Two review findings on PR #2871:
- coderabbitai: MIN_CHARS/MIN_SAVED_TOKENS parsed with a bare int() at module
import time, before any try/except could catch a bad value — a malformed
env_vars passthrough would crash the hook on every matched tool call instead
of failing open as documented. Wrapped in _int_env() with a safe fallback.
- chatgpt-codex-connector: Glob and Grep (files_with_matches mode) return a
`filenames: string[]` field per the CLI's own output schema, which the
hook's string-only candidate scan never touched — large file listings, the
exact case named in the CLAUDE.md guidance this add-on installs, passed
through uncompressed. Verified empirically that routing such an array
through compress()/SmartCrusher (as done for JSON-blob string fields)
silently subsamples it — 600 paths collapsed to ~15 with no visible marker,
unsafe for paths the model needs to act on individually. Added a separate
deterministic path: arrays over ARRAY_KEEP (40) entries are truncated in
order with one labeled marker entry appended, full array recoverable from
the CCR store by hash. Verified round-trip on Glob- and Grep-shaped
payloads (600 and 200 entries); confirmed order preservation and that
small arrays still pass through untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Desktop-spawned Claude Code sessions (cowork/dispatch) pin ANTHROPIC_BASE_URL
to the production endpoint (headroom #869), so the transparent proxy never
sees their traffic and compression depended on the model voluntarily calling
the headroom MCP tools. A managed PostToolUse hook now compresses
Bash/Grep/Glob/WebFetch outputs over ~4000 chars in every session type with
Headroom's rule-based pipeline, swapping them in via
hookSpecificOutput.updatedToolOutput with a retrieval marker. Originals live
in the shared CCR SQLite store, so mcp__headroom__headroom_retrieve recovers
them; savings land in the durable ledger (client "posttooluse-hook").
The hook fails open, never compresses stderr, skips sub-50-token savings, and
registers idempotently in ~/.claude/settings.json only after a --self-test
gate; new headroom_auto_compress option (default true) removes the managed
entry cleanly when disabled. Measured: 10781->2964 tokens (73%) on a
representative HA states dump, ~1.7 s hook overhead, <100 ms pass-through.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three add-on runtime-environment bugs, all found while investigating a Headroom
dashboard stuck at 0 gain.
Headroom MCP server had no HF_HOME. 1.27 fixed the Kompress model cache for the
svc-headroom proxy longrun by exporting HF_HOME there, but the MCP server is a
different process: Claude Desktop and Claude Code spawn it from the registered
mcpServers entry, so it never saw that export and kept resolving the HuggingFace
cache to ~/.cache, which this add-on symlinks to tmpfs. Its Kompress ML path
therefore never found the model, re-downloaded ~270 MB into tmpfs on every boot,
and lost it on the next one -- headroom_compress returned router:noop (output
unchanged) for prose and other unstructured content. Rule-based compression
(SmartCrusher, structured tool output) was unaffected and worked throughout,
which is why the failure only showed on some payloads. Carry env.HF_HOME on the
managed headroom entry in both claude_desktop_config.json and ~/.claude.json.
~/.gitconfig was written as root and left unreadable by abc. `git config --global`
ran as root during init and rewrites the file on every start, so 20-folders.sh's
earlier recursive chown never stuck to it; .config/gh survived abc-owned only
because the "already authenticated" branch skips rewriting it. The user that
actually runs git, gh and Claude could not read its own committer identity or the
gh credential helper: every commit failed with "Author identity unknown" and
authenticated pushes fell back to prompting. Run the git/gh setup as abc via
s6-setuidgid, matching 81-tokensave_repositories.sh, and reclaim root-owned
copies left by earlier versions before writing.
~/.bashrc accumulated stale HOME/FM_HOME exports across data_location changes.
The idempotency guard only tested for the current $LOCATION, so changing the
option and later changing it back appended a second block while leaving the first,
and the last one written won for every interactive shell. $HOME then pointed at a
directory the add-on no longer manages, so anything resolving config through it
read the wrong path -- `headroom doctor` reported "claude: not routed (no
~/.claude/settings.json)" against a correctly routed install, and bare `headroom`
invocations created a stray .headroom tree under the old location. Make the block
marker-delimited and rewrite it from scratch each boot.
Verified on a running add-on: headroom_compress now reports 1909 -> 1122 tokens
(41.2%, router:mixed) through the live MCP server; `headroom doctor` reports
"claude: routed via /data/data/.claude/settings.json"; and git commits work as abc
without a repo-local identity override.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codex flagged that the synchronous pre-warm (up to 300s) blocked the proxy port bind, defeating the terminal wrapper's health-check fallback and, combined with the new settings-managed ANTHROPIC_BASE_URL, could send terminal Claude Code launches to a proxy that was not listening yet.
The proxy already has a non-blocking answer to a cold cache: content_router.py calls compressor.ensure_background_load() on first use and passes the request through uncompressed until the model lands, so the port always binds immediately. Persisting HF_HOME alone is enough -- Kompress self-heals within the first couple of requests on a cold boot and loads instantly (eager preload) on every boot after.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
flock -n silently skipped TokenSave prep on lock contention with no retry until next restart; wait up to 60s instead (kernel releases flock the instant its owner exits, so only a truly stuck lock can't clear within that window).
Quarantine fired on any sync failure after 3 retries, including transient causes (permissions, disk full, missing binary) unrelated to corruption. Now only quarantines when stderr names actual database corruption (SQLite malformed/not-a-database/disk-image wording); other failures leave the index untouched and retry next start.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Headroom kept reporting zero savings for two independent reasons:
1. Desktop cowork/local-agent-mode sessions never reached the proxy.
Desktop spawns its bundled Claude Code binary at an absolute path
(bypassing the PATH wrapper) with ANTHROPIC_BASE_URL pinned to the
production endpoint (headroom #869). Manage env.ANTHROPIC_BASE_URL
in ~/.claude/settings.json instead — Claude Code writes settings
`env` entries over the inherited environment at startup, and cowork
sessions load user settings. Managed-value semantics: only set or
remove the variable when absent or equal to the add-on-managed proxy
URL, so a user-customized endpoint is never clobbered.
2. Even proxied traffic compressed nothing (175 requests, 0 saved).
The proxy's startup preload is cache-only, but the HF model cache
defaulted to ~/.cache -> tmpfs, wiped every restart, so the Kompress
ONNX model and its separately fetched ModernBERT tokenizer were
never cached and the engine idled in "deferred" mode forever
(misleadingly logged as "Kompress: not installed"). svc-headroom now
sets HF_HOME to persistent ~/.headroom/hf and pre-warms the cache
once at startup, bounded at 300s so an offline install still starts
the proxy in pass-through mode and retries next boot. The proxy
extra's ONNX runtime suffices — the multi-GB PyTorch [ml] extra is
deliberately not installed.
Verified live: proxy logs "Kompress: ENABLED (ModernBERT token
compressor)" after restart, and a terminal `claude -p` round-trip
increments the proxy's api_requests counter.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bashio::config prints its result via printf without a trailing newline, so
a plain while-read loop drops the last (often only) configured project path
and no TokenSave repository would be initialized. Use the
read || [ -n ... ] idiom in the three path loops so the final unterminated
record is still processed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KN8i26JrKSaBdvTrpVEyQ6
Codacy flagged the `A && B || continue` short-circuit pattern in the three
tokensave path loops; rewrite it as an explicit if so the fallback can never
run when both tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KN8i26JrKSaBdvTrpVEyQ6
Version 1.25 chowned the data location to a hardcoded 1000:1000 but never
mapped the shared abc desktop user to that UID: during cont-init abc was
still the image default (911), so TokenSave, RTK, nginx, PulseAudio, the
Mesa shader cache, and Claude Desktop itself failed with Permission denied.
The base image's init-adduser then remapped abc to root mid-startup because
it reads PUID/PGID from add-on options (fallback 0) where they were never
defined, which additionally made Claude Code reject bypass mode.
- Add PUID/PGID add-on options (default 1000:1000) and remap abc to that
identity at the top of 20-folders.sh, before any ownership pass and
before any service resolves the user; pin init-adduser to the same
effective identity so it cannot diverge mid-startup.
- In permission_mode bypass, fall back from a configured PUID 0 to UID
1000, since Claude Code refuses bypass permissions as root.
- Replace the nonexistent bashio::config.array (only present in the repo's
standalone bashio) with bashio::config in the TokenSave repository setup,
tools configuration, and claude-tools-doctor.sh.
- Chown managed Claude configuration files to the effective abc identity
instead of the raw configured PUID/PGID, which fell back to root.
- Pre-create /tmp/.X11-unix (sticky 1777) so Xorg running as non-root abc
on the tmpfs /tmp can create its socket.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KN8i26JrKSaBdvTrpVEyQ6
The startup indexer chose init vs sync purely on whether
.tokensave/tokensave.db existed, so an interrupted init or a hard
add-on stop mid-write could leave a partial or malformed SQLite graph
that every subsequent boot then ran `sync` against, failing (and
staying broken) forever.
Prepare each configured repo defensively instead:
- serialize the operation under a startup-scoped flock so an
overlapping restart or a mid-boot git post-commit/checkout sync hook
can't write the same DB concurrently;
- refresh an existing index with a retried incremental sync, since
SQLITE_BUSY from lock contention is transient, not corruption;
- quarantine a genuinely unreadable index (sync still failing after
retries) or a half-written one (an interrupted init, detected via a
sentinel file) to .tokensave/corrupt-<timestamp>/ and rebuild from
scratch, so the graph self-heals rather than propagating corruption.
All file operations run as the abc runtime user because the repo
.tokensave directory is outside this script's final ownership pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The /usr/local/bin/claude wrapper hardcoded HEADROOM_BIN as
/usr/local/bin/headroom, but the binary is installed at
/usr/bin/headroom (symlink to /lsiopy/bin/headroom). The -x check
therefore always failed and terminal Claude Code sessions never
routed through the Headroom proxy at 127.0.0.1:8787.
Resolve the binary with "command -v headroom" instead; an empty
result still fails the -x check safely and falls back to launching
Claude Code directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Check ha_mcp_token before SUPERVISOR_TOKEN: this add-on always sets
homeassistant_api, so the admin-equivalent Supervisor token was always
present and silently shadowed a user's deliberately scoped-down
ha_mcp_token, defeating the documented scoping path (Codex P1).
- Make ha-cli itself refuse to run when enable_ha_api_helper is false,
instead of only removing the CLAUDE.md guidance text — disabling the
option now actually disables the helper (Codex P2).
- Normalize HA_BASE_URL to include /api when the user omits it, so REST
calls don't 404 (CodeRabbit).
- Read/write CLAUDE.md with explicit UTF-8 in the ha-api-helper removal
block, matching the emoji/special characters Claude tends to write
there (CodeRabbit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ship a `ha-cli` command that lets Claude configure Home Assistant
(automations, scripts, scenes, helpers, dashboards, registries, service
calls) through the Home Assistant Core API instead of a /config filesystem
mount, so secrets.yaml and other add-ons' credentials stay out of reach.
It authenticates automatically with the add-on's SUPERVISOR_TOKEN via the
Supervisor Core-API proxy (no token setup), with optional HA_TOKEN /
ha_mcp_token overrides for a scoped Home Assistant user. A managed guidance
block in ~/.claude/CLAUDE.md tells Claude Code to use the helper and to
confirm before writes. Gated by the new enable_ha_api_helper option
(default on). Adds the websockets dependency for the WebSocket subcommand.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Home Assistant's MCP Server integration serves stateless Streamable HTTP at
/api/mcp; mcp-proxy defaults to SSE, so the previous registration (SSE at
/mcp_server/sse) could never attach. Pass --transport=streamablehttp
--stateless and default ha_mcp_url to /api/mcp.
