittorrent-nox directly (LSIO arm64 image has no notification-fd, causing EBADF restart loop)
+
 ## 5.2.0-1 (2026-05-10)
 - Fix qbittorrent-nox path (/usr/bin → /app) after LSIO image update
 

qbittorrent/config.yaml

@@ -143,4 +143,4 @@ schema:
 slug: qbittorrent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.2.0-1"
+version: "5.2.0-2"

qbittorrent/rootfs/etc/s6-overlay/s6-rc.d/svc-qbittorrent/run

@@ -37,13 +37,17 @@ fi
 # --- Launch qBittorrent ---
 
 # Determine log output based on silent mode
-QB_OUTPUT="/dev/stdout"
+QB_OUTPUT="/proc/1/fd/1"
 if bashio::config.true 'silent'; then
     QB_OUTPUT="/dev/null"
 fi
 
 bashio::log.info "Starting qBittorrent..."
 
-exec \
-    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost ${WEBUI_PORT}" \
-    s6-setuidgid abc /app/qbittorrent-nox --webui-port="${WEBUI_PORT}" > "${QB_OUTPUT}"
+if [ -f /etc/s6-overlay/s6-rc.d/svc-qbittorrent/notification-fd ]; then
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost ${WEBUI_PORT}" \
+        s6-setuidgid abc /app/qbittorrent-nox --webui-port="${WEBUI_PORT}" > "${QB_OUTPUT}"
+else
+    exec s6-setuidgid abc /app/qbittorrent-nox --webui-port="${WEBUI_PORT}" > "${QB_OUTPUT}"
+fi

seafile/CHANGELOG.md

@@ -1,4 +1,21 @@
 
+## 12.0.18-6 (2026-05-11)
+- Preserve custom port in `SEAFILE_SERVER_HOSTNAME` (e.g. `seafile.example.com:8443`)
+- Fix `CSRF_TRUSTED_ORIGINS` to use scheme+host[:port] only (no URL path)
+- Add validation: reject newlines and quote characters in URL config values
+- Replace sed address-range approach for `seafile.conf` with idempotent `awk` edit so repeated runs never produce duplicate `host =` keys
+- Harden `apply_addon_urls.sh` generation: baked-in values are written to a separate sourced file using `printf %q` and the script body uses a single-quoted heredoc, eliminating any shell-injection risk from malformed config values
+
+## 12.0.18-5 (2026-05-11)
+- Fix file uploads and downloads through a reverse proxy (e.g. Nginx Proxy Manager) by:
+  - Writing `SEAFILE_SERVER_HOSTNAME` and `SEAFILE_SERVER_PROTOCOL` to `seafile.env` so Seafile knows its external URL
+  - Setting `host = 0.0.0.0` in the `[fileserver]` section of `seafile.conf` so the fileserver binds to all interfaces
+  - Adding `CSRF_TRUSTED_ORIGINS` to `seahub_settings.py` to prevent Django CSRF rejections on HTTPS setups
+  - Making `FILE_SERVER_ROOT` optional (`str?`) so it can be left empty when the reverse proxy handles `/seafhttp` routing
+
+## 12.0.18-4 (2026-05-10)
+- Fix admin account creation by writing `conf/admin.txt` and seeding `seafile.env` with `SEAFILE_ADMIN_EMAIL`/`SEAFILE_ADMIN_PASSWORD` so the upstream `check_init_admin.py` no longer falls back to an interactive prompt (#2685)
+
 ## 12.0.18-3 (2026-05-10)
 - Fix MariaDB connection on HAOS >=17.3 by forcing IPv4 host resolution (#2688)
 

seafile/config.yaml

@@ -79,7 +79,7 @@ name: Seafile
 options:
   env_vars: []
   CONFIG_LOCATION: /config/addons_config/seafile/config.yaml
-  FILE_SERVER_ROOT: http://homeassistant.local:8082
+  FILE_SERVER_ROOT: ""
   PGID: 1000
   PORT: "8082"
   PUID: 1000
@@ -107,7 +107,7 @@ schema:
     - name: match(^[A-Za-z0-9_]+$)
       value: str?
   CONFIG_LOCATION: str?
-  FILE_SERVER_ROOT: str
+  FILE_SERVER_ROOT: str?
   PGID: int
   PORT: str?
   PUID: int
@@ -128,5 +128,5 @@ services:
 slug: seafile
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/seafile
-version: "12.0.18-3"
+version: "12.0.18-6"
 webui: http://[HOST]:[PORT:8000]