Match managed MCP entries by binary basename outside $HOME so a base-image
path change still updates them, while user-installed binaries under $HOME
remain untouched. Resolve tokensave via command -v like the others.
Write Claude config files 0600 (they hold the HA long-lived token in clear
text) and scope the build-time chmod +x pass to the shipped script dirs.
Docs: dashboard reachability wording, stale /config/data HOME, and the
custom-script filename (claude_desktop.sh, per the $slug.sh template).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Legacy monolithic builder was removed upstream in 2026.06.0; this repo
already uses the modular build-image action, so only the pin moves
(2026.03.2 -> 2026.06.0). Action inputs/outputs unchanged upstream —
drop-in compatible. Also strips trailing whitespace at EOF (yamllint).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Remove standalone web terminal (ttyd/tmux service, port 7681, terminal_*
options, claude-direct/claude-headroom wrappers). Claude Code stays and
powers Desktop cowork/dispatch sessions.
Fix Headroom dashboard: proxy bound 127.0.0.1 only, mapped port 8787
refused external connections; bind 0.0.0.0.
Fix dispatch/sign-in persistence: gnome-keyring package was never
installed, so the autostart keyring bootstrap no-oped and Electron
safeStorage was unavailable (allowlist cache + auth grants lost).
Add tokensave MCP (pinned 7.2.0, source-built like RTK), real HA MCP
bridge via mcp-proxy (enable_ha_mcp + ha_mcp_url/ha_mcp_token), uv for
additional_pip. Register managed MCP servers in Desktop and Claude Code
configs without clobbering user entries. Drop orphan options
ha_smart_context/dangerously_skip_permissions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The published 8.19.18 images are correct (verified: real ES 8.19.18,
run as root, migration + privilege-drop in place). But some upgrades
were left running a stale cached Elasticsearch 7.17.9 image that starts
as uid 1000, producing the reported "mv: cannot move '/data/config' ...
Permission denied" and "AccessDeniedException[.../data/nodes/0]".
- Bump version to 8.19.18-3 to force Home Assistant / Docker to pull a
fresh image tag instead of reusing the cached one.
- Add an explicit root check on the first init pass (before any move or
chown) so a non-root start fails with a clear, actionable message
instead of the cryptic permission error, and wrap the config-archive
mv with the same clear failure. The re-exec'd uid-1000 pass returns
before this check, so the privilege drop still works.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Elasticsearch refuses to bootstrap as root ("can not run elasticsearch
as root"). The previous fix in this PR kept the container root at
runtime to fix the /data permission failure, but never dropped
privileges again afterward — unlike 7.17.9, whose own entrypoint used
`chroot --userspec=1000:0` before launching Elasticsearch, the upstream
8.x entrypoint no longer does that. So every start, fresh or upgrade,
would fail once addon-init.sh's setup finished.
Fix: after addon-init.sh completes its root-only work (migration guard,
data/config relocation, chown), it re-execs the entrypoint itself as
uid 1000 via `chroot --userspec=1000:0 / ...` — the same mechanism
7.17.9 used, and exactly what the add-on's AppArmor profile already
grants (sys_chroot, setuid, setgid). On the re-exec'd pass the script
returns immediately (guarded by an exported sentinel) so none of the
setup work repeats; exported env vars (env_vars, the security default)
survive the exec normally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reported: on upgrade from an existing 7.17.9 install, the add-on failed
to start with "mv: cannot move '/data/config' to
'/data/config.bak-7.17.9': Permission denied".
Root cause: a previous fix in this same release restored `USER 1000:0`
at the end of the Dockerfile to match the upstream base image's own
final USER directive. But the upstream 8.19 entrypoint no longer drops
privileges itself (confirmed: it execs elasticsearch directly, no
gosu/chroot dance), and existing installs have /data owned by root
(7.17.9's default image variant runs fully as root). A non-root
container can never chown or move that data.
Revert to root at runtime, matching how this add-on always ran and
matching its own AppArmor profile (chown, setuid, setgid, sys_chroot,
mount capabilities — all meaningless for a non-root process anyway).
Root stays required for the build-time entrypoint patch too, unchanged
from the prior fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
curl -f treated any 4xx as failure, including 401. Users who enable
xpack.security (a supported override via ES_SETTING_XPACK_SECURITY_ENABLED)
got 401 on the unauthenticated healthcheck request, so the version marker
was never written and every restart re-logged the one-time migration
notice. Read the HTTP status directly and accept 200 or 401.
Reviewed and skipped: the cp -rn merge-into-existing-directory concern —
verified empirically (both locally and against the image's Debian/GNU
coreutils base) that GNU cp merges correctly into a pre-existing
same-named destination without nesting; the existing test suite already
exercises this exact path (legacy 7.x data preserved during migration).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- The 8.19.18 base image ends the build as USER 1000:0 with a
root-owned, read-only (0555) entrypoint, so the sed patch and later
chmod/package-install steps failed. Switch to root for the build and
restore the Elasticsearch user before runtime.
- Tighten the env_vars name check to require a leading letter/underscore
(shell identifier rules) instead of allowing a leading digit, which
made `export "$name"=...` fail and abort startup under `set -e`.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The add-on reported version 8.14.3 but the shipped image was still
Elasticsearch 7.17.9 — the Dockerfile BUILD_UPSTREAM was never bumped,
and the builder uses that ARG. The homeassistant-elasticsearch
integration requires 8.14+, so configuration failed (#2849).
- Upgrade to Elasticsearch 8.19.18 (latest 8.x; 9.x cannot read indices
created in 7.x)
- Add automatic 7.x -> 8.x data migration with a guard that aborts on
unsupported paths (downgrade, or data more than one major behind).
The version marker is written only after ES answers on 9200, so a
failed upgrade never masks the true on-disk data lineage
- Default xpack.security.enabled=false to preserve plain-HTTP behavior
the HA component expects; override via ES_SETTING_XPACK_SECURITY_ENABLED
- Fix the env_vars option, which never worked (the image has no
s6-overlay, so the cont-init stack never ran)
- Remove the ingest-attachment plugin install (bundled since ES 8.0,
which broke the 8.x build)
- Replace line-number-based entrypoint patching with a proper init
script sourced via a pattern-anchored injection
- Add updater.json pinned to the 8.19 line to prevent version drift and
accidental 9.x jumps
Fixes#2849
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The build-time hook that removes `sudo` from the BirdNET-Pi scripts was
injected at line 2 of newinstaller.sh, i.e. before the repo is cloned, so it
was a no-op and `sudo` remained in 25 scripts. Outside Home Assistant this
breaks every script invoked by a non-sudoers user (php-fpm's `caddy` user for
the WebUI System Controls, or `abc`) with "X is not in the sudoers file",
which is what prevented standalone (no-Supervisor) operation. Move the strip
to run after the installer clones the repo. Also drop the unused (and, in this
fork, incorrect) `$my_dir` -> `/config` rewrite.
Additionally create /run/php before starting PHP-FPM: it is normally created
by systemd-tmpfiles, which does not run in this container, so on a fresh/tmpfs
/run the socket cannot be bound and the WebUI never comes up.
Verified against the published 2026.07.10 image: the WebUI serves HTTP 200 and
restart_services.sh runs cleanly as the non-sudoers `caddy` user.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Creates a new Home Assistant add-on that installs from zach7036's BirdNET-Pi-Enhanced-Version fork instead of the Nachtzuster/alexbelgium fork. Leaves the existing birdnet-pi addon untouched.
Key changes from birdnet-pi:
- Installer repointed to zach7036/BirdNET-Pi-Enhanced-Version/main/newinstaller.sh
- Removed alexbelgium repo rename sed (zach7036 fork already clones itself)
- Removed merge_open_prs PR-merging step (install stable main)
- Updated slug to birdnet-pi-zach, image to birdnet-pi-zach-{arch}
- Updated README/docs upstream description
- Unique apparmor profile name
The generic Dockerfile patches (strip sudo, remap my_dir, systemctl shims) apply unchanged to the new fork since it follows standard BirdNET-Pi layout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Gate the headroom section on install_headroom (bashio::config.true), same
as svc-headroom, instead of only checking whether the binary is on PATH
(it's pip-installed unconditionally at build time, so it's always
present). have_headroom is now just a secondary availability guard.
Fixes noisy/stale headroom output when the option is disabled.
- Switch the shebang to with-contenv bashio so HOME comes from the s6
envdir instead of a hardcoded /data/data. 20-folders.sh only rewrites
/data/data references under /defaults, /etc/cont-init.d,
/etc/services.d and /etc/s6-overlay/s6-rc.d — not /usr/local/bin — so
a custom data_location previously left this script reading/writing the
wrong home directory.
Verified live: real cron firing confirms with-contenv correctly resolves
HOME and bashio::config from the s6 envdir when invoked by cron; isolated
gating-logic test covers all four enabled/binary-present combinations.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add claude-gains-report.sh + /defaults/crontabs/root: an hourly rtk gain +
headroom savings snapshot to the add-on log (heartbeat + accumulated gains).
- Add svc-headroom longrun: run the headroom proxy as a local MCP backend
(127.0.0.1:8787, no client routing) so headroom_compress/headroom_retrieve
actually store/retrieve content and record savings. Backend only, so the
Claude Desktop app's traffic is untouched (headroom #869).
- Nudge headroom tool usage via a managed, idempotent CLAUDE.md block.
- Bump version 1.6 -> 1.7 and update CHANGELOG.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The removal block's json.loads() was wrapped in a bare try/except that set
data = None on any parse error, then silently no-op'd (isinstance(data, dict)
is False) with exit 0 -- so a malformed claude_desktop_config.json meant the
headroom entry was never removed and bashio::log.warning never fired.
Drop the try/except so parse errors propagate naturally and the script exits
non-zero, matching the sibling rtk removal block's existing convention and
triggering the bashio::log.warning fallback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw
headroom's proxy/wrap routing relies on ANTHROPIC_BASE_URL, which Claude
Desktop force-overrides (headroom #869), so it cannot transparently compress
the desktop app. Register headroom's MCP server (headroom mcp serve) in Claude
Desktop's claude_desktop_config.json instead -- the supported integration --
exposing the headroom_compress/headroom_retrieve/headroom_stats tools inside
the app. The plain desktop launch is left untouched.
The JSON merge is idempotent, preserves any other MCP servers and top-level
keys, backs up malformed config, and removes the entry again when
install_headroom is disabled.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw
headroom "wrap" only accepts coding-agent CLIs (claude, codex, cursor, ...)
with agent args after "--", so it cannot wrap the claude-desktop Electron app.
Route the launch through headroom's standalone compression proxy instead: the
command file now starts "headroom proxy" and points Claude Desktop at it via
ANTHROPIC_BASE_URL, while the autostart still falls back to a plain launch if
that fails.
Claude Desktop currently force-overrides ANTHROPIC_BASE_URL (headroom #869), so
transparent compression only engages once upstream adds Desktop support; until
then the app launches normally. Update the README/CHANGELOG accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw
install_headroom defaults to true and headroom is baked into the image, so
82-claude_tools.sh rewrote the desktop launch to "headroom wrap claude-desktop
--no-sandbox ...". headroom "wrap" only accepts coding-agent CLIs (claude,
codex, cursor, ...) and expects agent arguments after a "--" separator, so
"claude-desktop" plus the Electron flags is an invalid wrap target/options.
The autostart ran only that command with no fallback, leaving the desktop app
unlaunched for default users.
- Keep the plain claude-desktop launch; just expose headroom with a usage hint
(matches the documented "make headroom available and log a usage hint").
- Harden autostart to fall back to the default launch if a custom/wrapped
command fails to start.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw
Startup crash loop ("All subprocesses terminated. Exiting."):
- Drop the misplaced shm_size env var (Home Assistant ignores it) and run Claude
Desktop with --disable-dev-shm-usage so the Electron renderer survives the default
64 MB /dev/shm.
- Make the Selkies desktop init oneshots (init-video, init-selkies-config) tolerant so
a partially-permitted device/permission op in the HA sandbox no longer fails add-on
bringup and crash-loops the container.
- Pre-create /tmp/selkies_js.log so the base image's "chmod 777 /tmp/selkies*" calls
never fail on an empty glob; reconcile XDG_RUNTIME_DIR to the tmpfs runtime dir.
Sign-in persistence ("Your sign-in won't be saved on this device"):
- Bundle gnome-keyring/libsecret-1-0/dbus-x11 and start an unlocked Secret Service in
the desktop session, launching with --password-store=gnome-libsecret. The keyring DB
lives on persistent storage (/config/data), so the session survives restarts.
Docs: add SIGN_IN.md documenting both problems and the (deferred) in-desktop browser
option needed to complete the initial OAuth login.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XycVEAj8oZgmQszn9gdQ2E
- Exit with a clear error if the /app/config migration fails, rather than
continuing to run against the non-persistent source directory (user
changes would otherwise silently vanish on the next restart).
- Exit with a clear error if /app is missing instead of swallowing a
broken upstream image layout with `|| true`.
Addresses further review feedback from PR #2816.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW
- Generate ENCRYPTION_KEY as 64 hex chars instead of base64: upstream reads
it via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc, so a base64
value silently broke Spotify token encryption for anyone leaving the
option blank (the default path).
- Store the key without a trailing newline and chmod 600 it.
- Only delete /app/config after a successful copy into /config, so a
failed migration (permissions, disk full) can't silently wipe the
upstream default config.
Addresses review feedback from PR #2816.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW
New add-on wrapping the upstream jjdenhertog/spotify-to-plex Docker image
(requested in issue #2814). Keeps Spotify playlists synced to Plex.
- Wraps the multi-arch upstream image via BUILD_FROM (amd64 + aarch64)
- Uses the shared ha_entrypoint framework with 00-global_var.sh so add-on
options (Spotify credentials, redirect URI, encryption key) become the
environment variables the app expects
- 99-run.sh persists /app/config into the add-on config dir, auto-generates
and stores a stable ENCRYPTION_KEY when left blank, then hands off to the
upstream supervisord
- Web UI exposed directly on port 9030
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW
Addresses review feedback on the sqlite persistence fix (PR #2812):
- validate_safe_path now rejects ".." path segments so a relative
output.sqlite.path can't traverse outside /config when rewritten.
- The rewrite now creates the destination's parent directory, since
SQLite won't create one itself for a path like "db/birdnet.db".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHJ4o22cdcgdNtb81tBTPJ
Upstream's shipped default config.yaml explicitly sets
output.sqlite.path to the relative "birdnet.db", so the missing-only
("//=") seeding of that key never fired. A relative path resolves
against the app's ephemeral container working directory instead of the
persistent /config volume, so the database was silently recreated
empty on every restart.
Rewrite any relative output.sqlite.path to live under /config on
startup, leaving already-absolute (user-customized) paths untouched.
Fixes https://github.com/tphakala/birdnet-go/discussions/3774
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHJ4o22cdcgdNtb81tBTPJ
awesomeversion (what HA's update entity uses since core's is-newer
check) parses "0.8.2-1" as semver with pre-release "1", and pre-releases
sort BELOW the base version: AwesomeVersion("0.8.2-1") >
AwesomeVersion("0.8.2") is False. Users stuck on the broken 0.8.2 nginx
release therefore see 0.8.2-1 as "Up-to-date" with a disabled Update
button and get no update notification. Four-segment 0.8.2.1 compares
strictly greater than both 0.8.2 and 0.8.2-1, and less than the next
upstream 0.8.3, so the fix becomes installable for everyone.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016acGazhHvyCNUFt71xzFxm
Per Copilot review feedback on #2807: add a build-time assertion for `psql`
so a future base-image change that drops postgresql-client is caught at
`docker build` time with a clear error, instead of surfacing as a cryptic
runtime failure in 99-run.sh. Also drop the hard-coded "14 through 18"
client version range from the comment, since that's specific to the
current base image and could go stale.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcbbgB7A5LLbPuPRjLUouk
The imagegenius v3 base image moved to a newer Ubuntu release where the
apt-key binary no longer exists, breaking the Dockerfiles' manual
PGDG-repo install of postgresql-client-15 (`wget ... | apt-key add -`).
That install was already redundant: imagegenius's own Dockerfile installs
postgresql-client-14 through 18 itself (via the modern signed-by keyring
method), so the psql CLI used by 99-run.sh is already present in the base
image. Remove the downstream install entirely rather than patching it to
use a keyring, since it duplicated work the base image already does.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcbbgB7A5LLbPuPRjLUouk
- Fix check_vchord_extension (and check_vector_extension) to query
pg_available_extensions against the actual immich database instead of
pg_extension on the default connection database. Immich creates the vchord
extension itself on first startup, so checking pg_extension before Immich
ever runs produced a false warning on every fresh install; checking
pg_available_extensions reports whether the server CAN provide the
extension, which is what the startup diagnostic actually needs.
- Drop the vestigial `services: - mysql:want` Supervisor service-discovery
hint from the four Immich config.yaml files: nothing in the add-on reads
it, and the scripts are hard-coded to PostgreSQL via psql — Immich has
never supported MySQL. Also fix the matching misleading line in the base
README.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcbbgB7A5LLbPuPRjLUouk
imagegenius/docker-immich stopped publishing GitHub releases (its newest release
is a "2026.0.0" announcement to that effect) and ships v3 only to GHCR, so
lastversion was stuck returning 2.7.5 and the add-ons never updated past v2.
Point the four Immich updater.json files at the real product repo
immich-app/immich, which publishes clean stable vX.Y.Z releases (currently
v3.0.1). The build.json images stay on the imagegenius :3 rolling tag, which
serves the newest 3.x build, keeping the tracked version and the pulled image
coherent. Also clear the now-obsolete github_exclude "2026" guard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcbbgB7A5LLbPuPRjLUouk
Upstream 0.8.2 added http-level limit_req_zone directives to its
nginx.conf. The ingress config was a wholesale copy of that file, and
both land in the same http context via servers/*.conf — nginx refuses
to declare a named shared-memory zone twice and dies at startup with
'limit_req_zone "api_rl" already bound' (502 on every page). Extract
everything from the column-0 "server {" onward instead, so maps and
zones stay declared once; zone/variable references resolve across
included files regardless of include order. Also comment out the new
Content-Security-Policy header in the ingress copy, matching the
existing X-* handling.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016acGazhHvyCNUFt71xzFxm
- Pin build.json to the imagegenius v3 image line (:3, :3-cuda, :3-noml, :3-openvino)
- Bump config.yaml version to 3.0.1 and record upstream_version 3.0.1 in updater.json
- Add a non-fatal VectorChord (vchord) startup check in the shared 99-run.sh so users
on a non-VectorChord database get a clear diagnostic (v3 drops pgvecto.rs)
- Document the Immich v3 database (VectorChord) and CPU requirements in each README and
point users at the Postgres 15 / Postgres 17 add-ons
- CHANGELOG entries for all four add-ons
The Postgres 15 / Postgres 17 add-ons already ship the official immich VectorChord image
(vectorchord0.4.3, matching Immich v3's pinned database) and are intentionally left
unchanged to preserve the pgvecto.rs to VectorChord migration path.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PcbbgB7A5LLbPuPRjLUouk
- Grant NET_ADMIN capability and /dev/net/tun device so the ZEROTIER option
works at runtime (Codex review)
- Use a JSON boolean for updater.json "paused" to match the documented format
(CodeRabbit review)
- Document the ZeroTier requirements in README and CHANGELOG
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PXZfzWxhkWHq8i8P7fnDvL
Implements the Zoraxy general-purpose reverse proxy (issue #1946) as a new
add-on following the repository conventions:
- Based on the upstream zoraxydocker/zoraxy image (Alpine)
- Web management UI exposed on port 8000 (webui link); reverse proxy on 80/443
- Persistent config/db/logs/plugins relocated to /config (addon_config) so they
survive add-on updates, by patching the upstream entrypoint working directory
- Options NOAUTH/ZEROTIER/FASTGEOIP/MDNS mapped to upstream env vars via the
shared 00-global_var module, plus env_vars passthrough for advanced settings
- Standard 6-section Dockerfile, supervised services.d launcher, healthcheck
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PXZfzWxhkWHq8i8P7fnDvL
Both variants share the same image; aligning the version ensures the
Supervisor pulls the updated build that suppresses the misleading
NET_RAW/NET_ADMIN alert for Full Access users.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WfZ5JKAR2NHP1KjoAGyBBD
Under the Home Assistant Supervisor the required NET_RAW/NET_ADMIN
capabilities are granted, but NetAlertX's upstream capabilities-audit
script cannot read them and prints a "🚨 ALERT: capabilities are missing"
banner. Users repeatedly mistook this informational message for the cause
of unrelated issues. Neutralise the audit script at build time (kept in
place as a no-op for the entrypoint runner) and bump version/changelog.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WfZ5JKAR2NHP1KjoAGyBBD
The folded block scalar was ~532 chars, exceeding the CodeRabbit v2
schema constraint and causing the config to be rejected. Trimmed to
238 chars; detailed context already lives in path_instructions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195h5b5zBHAA6urgJtp4aJP
Configure CodeRabbit (.coderabbit.yaml) tailored to this Home Assistant
add-on repository:
- tone_instructions establishing the HA add-on context for both issue
help and PR reviews
- chat.auto_reply + knowledge_base (issues/PRs/learnings) to support
issue triage and first-line help
- path_instructions encoding the add-on conventions (config.yaml,
Dockerfile, S6 cont-init/services scripts, updater.json, CHANGELOG,
workflows) from CLAUDE.md
- labeling/path filters aligned with the repo's existing labels and
generated artifacts
- review tools matching CI: shellcheck, hadolint, markdownlint,
yamllint, actionlint, gitleaks, checkov
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195h5b5zBHAA6urgJtp4aJP
- netbird-server: new profile `netbird-server_addon` (includes capability sys_chroot)
- netalertx_fa: symlink apparmor.txt to base netalertx profile, matching the
repo's existing _fa convention (e.g. scrutiny_fa -> scrutiny)
- signalk intentionally left without a profile (config sets apparmor: false)
No version bumps — profiles apply on each add-on's next update.
Co-Authored-By: Claude <noreply@anthropic.com>
- Add `capability sys_chroot` to all add-on AppArmor profiles (prophylactic
fix; required by any service that uses privilege-separation chroot, e.g.
sshd, Elasticsearch JVM, postgres)
- Fix AppArmor profile name collisions where add-ons had copy-pasted a wrong
profile name (inadyn_addon, db21ed7f_qbittorrent, radarr_addon,
db21ed7f_scrutiny, addon_db21ed7f_emby_nas, addon_updater, chromium_addon,
fireflyiii_addon, webtop_addon, joplin, gitea_addon) causing AppArmor to
silently apply the wrong profile
No version bumps — profiles apply on next add-on update.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7P3Nbem7n9FqGTXrLMadP
Gitea's install wizard uses an atomic SaveTo that replaces the symlink
at /data/gitea/conf/app.ini with a real file containing the completed
install config. On the next restart /config/app.ini (the pre-wizard
template) already exists, so the previous guard skipped the copy and
the rm deleted the real installed config, wiping DB/security settings.