seafile/rootfs/etc/cont-init.d/99-run.sh

@@ -94,6 +94,57 @@ sed -i "s|/shared|$DATA_LOCATION|g" /docker_entrypoint.sh
 sed -i "s|/shared|$DATA_LOCATION|g" /home/seafile/*.sh
 #sed -i "s=cp -r ./media $DATA_LOCATION/=chown -R seafile:seafile $DATA_LOCATION/* && chmod -R 777 $DATA_LOCATION/media && cp -rnf ./media/. $DATA_LOCATION/media ||true=g" /home/seafile/*.sh
 
+#####################
+# Admin credentials #
+#####################
+
+# Seafile's check_init_admin.py looks for SEAFILE_ADMIN_EMAIL and
+# SEAFILE_ADMIN_PASSWORD in the env, then falls back to conf/admin.txt, and
+# only prompts interactively if neither is available. The upstream init.sh
+# writes admin.txt, but it is skipped when conf/ccnet.conf or conf/revision
+# already exist (e.g. after a partial previous install) and the env vars do
+# not always reach the seahub subprocess via su. Write admin.txt directly and
+# inject the values into seafile.env so admin creation succeeds (#2685).
+ADMIN_EMAIL_VAL="$(bashio::config 'SEAFILE_ADMIN_EMAIL')"
+ADMIN_PASSWORD_VAL="$(bashio::config 'SEAFILE_ADMIN_PASSWORD')"
+
+if [[ -n "${ADMIN_EMAIL_VAL}" && "${ADMIN_EMAIL_VAL}" != "null" \
+    && -n "${ADMIN_PASSWORD_VAL}" && "${ADMIN_PASSWORD_VAL}" != "null" ]]; then
+    bashio::log.info "Seeding admin credentials"
+
+    mkdir -p "${DATA_LOCATION}/conf"
+
+    ADMIN_FILE="${DATA_LOCATION}/conf/admin.txt"
+    jq -n --arg email "${ADMIN_EMAIL_VAL}" --arg password "${ADMIN_PASSWORD_VAL}" \
+        '{email: $email, password: $password}' > "${ADMIN_FILE}"
+    chown seafile:seafile "${ADMIN_FILE}"
+    chmod 600 "${ADMIN_FILE}"
+
+    SEAFILE_ENV_FILE="${DATA_LOCATION}/conf/seafile.env"
+    touch "${SEAFILE_ENV_FILE}"
+    sed -i '/^SEAFILE_ADMIN_EMAIL=/d' "${SEAFILE_ENV_FILE}"
+    sed -i '/^SEAFILE_ADMIN_PASSWORD=/d' "${SEAFILE_ENV_FILE}"
+
+    case "${ADMIN_EMAIL_VAL}" in
+        *$'\n'*|*$'\r'*)
+            bashio::exit.nok "SEAFILE_ADMIN_EMAIL must not contain newlines"
+            ;;
+    esac
+
+    case "${ADMIN_PASSWORD_VAL}" in
+        *$'\n'*|*$'\r'*)
+            bashio::exit.nok "SEAFILE_ADMIN_PASSWORD must not contain newlines"
+            ;;
+    esac
+
+    {
+        printf 'SEAFILE_ADMIN_EMAIL=%s\n' "${ADMIN_EMAIL_VAL}"
+        printf 'SEAFILE_ADMIN_PASSWORD=%s\n' "${ADMIN_PASSWORD_VAL}"
+    } >> "${SEAFILE_ENV_FILE}"
+    chown seafile:seafile "${SEAFILE_ENV_FILE}"
+    chmod 600 "${SEAFILE_ENV_FILE}"
+fi
+
 #############################################
 # Configure service URL and file server root #
 #############################################
@@ -103,10 +154,8 @@ bashio::log.info "Configuring Seafile URLs"
 SERVER_IP_CONFIG=$(bashio::config 'SERVER_IP')
 SERVICE_URL_CONFIG=$(bashio::config 'url')
 FILE_SERVER_ROOT_CONFIG=$(bashio::config 'FILE_SERVER_ROOT')
-FILE_PORT_CONFIG=$(bashio::config 'PORT')
 