Always copy the real file over /config/app.ini regardless of whether
the target already exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D46Ef3nZZdbVuwUpPhCd4T
Symlink /data/gitea/conf/app.ini -> /config/app.ini so users can read
and edit the full Gitea configuration via the HA file editor without
needing shell access. Existing installs migrate their app.ini on first
restart. Closes#1907.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D46Ef3nZZdbVuwUpPhCd4T
Both add-ons failed because their AppArmor profiles did not list
`capability sys_chroot`, which AppArmor then denied even though it is
part of Docker's default capability set:
- gitea: sshd privilege-separation chroot("/var/empty") failed with
"Operation not permitted [preauth]", breaking git-over-SSH (#2653)
- elasticsearch: upstream startup chroot failed with
"chroot: cannot change root directory" (#2709)
Also rename the elasticsearch AppArmor profile from the copy-pasted
`inadyn_addon` (shared with several other add-ons) to
`elasticsearch_addon` to avoid profile-name collisions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7P3Nbem7n9FqGTXrLMadP
Upstream paperless-ngx switched to an s6-overlay v3 init system at v2.15.0
(ENTRYPOINT ["/init"]) and removed the legacy /sbin/docker-entrypoint.sh that
this add-on patched. The add-on had therefore been broken since the 2.15.x bump.
- Inject initialization via S6_STAGE2_HOOK=/ha_entrypoint.sh instead of patching
the now-removed upstream entrypoint
- Export runtime variables to the s6 container_environment so the upstream
supervised services (svc-webserver, svc-worker, svc-scheduler, svc-consumer)
pick them up
- Use the canonical ha_entrypoint.sh template (remove the outdated bundled copy)
- Add 00-global_var module + jq for env_vars passthrough
- Guard the ImageMagick policy patch and the optional nginx/redis startup
- Bump version and updater tracking to 2.20.15
tr reads from the infinite /dev/urandom stream; head exits after N bytes,
closing the pipe, which sends SIGPIPE to tr (exit 141). With set -euo pipefail
at the top of 99-run.sh, pipefail surfaces that as the script exit code and
the container never starts. Suppress it with || true on both occurrences in
the MinIO credential generation block.
https://claude.ai/code/session_01MaLKhb2CJiF9Fb3Dyr585r
- Rename AppArmor profile from the leftover qbittorrent name to ente_addon
to avoid colliding with the qbittorrent add-on's profile
- Map the Accounts (3001), Auth (3003) and Cast (3004) ports so the login,
2FA and cast web apps served by nginx are actually reachable
- Default the external Postgres port to 5432 when DB_PORT is left blank
- Write the resolved DB host/port to museum.yaml so external databases are
configured correctly on disk, not just via env overrides
- Exclude minio-data and postgres from Home Assistant backups to avoid
pulling the whole photo library and database into every backup
https://claude.ai/code/session_01MaLKhb2CJiF9Fb3Dyr585r
1. Generate random MinIO credentials on first run, persist to /config/minio-creds,
reuse on restart. Export MINIO_ROOT_USER/PASSWORD env vars for MinIO server.
2. Make nginx web startup idempotent by checking if web.bak exists before moving.
3. Bind MinIO console to 127.0.0.1:9001 with --console-address.
4. Expose port 3002 (albums) in config.yaml and derive ENTE_ALBUMS_ORIGIN from
the API endpoint host with the mapped external port 8302.
Add a dedicated nginx health endpoint on 127.0.0.1:3001 with access_log
off that returns 200 at /health. Update HEALTHCHECK to verify both that
the filebrowser process is running (pgrep) and nginx is serving (curl to
health endpoint), avoiding direct HTTP requests to filebrowser that caused
log spam every 5 seconds.
Adds clear step-by-step instructions in the Mounting Drives section
of all Immich addon READMEs explaining how to use a mounted local
disk for Immich storage by combining localdisks and data_location.
Removing /config/config.yaml after a failed first-boot curl left the
next yq read (.realtime.audio.export.path) trying to open a missing
file; under set -e that aborts the entire cont-init script, so the
addon would never get to seed its defaults or start BirdNET-Go.
Seed an empty YAML document ({}) instead. The existing "//=" defaults
block then populates output.sqlite.path, logging.file_output.*, and
the migration block writes realtime.audio.export.path. Result: an
offline first boot now produces a valid minimal config.yaml and the
container starts cleanly.
Also harden the yq read with "// """ so a freshly seeded "{}" doc
returns an empty string (caught by the existing :-DEFAULT fallback)
rather than the literal string "null".
Replace mqtt_disable / mariadb_disable (opt-out, default-on) with
mqtt_auto_config / mariadb_auto_config (opt-in, default-off). When the
HA addon is detected but the option is off, still log the broker /
database credentials and a hint pointing the user at the option — so
discoverability stays the same without surprise config rewrites.
Bugs fixed in 01-structure.sh:
- Database backup created during BIRDSONGS_FOLDER migration was written
to the script's CWD instead of /config, and the restore path was
recomputed with a fresh timestamp — so any second-boundary crossing
between backup and restore left the user unable to recover. Backup
path is now absolute and reused for restore.
- Path inputs are validated against [A-Za-z0-9._/-]+ before being
interpolated into the SQL UPDATE statement.
- Default-config download tolerates network failure instead of leaving
an empty config.yaml behind.
- output.sqlite.path and logging.file_output.* are now seeded with the
"set-if-missing" idiom (`//=`) so user edits to config.yaml survive
restarts. (Breaking: addon options for log rotation now only seed
defaults on first run.)
- Path normalization centralized; trailing-slash juggling removed.
UX upgrades:
- 33-mqtt.sh now auto-configures realtime.mqtt.* in config.yaml from
the HA Mosquitto addon (with new mqtt_disable opt-out option).
- 33-mariadb.sh now auto-switches output.mysql.* to the HA MariaDB
addon and disables SQLite (with mariadb_disable opt-out option).
Cleanup:
- Dockerfile: upstream entrypoint sed-patch now warns (not silently
succeeds) when the target pattern is missing in a new nightly.
- Removed dead nginx upstream.conf pointing at unused port 8096.
- Trimmed redundant nginx HTML-attribute sub_filters; upstream
birdnet-go handles those itself via X-Ingress-Path. JS string
rewrites kept since the upstream HTML rewriter does not touch JS.
(Breaking UI-side if upstream regresses — see CHANGELOG.)
- Change cronupdate shebang from bashio to /bin/bash (cron PATH lacks bashio)
- Remove bashio API calls from cron script (no Supervisor access in cron)
- Source /.env in cron script to load all env_vars from 00-global_var.sh
- Persist SILENT_MODE to /etc/environment for cron access
- Remove destructive `sed 's|root|www-data|g'` on /etc/crontab
- Fix /etc/environment permissions from 600 to 644 for cron readability
/etc/asound.conf is read-only in the addon environment, so both the
shipped overrides and the user-supplied override are now written to
/root/.asoundrc (the app runs as root with HOME=/root). ALSA loads
~/.asoundrc as an additive layer on top of the system config, so the
override behavior is unchanged.
Add addon options to control birdnet-go log file rotation:
- LOG_MAX_SIZE_MB (default: 50): maximum size per log file before rotation
- LOG_MAX_AGE_DAYS (default: 7): maximum days to retain old log files
On startup, the addon:
1. Configures birdnet-go's logging.file_output settings in config.yaml
2. Sets max_rotated_files to 3 and enables compression
3. Trims existing log files exceeding the configured age
Fixes#1922
Advanced users who legitimately need JACK, a custom dsnoop chain, or any
other ALSA setup can drop their own asound.conf into the addon config
folder. The cont-init script copies it over /etc/asound.conf before
launching the app, replacing the addon-shipped defaults.
- Patch upstream entrypoint via sed so chmod on the read-only /dev/snd
mount no longer prints "Read-only file system" lines.
- Add /etc/asound.conf overriding the JACK, OSS, dsp, and dsnoop PCM
plugins to type "null" with hint.show off. This hides them from
snd_device_name_hint(), so miniaudio's device enumeration no longer
probes them at launch and the corresponding libjack/pcm_oss/pcm_dsnoop
errors disappear.
Two build-time bugs prevented the immich image from being built:
1. The find . chmod command ran from WORKDIR=/ and descended into
/app/immich/server/node_modules/, hitting files it could not chmod
(exit code 1 at build step 5). Fixed by scoping find to only
/etc /usr/local/bin /usr/local/lib /usr/local/share — the actual
directories populated by COPY rootfs/ /.
2. sed -i tried to patch /etc/s6-overlay/s6-rc.d/init-test-run/run
which no longer exists in the imagegenius base image (removed in
an earlier upstream update). Fixed with a [ -f ... ] guard so the
sed is silently skipped when the file is absent.
Reproduced both bugs locally with docker build, verified fix on a
bare-metal VPS — all 17 build steps complete cleanly.
Fixes#2718
When image: is set in config.yaml, HA pulls that image directly and
never runs the Dockerfile, so the rootfs overlay (including the
passthrough entrypoint) was never applied. Removing image: forces HA
to build from the Dockerfile, which COPYs rootfs/ and applies our
run script and entrypoint override.
Also switch run script from symlink approach to AURRAL_DATA_DIR env
var, which avoids the race condition where docker-entrypoint.sh runs
before s6 and tries to chown a broken symlink target.
/data is HA's built-in private persistent storage for every addon - no
user configuration needed. Only download_folder needs to be user-facing
since that's where the music lives and users need to know the path.
The upstream docker-entrypoint.sh chowns /app/backend/data which fails
when it's a symlink to a host-mounted HA path. Instead, use the env vars
that Aurral natively supports to redirect paths:
- AURRAL_DATA_DIR -> data_folder config option
- DOWNLOAD_FOLDER -> download_folder config option
- WEEKLY_FLOW_FOLDER -> download_folder/weekly-flow
This lets the entrypoint chown the real (container-internal) /app/backend/data
unmolested, while node writes persistent data directly to the HA share paths.
Previously image: pointed directly at the upstream ghcr.io/lklynet/aurral,
meaning the Dockerfile was never built and the rootfs overlay (including the
entrypoint fix) was never applied. Changed to ghcr.io/alexbelgium/aurral-{arch}
which is where the CI build pushes the image built FROM the upstream via build.json.
docker-entrypoint.sh runs chown -R on /app/backend/data which fails when
that path is a symlink to a host-mounted HA volume. Replace it with a
passthrough script that just exec's its arguments, letting the s6 run
script handle all setup.
The upstream docker-entrypoint.sh runs chown -R on /app/backend/data before
the s6 run script can replace it with a symlink. When the symlink target is a
host-mounted HA path (/share, /data, etc.), the chown fails with
"Operation not permitted".
Overriding ENTRYPOINT with /init hands control directly to s6-overlay, which
then runs the run script that creates the symlinks before node starts.
- config.yaml: strip back to download_folder, data_folder, port only
- README.md: match alexbelgium style, merge upstream link into About,
remove badge buttons, remove Navidrome references
- config.yaml: fix url to point to master, add ingress support,
remove download_folder/data_folder from options (set via UI),
match lidarr schema style with env_vars passthrough
- updater.json: add with upstream v1.76.12 tracking lklynet/aurral
- run script: use proper ingress port env var, cleaner startup
- README.md: fix install instructions to reference master branch
Replace the legacy Werkzeug dev server (python -m core.api) with a single
gunicorn GeventWebSocketWorker, matching upstream BirdNET-PiPy 0.7.0's
production-server migration (the add-on already builds 0.7.0 source).
Single worker is mandatory: live detections fan out via an in-process
Socket.IO emit (no Redis message_queue), so >1 worker would silently drop
Live Feed broadcasts. Heavy maintenance jobs cooperatively yield to keep the
worker responsive. Bound to 127.0.0.1:5002 for single-container use. Also
fixes the now-stale 'Python core.api' comment in nginx/run.
Add-on packaging change only -> 0.7.0 -> 0.7.0-1 (suffix convention; base
tracks upstream via the updater bot).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two independent failure modes can cause the restart loop on arm64:
1. /dev/stdout may be inaccessible in some ARM container runtimes; replaced
with /proc/1/fd/1 which LSIO images already use for direct container stdout.
2. s6-notifyoncheck writes to fd 3 on check success, but s6-rc only opens
that fd when notification-fd exists in the service directory. LSIO arm64
images ship svc-qbittorrent without it, so s6-notifyoncheck exits with
EBADF and s6 restarts the service in a loop. Guard with a file check and
fall back to exec'ing qbittorrent-nox directly when the file is absent.
https://claude.ai/code/session_01F16ThtZyfXj6ZKFPkrSAAq
/dev/stdout resolves via /proc/self/fd/1 and can be inaccessible in some
ARM container runtimes, causing the exec redirect to fail and s6 to restart
the service in a loop. /proc/1/fd/1 is the path LSIO images already use
for direct container stdout (see nginx silent-mode handling) and is reliable
across architectures.
https://claude.ai/code/session_01F16ThtZyfXj6ZKFPkrSAAq
s6-rc opens fd 3 for a longrun service only when a notification-fd file is
present in the service directory. The LSIO aarch64 image ships svc-qbittorrent
without that file, so fd 3 is never opened. s6-notifyoncheck exits with EBADF
after its readiness check passes, s6 treats the supervised process as dead and
immediately restarts it — producing the infinite "Starting qBittorrent..." loop.
Check for the notification-fd file at runtime: use the full s6-notifyoncheck
path when it is present (amd64, preserving existing behaviour), and fall back
to exec'ing qbittorrent-nox directly when it is absent (aarch64).
https://claude.ai/code/session_01F16ThtZyfXj6ZKFPkrSAAq
s6-notifyoncheck writes to fd 3 when its readiness check passes, but
the LSIO aarch64 image's svc-qbittorrent service has no notification-fd
file so s6-rc never opens fd 3. s6-notifyoncheck exits with EBADF, s6
sees the supervised process die and immediately restarts it, producing
the infinite "Starting qBittorrent..." loop seen on odroid-c2 and other
aarch64 boards.
Drop s6-notifyoncheck entirely and exec qbittorrent-nox directly under
s6-setuidgid so s6 supervises the real process. Silent mode is handled
by redirecting the shell's fds before exec rather than passing a
/dev/stdout path (avoids a separate class of ARM container fd issues).
https://claude.ai/code/session_01F16ThtZyfXj6ZKFPkrSAAq
Seafile's check_init_admin.py looks for SEAFILE_ADMIN_EMAIL/PASSWORD
in the env, then falls back to conf/admin.txt, and only prompts
interactively if neither is available. The upstream init.sh writes
admin.txt, but it is skipped when conf/ccnet.conf or conf/revision
already exist (e.g. after a partial previous install) and the env
vars do not always reach the seahub subprocess via su. Write
admin.txt directly and inject the values into seafile.env so admin
creation succeeds (#2685).
https://claude.ai/code/session_01EwuoFH7aHJMySr9J775XQP
s6-notifyoncheck exits with EBADF when notification-fd 3 isn't opened by
s6-rc (can happen depending on LSIO image layer order), killing the supervised
qBittorrent process and causing the 2-second restart loop. Dropping it lets
s6 supervise qBittorrent directly without the fragile fd notification path.
Also probe /app, /usr/bin, and /usr/local/bin for the binary so the addon
works across LSIO image builds that place qbittorrent-nox in different spots.
https://claude.ai/code/session_015eiGSjWjSVtKbBFhBHUeDt
On HAOS >=17.3 the Supervisor Docker network gained IPv6, so
core-mariadb resolves to an IPv6 address first. The official MariaDB
addon only grants its service user from the IPv4 supervisor subnet, so
connections from IPv6 fail with "Access denied".
Resolve the hostname to its IPv4 address before connecting in every
addon that consumes bashio::services 'mysql' 'host': photoprism,
monica, fireflyiii, seafile, zoneminder. Fall back to the raw hostname
if resolution fails so IPv4-only setups keep working unchanged.
Replaces the 0.6.6-3 sleep+ingress-file-loop in services.d/nginx/run
with bashio::net.wait_for on 127.0.0.1:5002 (core.api). Under
s6-overlay all services.d/* services start concurrently, so nginx
could accept requests before the API had bound its port — proxy paths
(/api/, /socket.io/, /internal/auth) would 502, and that 502 could be
cached by an upstream service worker / edge cache (e.g. Cloudflare-
fronted HA), leaving the UI blank.
Matches the sister-addon pattern (bazarr, jellyfin, radarr). Also
switches to `exec nginx` for proper s6 supervision of the nginx PID.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bump birdnet-pipy to 0.6.6 (upstream tags v0.6.5 + v0.6.6; skipping
0.6.5 same as the updater bot would).
Minor CHANGELOG.md cleanup while here: normalize 10 entries from
DD-MM-YYYY to YYYY-MM-DD, and remove a stale pre-ingress block (0.2,
0.6.1-0.6.6 dated Jan 2026) that was colliding with real version
numbers further up the file.
When DB_CONNECTION is set to mariadb_addon, the script now checks if the user
has explicitly configured DB_USERNAME, DB_PASSWORD, or DB_DATABASE in addon
options. If set, those values are used instead of the MariaDB addon service
discovery credentials. This fixes authentication failures when the service
account doesn't have proper access.
Fixes: Firefly III access denied for user 'service' issue
Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/7cacda5b-d03e-47c5-b4fc-4cfb4ef2a3dc
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Adds `homeassistant_api: true` so the addon can call HA Core's
`update.install` service. Required for in-app self-update —
Supervisor blocks `/store/addons/<self>/update`, so the backend
routes through Core.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The app derives its timezone from station lat/lng via timezonefinder
(Settings → Location in the Web UI), so a separate addon-level TZ only
ever created mismatch with the UI-derived zone. All app-facing timestamps
(dashboard, API, DB) and Python service stdout (api/main/birdnet) already
honor the UI zone via logging_config.py's formatter, and the frontend log
viewer re-converts Icecast timestamps on read.
Net effect in the HA addon log pane: Python services still show the
correct local time; only Icecast's raw stdout now prints in UTC (accepted
trade for a single source of truth). Deletes
rootfs/etc/cont-init.d/02-timezone.sh added in 0.5.6-2.
Also cleans up the options YAML in DOCS.md/README.md: drops
RECORDING_MODE and RTSP_URL (never wired — app reads them from
user_settings.json), drops http_stream from the modes list, and moves
STREAM_BITRATE under an env_vars: example since it's honored by
start-icecast.sh but not a schema option.
Bumped to 0.6.3-2 (addon-only, no upstream app change).
Upstream 0.6.3 consolidates deployment-path handling into a single
<base href> declaration in index.html with Vite base: './' and
relative paths for all internal URLs. The previous seven sub_filter
rules (href/src/'/api'/'/socket.io') are no longer needed — one
<base href> replacement is sufficient.
Also removes the incidental brittleness from byte-level sub_filter
matches in minified JS bundles (the '/stream/' rule inadvertently
double-prefixed the literal 'api.get("/stream/config")' string).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove the nginx rewrite directive that could cause URL normalization/re-encoding
issues with special characters in query strings (like spaces encoded as +).
HA Supervisor strips the ingress prefix before forwarding, making the rewrite
unnecessary. Without it, proxy_pass uses the raw $request_uri which preserves
URL encoding.
Also fix Connection header from hardcoded "upgrade" to $connection_upgrade
map variable for proper WebSocket vs regular HTTP request handling.
Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/3982b002-dfcb-4eb5-98c2-913f665b6a07
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Two fixes for the birdnet-pipy addon:
1. Icecast log permission error: 01-structure.sh creates /app/data/logs
as root, but start-icecast.sh runs via gosu icecast2. The first log
write fails with "Permission denied", crashing icecast in a restart
loop (502 Bad Gateway on the Live Feed page). Fix: chown the log dir
and file to icecast2 before dropping privileges.
2. Live Feed double-prefixed request in ingress mode: the "/stream/"
sub_filter rule also matches 'api.get("/stream/config")' in the JS
bundle, producing a request like
/hassio_ingress/TOKEN/api/hassio_ingress/TOKEN/stream/config (404).
The upstream frontend (BirdNET-PiPy >= 0.6.2) now strips the leading
slash from stream URLs so they resolve via <base href> — the
sub_filter rule is no longer needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The calibre-web addon relies on calibredb to retrieve book metadata for
downloads. Previously, calibre was only installed at runtime via
DOCKER_MODS (linuxserver/mods:universal-calibre), which could fail due
to network issues or changes in the init sequence.
Installing calibre at build time ensures calibredb is always available
in the container, fixing the 500 Internal Server Error when downloading
books.
Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/6f6e6795-4a2c-4c6a-88b2-931def081d20
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The upstream Maintainerr image declares /opt/data as a Docker VOLUME.
Attempting to rm -rf /opt/data fails with "Resource busy" because mount
points cannot be removed. Instead, we now:
1. Copy seed data from /opt/data to /config (persistent storage)
2. Clear contents inside /opt/data (rm -rf /opt/data/*)
3. Symlink each item in /config back into /opt/data
This ensures the VOLUME directory stays intact while all data is
redirected to persistent storage.
Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/82a46feb-2e9c-4c40-b193-614167e6d5c3
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Added transmissionic webUI, moved transmission-web-control to the end - is removed in the current version, but there are discussions ongoing so not removing it for the moment
- Add General display options (Interval, ShowClock, etc.) to addon config schema
- Add per-Account filter options (Albums, People, ShowFavorites, etc.) to Accounts schema
- Rewrite 99-run.sh to generate complete Settings.yaml with General and Accounts sections
- env_vars are automatically classified as General or Account-level settings
- Schema options take precedence over env_vars
- Full backward compatibility: existing env_var configs continue to work
- Update README with comprehensive options documentation
- Bump version to 1.0.32.0-4
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The upstream haugene/transmission-openvpn v5.4.0 image uses systemd-resolved
via D-Bus in its update-resolv-conf script, which fails in HA containers
that lack systemd/D-Bus with 'sd_bus_open_system: No such file or directory'.
This adds a custom update-resolv-conf script that directly modifies
/etc/resolv.conf by parsing OpenVPN's foreign_option_* environment variables.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Add Accounts list schema to config.yaml for multi-account support
- Make ApiKey and ImmichServerUrl optional when using Accounts list
- Generate Settings.yaml from addon options in 99-run.sh
- Fix /app/Config symlink direction for proper config persistence
- Set IMMICHFRAME_CONFIG_PATH for reliable config discovery
- Update README with multi-account documentation and examples
- Bump version to 1.0.32.0-2
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- New init script 02-timezone.sh: reads TZ from addon config, validates
against /usr/share/zoneinfo, applies to container (/etc/localtime,
/etc/timezone, s6 container env)
- Change default TZ from Etc/UTC to Europe/Paris
- Increment version to 0.5.6-2
- Update CHANGELOG.md and DOCS.md
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The probe script requires bashio::addon.version to return non-empty output,
but the Supervisor API may not be ready during container init. This causes
all shebang candidates to be rejected even though the interpreter works fine.