 DEFAULT_HOST=${SERVER_IP_CONFIG:-homeassistant.local}
-DEFAULT_FILE_PORT=${FILE_PORT_CONFIG:-8082}
 
 normalize_url() {
     local raw_url="${1%/}"
@@ -125,7 +174,39 @@ normalize_url() {
 }
 
 SERVICE_URL_VALUE=$(normalize_url "${SERVICE_URL_CONFIG:-${DEFAULT_HOST}:8000}" "http")
-FILE_SERVER_ROOT_VALUE=$(normalize_url "${FILE_SERVER_ROOT_CONFIG:-${DEFAULT_HOST}:${DEFAULT_FILE_PORT}}" "http")
+
+# FILE_SERVER_ROOT is optional; when empty Seafile derives it from SERVICE_URL
+# (clients then reach the fileserver via the same reverse proxy path /seafhttp).
+if [[ -n "${FILE_SERVER_ROOT_CONFIG}" && "${FILE_SERVER_ROOT_CONFIG}" != "null" ]]; then
+    FILE_SERVER_ROOT_VALUE=$(normalize_url "${FILE_SERVER_ROOT_CONFIG}" "http")
+else
+    FILE_SERVER_ROOT_VALUE=""
+fi
+
+# Validate URL values: reject characters that would break config file syntax or
+# the generated helper script (quotes and newlines are the dangerous ones).
+_seafile_validate_url() {
+    local _val="$1" _name="$2"
+    case "${_val}" in
+        *$'\n'*|*$'\r'*|*\"*|*\'*)
+            bashio::exit.nok "${_name} contains invalid characters (newlines or quotes are not allowed)"
+            ;;
+    esac
+}
+_seafile_validate_url "${SERVICE_URL_VALUE}" "url"
+if [[ -n "${FILE_SERVER_ROOT_VALUE}" ]]; then
+    _seafile_validate_url "${FILE_SERVER_ROOT_VALUE}" "FILE_SERVER_ROOT"
+fi
+
+# Extract protocol and host[:port] for seafile.env.
+# Keep the port when present (e.g. seafile.example.com:8443) so Seafile
+# advertises the correct external endpoint on non-standard ports.
+SERVER_PROTOCOL="${SERVICE_URL_VALUE%%://*}"
+_service_authority="${SERVICE_URL_VALUE#*://}"
+SERVER_HOSTNAME="${_service_authority%%/*}"   # strip any path; keep host:port
+
+# CSRF_TRUSTED_ORIGINS requires scheme://host[:port] only – no path component.
+CSRF_ORIGIN="${SERVER_PROTOCOL}://${SERVER_HOSTNAME}"
 
 SEAHUB_CONF_DIRS=()
 if [[ -d "${DATA_LOCATION}/conf" || ! -d "${DATA_LOCATION}/seafile/conf" ]]; then
@@ -145,28 +226,135 @@ for conf_dir in "${SEAHUB_CONF_DIRS[@]}"; do
 
     sed -i '/^SERVICE_URL *=/d' "${SEAHUB_SETTINGS_FILE}"
     sed -i '/^FILE_SERVER_ROOT *=/d' "${SEAHUB_SETTINGS_FILE}"
+    sed -i '/^CSRF_TRUSTED_ORIGINS *=/d' "${SEAHUB_SETTINGS_FILE}"
 
-    {
-        echo "SERVICE_URL = \"${SERVICE_URL_VALUE}\""
-        echo "FILE_SERVER_ROOT = \"${FILE_SERVER_ROOT_VALUE}\""
-    } >> "${SEAHUB_SETTINGS_FILE}"
+    printf 'SERVICE_URL = "%s"\n' "${SERVICE_URL_VALUE}" >> "${SEAHUB_SETTINGS_FILE}"
+    if [[ -n "${FILE_SERVER_ROOT_VALUE}" ]]; then
+        printf 'FILE_SERVER_ROOT = "%s"\n' "${FILE_SERVER_ROOT_VALUE}" >> "${SEAHUB_SETTINGS_FILE}"
+    fi
+    printf 'CSRF_TRUSTED_ORIGINS = ["%s"]\n' "${CSRF_ORIGIN}" >> "${SEAHUB_SETTINGS_FILE}"
 done
 