Fix: output a 'PROBE_OK' marker when the script executes successfully but
the version is empty. Also check /.bashio-standalone.sh as fallback path
(some containers store it there instead of /usr/local/lib/).
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
When the environment is too large for exec (E2BIG), scripts fail with
'env: can't execute bashio: Argument list too long'. This adds a fallback
that sources the script in a subshell with bashio preloaded, avoiding exec
entirely. Applied to both init scripts and service runners.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The script failed with 'find: /homeassistant/addons_config: No such file or directory'
because it accessed the directory without checking if it exists. Since the script uses
set -e, the failing find command caused the entire init script to exit.
This follows the same pattern already used in the filebrowser addon's 20-folders.sh.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Use DATA_DIR=/config (config:rw map) per maintainer request
- Scope chmod to /entrypoint.sh and cont-init.d instead of whole FS
- Gate chown -R behind .initialized marker to avoid slow restarts
- Bump version to 0.133.1 (latest upstream manyfold-solo release)
- Remove image: field from config.yaml so HA builds via Dockerfile
- Pin Dockerfile and build.yaml to 0.133.1 instead of :latest
- Add Secret Key Base section to README covering all install scenarios
- Add Migration section to README with steps to preserve data when
switching addon slug or reinstalling
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add hassio_api and hassio_role: manager to config.yaml so the addon
can call /addons/self/restart via the Supervisor API
- Resolve branch to commit SHA before downloading source for build
traceability (displayed in the app's Settings page)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The upstream Gramps Web project deprecated EMAIL_USE_TLS in favor of
EMAIL_USE_SSL (for port 465) and EMAIL_USE_STARTTLS (for port 587).
This updates the addon config schema and documentation accordingly.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Dynamically detect render device GID using stat instead of hardcoding 104
- chmod 666 render devices to ensure accessibility for non-root PUID/PGID
- Only run render setup when /dev/dri exists
- Use GID-specific group naming to avoid conflicts
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The addons_updater script's global sed replacement corrupted Dockerfiles
when the upstream_version was empty (""), replacing all empty double-quoted
strings with version strings. This corrupted:
- HEALTH_URL values (causing malformed health check URLs and container
instability from failed health checks)
- ASCII art comments in Dockerfile headers
Fixed affected addons: guacamole, tdarr, photoprism, enedisgateway2mqtt_dev,
gazpar2mqtt, seafile
Also added a guard in the updater script to skip updates when version
strings are empty, preventing this corruption from recurring.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
On aarch64, native Node.js modules (sharp, @next/swc, etc.) may have
been incorrectly cross-compiled via Docker BuildKit QEMU emulation.
Add an npm rebuild step that runs at startup on aarch64 to re-download
the correct prebuilt native binaries for the actual hardware.
Fixes #XXXX
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Add ingress: true, ingress_port: 0, and ingress_stream: true to
config.yaml. Update ingress_params.conf with sub_filter rules for
Vue.js SPA: rewrite API paths, stream paths, Socket.IO paths, and
inject base href for Vue Router history mode.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Replace `usermod -o -u 0 node` and `groupmod -o -g 0 node` with direct
sed modifications to /etc/passwd and /etc/group. The usermod/groupmod
commands can hang indefinitely in container environments due to lock
file contention, NSS cache daemon (nscd) interactions, or PAM module
issues. The sed approach achieves the same result without these risks.
Fixes #XXXX
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The sudoers entry for the wger user was written to /etc/sudoers before
the sudo package was installed. When apt-get installs sudo, its default
/etc/sudoers conffile may overwrite the entry, causing sudo to fail at
runtime. This prevented ha_entrypoint.sh from running as root, so
/data/media was never created with correct permissions, resulting in
PermissionError when downloading exercise images.
Fix: re-add the sudoers entry after the sudo package is installed.
Also improve symlink handling in 90-run.sh to avoid self-referencing
copies on subsequent container starts.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- ha_entrypoint.sh: probe_script_content now tries regular bashio first,
falls back to bashio-standalone.sh if Supervisor API unreachable
- 00-banner.sh: source bashio-standalone before calling bashio functions
in standalone branch (prevents undefined function errors with set -e)
- 01-custom_script.sh: same probe fix + add bashio-standalone.sh to
fallback source chain
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Sonarr v4 configures FFMpegCore to look for ffprobe exclusively in its own
binary directory (/app/sonarr/bin/) via AppDomain.CurrentDomain.BaseDirectory.
The addon already installs ffmpeg via apt (providing /usr/bin/ffprobe), but
Sonarr never looks there. This init script creates a symlink so Sonarr can
find the system-installed ffprobe.
Fixes#2451
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Source /etc/environment in cronupdate to load addon env vars (FIREFLY_III_URL, etc.)
- Persist cron-needed vars (JSON_CONFIGURATION_DIR, IMPORT_DIR_WHITELIST, etc.) to /etc/environment
- Fix inverted nginx map values that caused health check logs to spam while suppressing real requests
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Add the "Add repository to my Home Assistant" blue button to all
addon README files that were missing it. This makes it easier for
new HA users to add the repository with a single click.
Updated 59 addon READMEs:
- 51 with standard Installation section format
- 8 with non-standard or missing Installation sections
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Use ${PULSE_SERVER:-unix:/run/pulse/native} in icecast/run and main/run
to respect the PULSE_SERVER env var set by HA supervisor
- Create /run/pulse/native symlink when PulseAudio socket is elsewhere
- Copy PulseAudio cookie for icecast2 user authentication
- Add icecast2 to audio group
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
The upstream Docker image's write_config.sh hardcodes
FILE_SERVER_ROOT = "http://<SERVER_IP>/seafhttp" in seahub_settings.py,
overwriting the addon's configured value on first run. This causes
download URLs to contain an incorrect /seafhttp prefix and miss the
file server port.
Fix by creating a helper script (apply_addon_urls.sh) that re-applies
the addon's FILE_SERVER_ROOT and SERVICE_URL right before Seafile
services start, after all upstream init/setup/update scripts complete.
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
1. Mountpoint name collisions: check if /mnt/$diskname already exists
before mounting and skip with warning if it does
2. test_mount() readonly false positive: verify mountpoint is actually
mounted before reporting readonly status
3. Independent retries: save original MOUNTOPTIONS and use as base for
each noserverino/noperm retry independently
4. Hostname support: accept hostnames (not just IPv4) in CIFS/NFS path
validation, FSTYPE detection, and server extraction
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Add SMB 1.0 to version ladder in retry_cifs_with_vers_ladder_on_dialect_failure
- Add sec=ntlm to security variants for SMB1 compatibility
- Fix SMBVERS_FORCE override to actually force when SMBv1 detected
- Fix smbclient SMBv1 detection to use credentials instead of anonymous
- Add SMBv1 pattern detection to nmap smb-protocols parsing
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
- Set ingress: false and add webui URL in config.yaml
- Remove nginx from Dockerfile PACKAGES
- Remove nginx ingress init script, nginx config, and nginx service
Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>
Removed redundant retry function for CIFS mounting and improved error handling by simplifying options. Enhanced disk list parsing to handle commas and trailing characters more robustly.
both Wireguard and OpenVPN are now handled by single service file
This remove dependency to external tools
Simplify vpn routing by using dedicated routing table which is used by qbittorrent torrent client listenning directly on the vpn interface.
To prevent DNS leeks traffic to addon configured DNS servers is forced to use same dedicated routing table
The pi user account was locked when pi_password was not configured,
causing the web terminal login to fail immediately with "Connection
Closed". Now the pi user is given an empty password when no password
is specified, enabling passwordless web terminal login.
Fixes#2393
Based on feedback from PR #2319 code review: critical network operations
need explicit error handling and validation.
Added safeguards:
- curl -f flag: Fail on HTTP errors (429, 404, 500, etc)
- test -s check: Verify downloaded file is not empty
- tar extraction error check: Fail if tar extraction fails
- lib directory validation: Confirm bashio/lib exists after extraction
- Explicit error messages: Clear diagnostics if any step fails
This prevents silent failures where downloads could fail but build
continues with broken/missing bashio installation.
Prevents: Users pulling images with non-functional bashio
Impact: Build will fail explicitly with clear error messages if download/extraction fails
- Multi-architecture support restored (aarch64 builds)
- Error suppression removed for user diagnostics
- Circular dependency fix documented
- Config.yaml version tag corrected
CRITICAL FIXES:
1. Restore multi-architecture support - Use ARG BUILD_FROM/BUILD_ARCH instead of hardcoded amd64 base image
- Fixes: aarch64 builds were broken by hardcoded FROM ghcr.io/hassio-addons/base/amd64:11.1.0
- Now: FROM $BUILD_FROM allows alexbelgium build system to set correct base per architecture
2. Remove stderr suppression from agent command - Restore error visibility for debugging
- Fixes: Error messages were hidden by 2>/dev/null redirection
- Now: ./agent command output visible for user diagnostics
These changes ensure:
- Multi-arch builds work correctly (amd64, aarch64, armv7, armhf, i386)
- Users can debug configuration issues via visible error logs
- Circular dependency fix is fully compatible with existing build system
Adds changelog entry for alpine-sts version (30-12-2025) documenting:
- Fix for circular dependency that prevented Docker builds
- Restoration of official Portainer Agent image source
- Resolution of Issue #2318 (404 manifest unknown errors for users)
Adds missing .github/paths-filter.yml configuration file required by
PR check workflow. Registers all addon paths including portainer_agent
for automated build testing on pull requests.
This allows GitHub Actions to properly detect which addons have changed
and trigger appropriate validation checks.
Restores official Portainer Agent image source (ghcr.io/portainerci/agent:latest)
in COPY --from statements. Previous code review feedback inadvertently introduced
a circular dependency that prevents Docker builds.
This fixes Issue #2318 where users cannot update due to 404 manifest unknown error.
Closes#2318
- Use BUILD_FROM and BUILD_ARCH for multi-architecture support
* Replace hardcoded amd64 with BUILD_FROM in FROM statement
* Use BUILD_ARCH variable in COPY --from directives
* Enables building for both amd64 and aarch64 architectures
- Remove error suppression in run script for better debugging
* Change 'cd /app || true' to 'cd /app' (fail fast on errors)
* Remove '2> /dev/null' redirection from agent startup
* Allow error messages to reach container logs for troubleshooting
These changes ensure the fix works correctly across all supported architectures
and provides visibility into any runtime issues.
Fixes#2307
Changes:
- Update bashio from v0.17.5 → main branch (improved API error handling)
- Add robust protection mode check with Docker socket fallback
- Implement Level 1 (standard bashio) + Level 2 (socket check) fallback logic
- Update CHANGELOG.md with fix details
- Tested and verified working on Home Assistant OS with protection mode OFF
The fix addresses root cause: bashio v0.17.5 calls /addons/self endpoint
which returns 403 Forbidden. bashio's error handling incorrectly assumes
this means protection mode is ON. The fallback checks Docker socket directly
as a reliable indicator of actual protection mode state.
Updated the script to improve error handling and logging for SQLite and PostgreSQL migrations. Adjusted the way directories and files are created and linked, ensuring proper permissions and existence checks.
The security improvements have been successfully implemented with immediate risk reduction and frameworks in place for ongoing security enhancement. The repository now has a solid security foundation with documented processes for maintaining and improving security going forward.
**Critical Finding**: 57 out of 108 add-ons (53%) request SYS_ADMIN privileges - a system administration capability that grants near-root access within containers.
**Risk Assessment**: HIGH - The widespread use of SYS_ADMIN significantly increases the attack surface and potential for container escapes.
## 📊 Privilege Usage Statistics
- **Total Add-ons**: 108
- **Add-ons with Privileges**: 60 (55%)
- **SYS_ADMIN Usage**: 57 add-ons (53%)
- **NET_ADMIN Usage**: 9 add-ons (8%)
- **DAC_OVERRIDE Usage**: 0 add-ons (0%) ✅
## 🚨 Top 5 Critical Add-ons Analysis
### 1. Filebrowser (8,427 installations)
**Privileges**: `SYS_ADMIN`, `DAC_READ_SEARCH`
**Device Access**: Extensive - All storage devices (sda-sdg, nvme, partitions)
**Purpose**: Web-based file management interface
**Analysis**:
- ❌ **Over-privileged**: SYS_ADMIN likely not needed for file browsing
- ❌ **Excessive device access**: Requests access to ALL possible storage devices
- ⚠️ **Security risk**: File manager with admin privileges = potential data exfiltration
- 🔧 **Alternative**: Use bind mounts with specific directories instead of SYS_ADMIN
**Justification Score**: 2/10 - Very weak justification
### 2. Nextcloud (Cloud Storage)
**Privileges**: `SYS_ADMIN`, `DAC_READ_SEARCH`
**Device Access**: All storage and video devices
**Purpose**: Personal cloud storage and collaboration platform
**Analysis**:
- ⚠️ **Potentially justified**: May need filesystem operations for cloud storage
- ❌ **Excessive device access**: Duplicate device entries in config
- 🔧 **Alternative**: Use specific capabilities like `CHOWN`, `FOWNER` instead of SYS_ADMIN
- ⚠️ **Security concern**: Cloud platform with admin access to all devices
# Security Improvements for Home Assistant Add-ons Repository
This directory contains security improvements, analysis, and templates created to enhance the security posture of the Home Assistant add-ons repository.
## 📋 Documentation Files
### Security Analysis & Planning
- **`SECURITY_IMPROVEMENT_PLAN.md`** - Master security improvement plan with classified actions and priorities
- **`PRIVILEGE_ANALYSIS_REPORT.md`** - Detailed analysis of container privilege usage across all 108 add-ons
- **`IMPLEMENTATION_SUMMARY.md`** - Summary of completed security improvements and metrics
- **`SECURITY_REVIEW_CHECKLIST.md`** - Comprehensive security review checklist for contributors
### Implementation Guides
- **`config_reduction_examples.md`** - Practical examples for reducing container privileges
## 🛠️ Security Templates
### Secure Download & Script Management
- **`ha_secure_download.sh`** - Secure script downloader with integrity verification
- **`ha_autoapps_secure.sh`** - Secure version of the automatic app installer
### Input Validation Framework
- **`ha_input_validation.sh`** - Comprehensive input validation library for add-on configurations
- **`example_validated_init.sh`** - Example implementation showing how to use the validation library
## 🔍 Key Findings
### Critical Security Issues Addressed
1.**File Permission Vulnerabilities** - Fixed 20/21 instances of `chmod 777`
2.**Remote Script Execution** - Created secure alternatives with integrity verification
3.**Container Privilege Escalation** - Analyzed 57 add-ons using SYS_ADMIN (53% of repository)
### Security Improvements Achieved
- **95% reduction** in file permission vulnerabilities
*This checklist should be completed for every new add-on and major security-related changes to existing add-ons. Keep this document updated as security requirements evolve.*
# Max 250 chars. Detailed context lives in path_instructions below.
tone_instructions:"HA add-on repo with 120+ Docker add-ons for Home Assistant Supervisor. Be concise, practical and friendly; most contributors are hobbyists. Link to add-on READMEs and the repo wiki. Follow existing conventions over generic best practices."
early_access:false
enable_free_tier:true
reviews:
# "chill" keeps reviews helpful without nitpicking the many small upstream
# version-bump PRs that dominate this repo.
profile:"chill"
# Don't block merges; this repo merges frequently and relies on CI gating.
bashio::log.notice "This script is used to mount local USB/SATA/SD/NVMe drives. Instructions here : https://github.com/alexbelgium/hassio-addons/wiki/Mounting-Local-Drives-in-Addons"
bashio::log.notice "This script is used to mount local USB/SATA/SD/NVMe drives. Instructions here : https://github.com/alexbelgium/hassio-addons/wiki/Mounting-Local-Drives-in-Addons"
# Show support fs https://github.com/dianlight/hassio-addons/blob/2e903184254617ac2484fe7c03a6e33e6987151c/sambanas/rootfs/etc/s6-overlay/s6-rc.d/init-automount/run#L106
# Show support fs https://github.com/dianlight/hassio-addons/blob/2e903184254617ac2484fe7c03a6e33e6987151c/sambanas/rootfs/etc/s6-overlay/s6-rc.d/init-automount/run#L106
bashio::log.blue "Disabled : please use another method"
bashio::log.blue "Disabled : please use another method"
exit0
exit0
fi
fi
bashio::log.notice "This script is used to mount remote smb/cifs/nfs shares. Instructions here : https://github.com/alexbelgium/hassio-addons/wiki/Mounting-remote-shares-in-Addons"
bashio::log.notice "This script is used to mount remote smb/cifs/nfs shares. Instructions here : https://github.com/alexbelgium/hassio-addons/wiki/Mounting-remote-shares-in-Addons"
@@ -14,344 +15,459 @@ bashio::log.notice "This script is used to mount remote smb/cifs/nfs shares. Ins
if ! echo"$err"| grep -Eq 'mount error\(22\)|mount error\(95\)|mount error\(112\)|Server abruptly closed the connection|does not support the SMB version|Protocol negotiation|NT_STATUS_CONNECTION_DISCONNECTED';then
bashio::log.fatal "...... the structure of your \"networkdisks\" option : \"$disk\" doesn't seem correct, please use a structure like //123.12.12.12/sharedfolder,//123.12.12.12/sharedfolder2. If you don't use it, you can simply remove the text, this will avoid this error message in the future."
bashio::log.warning "Your smb system requires smbv1. This is an obsolete protocol. Please correct this to prevent issues."
bashio::log.warning ""
fi
else
# Mounting failed messages
if[["$FSTYPE"=="cifs"]];then
bashio::log.fatal "Error, unable to mount $disk to /mnt/$diskname with username $USERNAME, $PASSWORD. Please check your remote share path, username, password, domain, try putting 0 in UID and GID"
bashio::log.fatal "Error, unable to mount NFS share $disk to /mnt/$diskname. Please check the export path and that NFS server allows this client (and NFSv4)."
# last-ditch try with very basic options
mount_drive "rw"
fi
bashio::log.fatal "Error read : $(< ERRORCODE), addon will stop in 1 min"
bashio::log.warning "Your SMB system requires SMBv1. This is an obsolete protocol. Please correct this to prevent issues."
bashio::log.warning ""
fi
cleanup_cred
elif[["$MOUNTED"=="readonly"]];then
bashio::log.warning "...... $disk mounted to /mnt/$diskname but is READ-ONLY or not writable by UID/GID ${PUID#,uid=}:${PGID#,gid=}."
bashio::log.warning "...... Check Samba share permissions, or try setting PUID/PGID to 0/0 (root), or adjust server ACLs."
rm -f "$ERRORCODE_FILE" 2>/dev/null ||true
cleanup_cred
else
if[["$FSTYPE"=="cifs"]];then
bashio::log.fatal "Error, unable to mount $disk to /mnt/$diskname with username $USERNAME. Please check share path, username/password/domain; try UID/GID 0."
@@ -11,8 +11,6 @@ if [ ! -d /config ] || ! bashio::supervisor.ping 2> /dev/null; then
exit0
exit0
fi
fi
bashio::log.notice "This script is used to export custom environment variables at start of the addon using the env_vars addon options. Instructions here : https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2"
# Define slug
# Define slug
slug="${HOSTNAME/-/_}"
slug="${HOSTNAME/-/_}"
slug="${slug#*_}"
slug="${slug#*_}"
@@ -74,6 +72,11 @@ if [[ "$CONFIGSOURCE" != *".yaml" ]]; then
exit1
exit1
fi
fi
ENV_FILE="/.env"
if[[ ! -f "$ENV_FILE"]];then
printf'# Generated by 01-config_yaml.sh from %s\n'"$CONFIGSOURCE" > "$ENV_FILE"
fi
# Permissions only if the config file already exists
# Permissions only if the config file already exists
if ! command -v bashio::addon.version >/dev/null 2>&1;then
for f in /usr/lib/bashio/bashio.sh /usr/lib/bashio/lib.sh /usr/src/bashio/bashio.sh /usr/local/lib/bashio/bashio.sh /usr/local/lib/bashio-standalone.sh;do
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
## Repository Overview
This is a Home Assistant add-on repository containing 120+ Docker-based add-ons for the Home Assistant Supervisor. Each add-on is a self-contained directory with a Dockerfile, config schema, and S6-overlay init scripts. The repository uses GitHub Actions for CI/CD, linting, and automated upstream version tracking.
## Add-On Directory Structure
Most add-ons follow this common layout, though exceptions exist (e.g. some archived add-ons use `config.json` instead of `config.yaml`, some add-ons have `build.yaml` instead of `build.json` or no build file at all, and not every add-on includes a `rootfs/` tree):
```
addon_name/
├── config.yaml # HA add-on metadata, schema, ports, maps
├── build.json # Base Docker images per architecture (may be build.yaml, or absent)
├── CHANGELOG.md # Required; must be updated on every PR
└── rootfs/ # Optional; absent in some add-ons
└── etc/
├── cont-init.d/ # S6-overlay init scripts (numbered, run in order)
└── services.d/ # S6-overlay supervised services (some add-ons use
# s6-overlay v3 layout at etc/s6-overlay/s6-rc.d/ instead)
```
## Dockerfile Convention
Most Dockerfiles follow this 6-section pattern (some add-ons deviate slightly, e.g. using a pinned upstream image directly instead of `ARG BUILD_FROM`):
4.**Entrypoint**– Set `S6_STAGE2_HOOK=/ha_entrypoint.sh`
5.**Labels**– Standard OCI + HA labels from build args
6.**Healthcheck**– curl-based check suppressed from nginx/apache logs
Shared build-time scripts are pulled from `.templates/` at build time:
-`ha_automodules.sh`– Downloads module scripts listed in `ARG MODULES=`
-`ha_autoapps.sh`– Installs packages listed in `ENV PACKAGES=`
-`ha_entrypoint.sh`– S6 stage-2 hook; launches the cont-init stack at container start
-`ha_lsio.sh`– Patches LinuxServer.io base images for HA compatibility
-`bashio-standalone.sh`– Bashio library for scripts outside Supervisor context
The `ARG MODULES=` line lists template scripts to download at build time (e.g., `00-banner.sh 01-custom_script.sh 00-smb_mounts.sh`). Commonly-used modules in `.templates/` (not exhaustive):
-`00-banner.sh`– Print the add-on startup banner
-`00-global_var.sh`– Initialize global env vars from HA options
-`00-local_mounts.sh`– Mount local disks (localdisks option)
-`00-smb_mounts.sh`– SMB/CIFS network mount support
-`00-deprecated.sh`– Print a deprecation warning for add-ons superseded by official ones
-`01-config_yaml.sh`– Map HA options → app's `config.yaml`
-`01-custom_script.sh`– Run user-provided custom scripts
-`99-custom_script.sh`– Run a user `script.sh` from the add-on config dir at startup
Other helper scripts in `.templates/` used at build/run time: `ha_automatic_packages.sh` (resolve package names across distros), `ha_entrypoint_modif.sh`, `00-aaa_dockerfile_backup.sh`, plus `config.template`/`script.template`/`show_text_color` (templates/assets copied into add-ons).