 bashio::log.info "SERVICE_URL set to ${SERVICE_URL_VALUE}"
-bashio::log.info "FILE_SERVER_ROOT set to ${FILE_SERVER_ROOT_VALUE}"
+if [[ -n "${FILE_SERVER_ROOT_VALUE}" ]]; then
+    bashio::log.info "FILE_SERVER_ROOT set to ${FILE_SERVER_ROOT_VALUE}"
+else
+    bashio::log.info "FILE_SERVER_ROOT not set; Seafile will derive it from SERVICE_URL"
+fi
+bashio::log.info "CSRF_TRUSTED_ORIGINS set to [\"${CSRF_ORIGIN}\"]"
+
+#############################################
+# Configure seafile.env (hostname/protocol) #
+#############################################
+
+bashio::log.info "Configuring seafile.env (SEAFILE_SERVER_HOSTNAME=${SERVER_HOSTNAME}, SEAFILE_SERVER_PROTOCOL=${SERVER_PROTOCOL})"
+
+for conf_dir in "${SEAHUB_CONF_DIRS[@]}"; do
+    SEAFILE_ENV_FILE="${conf_dir}/seafile.env"
+    touch "${SEAFILE_ENV_FILE}"
+    chown seafile:seafile "${SEAFILE_ENV_FILE}" 2>/dev/null || true
+    chmod 600 "${SEAFILE_ENV_FILE}"
+    sed -i '/^SEAFILE_SERVER_HOSTNAME=/d' "${SEAFILE_ENV_FILE}"
+    sed -i '/^SEAFILE_SERVER_PROTOCOL=/d' "${SEAFILE_ENV_FILE}"
+    {
+        printf 'SEAFILE_SERVER_HOSTNAME=%s\n' "${SERVER_HOSTNAME}"
+        printf 'SEAFILE_SERVER_PROTOCOL=%s\n' "${SERVER_PROTOCOL}"
+    } >> "${SEAFILE_ENV_FILE}"
+done
+
+#############################################
+# Configure fileserver binding (0.0.0.0)   #
+#############################################
 
 # The upstream write_config.sh hardcodes /seafhttp in FILE_SERVER_ROOT and
 # overwrites our settings on first run.  Create a helper that re-applies the
 # addon's URL configuration right before Seafile services start, so it always
 # takes effect regardless of what the upstream init/setup scripts wrote.
-cat > /home/seafile/apply_addon_urls.sh << URLEOF
+#
+# addon_url_config.sh holds the baked-in values (printf %q escaped) AND the
+# shared _seafile_set_fileserver_host function so the logic lives in exactly
+# one place.  The apply_addon_urls.sh helper sources that file and uses the
+# function; this script sources it too so it can call the same function below.
+{
+    printf 'ADDON_DATA_LOCATION=%q\n'      "${DATA_LOCATION}"
+    printf 'ADDON_SERVICE_URL=%q\n'        "${SERVICE_URL_VALUE}"
+    printf 'ADDON_FILE_SERVER_ROOT=%q\n'   "${FILE_SERVER_ROOT_VALUE:-}"
+    printf 'ADDON_SERVER_HOSTNAME=%q\n'    "${SERVER_HOSTNAME}"
+    printf 'ADDON_SERVER_PROTOCOL=%q\n'    "${SERVER_PROTOCOL}"
+    printf 'ADDON_CSRF_ORIGIN=%q\n'        "${CSRF_ORIGIN}"
+    # Shared helper: idempotently set host = 0.0.0.0 in the [fileserver] INI
+    # section using awk (avoids sed address-range pitfalls that leave duplicate
+    # keys).  mktemp ensures a unique temp file; on any failure the original is
+    # left untouched.
+    cat << 'FUNCEOF'
+_seafile_set_fileserver_host() {
+    local _cf="$1"
+    local _tmp
+    _tmp=$(mktemp "${_cf}.XXXXXX") || return 1
+    awk '
+        /^\[fileserver\]/ { in_fs=1; print; next }
+        /^\[/             { in_fs=0 }
+        in_fs && /^[[:space:]]*host[[:space:]]*=/ { next }
+        { print }
+    ' "${_cf}" > "${_tmp}" && mv "${_tmp}" "${_cf}" || { rm -f "${_tmp}"; return 1; }
+    if grep -q '^\[fileserver\]' "${_cf}"; then
+        sed -i '/^\[fileserver\]/a host = 0.0.0.0' "${_cf}"
+    else
+        printf '\n[fileserver]\nhost = 0.0.0.0\n' >> "${_cf}"
+    fi
+}
+FUNCEOF
+} > /home/seafile/addon_url_config.sh
+chmod 644 /home/seafile/addon_url_config.sh
+
+# Source so _seafile_set_fileserver_host is available in this script.
+# shellcheck disable=SC1091
+. /home/seafile/addon_url_config.sh
+
+bashio::log.info "Setting fileserver host to 0.0.0.0 in seafile.conf"
+
+for conf_dir in "${SEAHUB_CONF_DIRS[@]}"; do
+    SEAFILE_CONF="${conf_dir}/seafile.conf"
+    mkdir -p "${conf_dir}"
+    if [[ -f "${SEAFILE_CONF}" ]]; then
+        _seafile_set_fileserver_host "${SEAFILE_CONF}"
+    else
+        printf '[fileserver]\nhost = 0.0.0.0\n' > "${SEAFILE_CONF}"
+        chown seafile:seafile "${SEAFILE_CONF}" 2>/dev/null || true
+    fi
+done
+
+cat > /home/seafile/apply_addon_urls.sh << 'URLEOF'
 #!/bin/bash
-for _CONF in "${DATA_LOCATION}/conf/seahub_settings.py" "${DATA_LOCATION}/seafile/conf/seahub_settings.py"; do
-    if [ -f "\$_CONF" ]; then
-        sed -i '/^SERVICE_URL *=/d' "\$_CONF"
-        sed -i '/^FILE_SERVER_ROOT *=/d' "\$_CONF"
-        echo 'SERVICE_URL = "${SERVICE_URL_VALUE}"' >> "\$_CONF"
-        echo 'FILE_SERVER_ROOT = "${FILE_SERVER_ROOT_VALUE}"' >> "\$_CONF"
+# shellcheck disable=SC1091
+. /home/seafile/addon_url_config.sh
+
+for _CONF in "${ADDON_DATA_LOCATION}/conf/seahub_settings.py" \
+             "${ADDON_DATA_LOCATION}/seafile/conf/seahub_settings.py"; do
+    if [ -f "$_CONF" ]; then
+        sed -i '/^SERVICE_URL *=/d'          "$_CONF"
+        sed -i '/^FILE_SERVER_ROOT *=/d'     "$_CONF"
+        sed -i '/^CSRF_TRUSTED_ORIGINS *=/d' "$_CONF"
+        printf 'SERVICE_URL = "%s"\n' "${ADDON_SERVICE_URL}" >> "$_CONF"
+        if [ -n "${ADDON_FILE_SERVER_ROOT}" ]; then
+            printf 'FILE_SERVER_ROOT = "%s"\n' "${ADDON_FILE_SERVER_ROOT}" >> "$_CONF"
+        fi
+        printf 'CSRF_TRUSTED_ORIGINS = ["%s"]\n' "${ADDON_CSRF_ORIGIN}" >> "$_CONF"
+    fi
+done
+for _ENV in "${ADDON_DATA_LOCATION}/conf/seafile.env" \
+            "${ADDON_DATA_LOCATION}/seafile/conf/seafile.env"; do
+    if [ -f "$_ENV" ]; then
+        sed -i '/^SEAFILE_SERVER_HOSTNAME=/d' "$_ENV"
+        sed -i '/^SEAFILE_SERVER_PROTOCOL=/d' "$_ENV"
+        printf 'SEAFILE_SERVER_HOSTNAME=%s\n' "${ADDON_SERVER_HOSTNAME}" >> "$_ENV"
+        printf 'SEAFILE_SERVER_PROTOCOL=%s\n' "${ADDON_SERVER_PROTOCOL}" >> "$_ENV"
+    fi
+done
+for _SCONF in "${ADDON_DATA_LOCATION}/conf/seafile.conf" \
+              "${ADDON_DATA_LOCATION}/seafile/conf/seafile.conf"; do
+    if [ -f "$_SCONF" ]; then
+        _seafile_set_fileserver_host "$_SCONF"
     fi
 done
 URLEOF