## config.yaml Schema
Key fields in every add-on's `config.yaml`:
```yaml
arch:[aarch64, amd64]
image:ghcr.io/alexbelgium/{slug}-{arch}
version:"X.Y.Z"# upstream version (format varies; see Versioning section)
ingress:true/false
ingress_port:8000
map:
- addon_config:rw # /addon_configs/<hostname>/
- share:rw
- media:rw
- ssl
schema:
env_vars:# Allows arbitrary env var passthrough
- name:match(^[A-Za-z0-9_]+$)
value:str?
PUID:int
PGID:int
TZ:str?
networkdisks:str? # SMB mounts
localdisks:str? # Local disk mounts
```
The `env_vars` schema key enables the env-var passthrough mechanism. At runtime the `00-global_var.sh` cont-init module reads `/data/options.json` and exports each key as an environment variable (writing to `/.env` and `/etc/environment`). `ha_entrypoint.sh` is the S6 stage-2 hook that launches the cont-init stack but does not itself perform the JSON-to-env conversion.
## Versioning
Add-on versions in `config.yaml` closely follow the upstream release tag and do not conform to a single fixed format. Common patterns include:
-`X.Y.Z`– plain upstream semver (e.g. `0.137.0`)
-`X.Y.Z-N`– upstream version with a local patch counter (e.g. `0.6.26-2`)
When an upstream version is bumped, update `version` in `config.yaml`. If the add-on's `Dockerfile` contains an `ARG BUILD_UPSTREAM` line, update that value too — it is the canonical place that records the upstream version at build time (it is **not** stored in `build.json`/`build.yaml`). Some add-ons do not use `BUILD_UPSTREAM` at all. The `updater.json` file tracks which upstream source/repo to monitor and records the last seen version.
Add-ons support end-user customization without rebuilding the image (see the repo wiki). At startup, `99-custom_script.sh` looks in the add-on's config directory for a user-provided `script.sh` (seeded from `.templates/script.template`) and executes it. Combined with the `env_vars` passthrough and the custom-script modules, this lets users inject commands and environment without forking the add-on.
✓ [Aurral](aurral/) : Self-hosted music discovery, request management, flows, and playlist importing for Lidarr with library-aware recommendations.
@@ -92,6 +98,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Baikal](baikal/) : Calendar+Contacts server
✓ [Baikal](baikal/) : Calendar+Contacts server
@@ -108,13 +116,24 @@ If you want to do add the repository manually, please follow the procedure highl
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![mqtt][mqtt-badge]
![mqtt][mqtt-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Bazarr NAS](bazarr/) : Companion application to Sonarr and Radarr to download subtitles
✓ [Bazarr NAS](bazarr/) : Companion application to Sonarr and Radarr to download subtitles
✓  [BentoPDF](bentopdf/) : Privacy-first PDF toolkit. 50+ tools, all processing client-side in the browser. Files never leave your device.
@@ -142,6 +184,20 @@ If you want to do add the repository manually, please follow the procedure highl
![ingress][ingress-badge]
![ingress][ingress-badge]
![MariaDB][mariadb-badge]
![MariaDB][mariadb-badge]
![mqtt][mqtt-badge]
![mqtt][mqtt-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Birdnet-go (customized and built from source)](birdnet-go-dev/) : Realtime BirdNET soundscape analyzer, compiled from the alexbelgium/birdnet-go fork with all open PRs merged, with OpenVINO enabled for Intel CPU/iGPU acceleration (amd64-only test build)
✓ [Browserless Chromium](browserless_chrome/) : Chromium as a service container
✓ [Browserless Chromium](browserless_chrome/) : Chromium as a service container
@@ -164,6 +230,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Calibre-web](calibre_web/) : Browsing, reading and downloading eBooks using an existing Calibre database
✓  [Calibre-web](calibre_web/) : Browsing, reading and downloading eBooks using an existing Calibre database
@@ -172,6 +240,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Castsponsorskip](sponsorblockcast/) : Skip YouTube ads and sponsorships on all local Google Cast devices
✓ [Castsponsorskip](sponsorblockcast/) : Skip YouTube ads and sponsorships on all local Google Cast devices
@@ -180,12 +250,31 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
✓ [Changedetection.io](changedetection.io/) : web page monitoring, notification and change detection
✓ [Changedetection.io](changedetection.io/) : web page monitoring, notification and change detection
✓  [Claude Desktop](claude_desktop/) : Claude Desktop with Headroom, RTK, and TokenSave optimization
✓  [Cleanuparr](cleanuparr/) : Automatically removes stuck and unwanted downloads from your *arr and download clients
✓  [Cloudcommander](cloudcommander/) : Cloud Commander a file manager for the web with console and editor
✓  [Cloudcommander](cloudcommander/) : Cloud Commander a file manager for the web with console and editor
@@ -194,6 +283,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Codex](codex/) : Web based comic archive browser and reader
✓  [Codex](codex/) : Web based comic archive browser and reader
@@ -202,6 +293,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Collabora](collabora/) : Collabora Online office suite
✓ [Collabora](collabora/) : Collabora Online office suite
@@ -216,10 +309,13 @@ If you want to do add the repository manually, please follow the procedure highl
@@ -230,6 +326,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Emby Beta](emby_beta/) : A free Software Media System that puts you in control of managing and streaming your media (beta version)
✓  [Emby Beta](emby_beta/) : A free Software Media System that puts you in control of managing and streaming your media (beta version)
@@ -238,6 +336,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Ente](ente/) : Self-hosted, end-to-end-encrypted photo & video storage (Ente server + MinIO)
✓ [Ente](ente/) : Self-hosted, end-to-end-encrypted photo & video storage (Ente server + MinIO)
@@ -245,6 +345,8 @@ If you want to do add the repository manually, please follow the procedure highl
✓ [Epic Games Free](epicgamesfree/) : Automatically login and redeem promotional free games from Epic Games Store
✓ [Epic Games Free](epicgamesfree/) : Automatically login and redeem promotional free games from Epic Games Store
@@ -253,13 +355,25 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
✓  [Filebrowser (10314x)](filebrowser/) : filebrowser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit your files
✓  [FileBrowser Quantum](filebrowser_quantum/) : FileBrowser Quantum provides a modern, responsive file manager with multi-source support, advanced authentication options, and realtime indexing for your Home Assistant files
✓  [Filebrowser](filebrowser/) : filebrowser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit your files
✓  [Immich Cuda](immich_cuda/) : Self-hosted photo and video backup solution directly from your mobile phone
✓  [Immich Cuda](immich_cuda/) : Self-hosted photo and video backup solution directly from your mobile phone
@@ -356,7 +471,8 @@ If you want to do add the repository manually, please follow the procedure highl
✓ [Inadyn](inadyn/) : Inadyn is a small and simple Dynamic DNS, DDNS, client with HTTPS support. A large number of dynamic dns providers are supported (https://github.com/troglobit/inadyn#supported-providers). For those that are not, you can use a custom provider as per this project's documentation (https://github.com/nalipaz/hassio-addons/blob/master/README.md)
✓ [Inadyn](inadyn/) : Inadyn is a small and simple Dynamic DNS, DDNS, client with HTTPS support. A large number of dynamic dns providers are supported (https://github.com/troglobit/inadyn#supported-providers). For those that are not, you can use a custom provider as per this project's documentation (https://github.com/nalipaz/hassio-addons/blob/master/README.md)
@@ -401,19 +519,23 @@ If you want to do add the repository manually, please follow the procedure highl
✓  [Jellyfin NAS](jellyfin/) : A Free Software Media System that puts you in control of managing and streaming your media
✓  [Jellyfin (71957x) NAS](jellyfin/) : A free Software Media System that puts you in control of managing and streaming your media
✓  [Mealie](mealie/) : Mealie is a self hosted recipe manager and meal planner built in Vue
✓  [Mealie](mealie/) : Mealie is a self hosted recipe manager and meal planner built in Vue
@@ -518,7 +660,7 @@ If you want to do add the repository manually, please follow the procedure highl
![ingress][ingress-badge]
![ingress][ingress-badge]
![mqtt][mqtt-badge]
![mqtt][mqtt-badge]
✓  [NetAlertX Full Access](netalertx_fa/) : 🖧🔍 WIFI / LAN scanner, intruder, and presence detector
✓  [NetAlertX Full Access](netalertx_fa/) : 🖧🔍 Centralized network visibility and continuous asset discovery.
@@ -535,6 +683,14 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![MariaDB][mariadb-badge]
![MariaDB][mariadb-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Nginx Proxy Manager + Static Web Server](nginx_webserver_proxy/) : Nginx Proxy Manager with a built-in configurable static file server. Manage reverse proxies via NPM UI on port 81 while serving files from HA storage on port 80.
@@ -586,10 +744,10 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
✓ [Overseerr](overseerr/) : Request management and media discovery tool built to work with your existing Plex ecosystem
✓ [Overseerr (deprecated)](zzz_archived_overseerr/) : Request management and media discovery tool built to work with your existing Plex ecosystem (deprecated, migrate to Seer add-on)
✓ [Plex NAS](plex/) : Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices
✓ [Plex NAS](plex/) : Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices
@@ -615,8 +777,10 @@ If you want to do add the repository manually, please follow the procedure highl
@@ -646,12 +810,15 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
✓ [Prowlarr NAS](prowlarr/) : Torrent Trackers and Usenet indexers offering complete management ofSonarr, Radarr, Lidarr, and Readarr indexers with no per app setup required
✓ [Prowlarr NAS](prowlarr/) : Torrent Trackers and Usenet indexers offering complete management ofSonarr, Radarr, Lidarr, and Readarr indexers with no per app setup required
✓  [Radarr](radarr/) : A fork of Sonarr to work with movies like Couchpotato
✓  [Radarr](radarr/) : A fork of Sonarr to work with movies like Couchpotato
@@ -660,6 +827,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Readarr](readarr/) : Book manager and automation
✓  [Readarr](readarr/) : Book manager and automation
@@ -668,6 +837,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Repository Updater](addons_updater/) : Automatic addons update by aligning version tag with upstream releases
✓ [Repository Updater](addons_updater/) : Automatic addons update by aligning version tag with upstream releases
@@ -689,6 +860,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Sabnzbd](sabnzbd/) : Makes Usenet as simple and streamlined as possible by automating everything we can
✓  [Sabnzbd](sabnzbd/) : Makes Usenet as simple and streamlined as possible by automating everything we can
@@ -696,6 +869,8 @@ If you want to do add the repository manually, please follow the procedure highl
@@ -720,6 +896,16 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![MariaDB][mariadb-badge]
![MariaDB][mariadb-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Seerr](seerr/) : Open-source media request and discovery manager for Jellyfin (71957x), Plex, and Emby
✓  [Sonarr](sonarr/) : Can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them
✓  [Sonarr](sonarr/) : Can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them
✓  [Spotweb](spotweb/) : Spotweb is a decentralized usenet community based on the Spotnet protocol
✓  [Spotweb](spotweb/) : Spotweb is a decentralized usenet community based on the Spotnet protocol
@@ -759,6 +961,8 @@ If you want to do add the repository manually, please follow the procedure highl
✓  [Webtop KDE](webtop_kde/) : Full linux desktop environment accessible via any modern web browser
✓  [Webtop KDE](webtop_kde/) : Full linux desktop environment accessible via any modern web browser
@@ -809,6 +1022,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓  [Webtop xfce](webtop/) : Full linux desktop environment accessible via any modern web browser
✓  [Webtop xfce](webtop/) : Full linux desktop environment accessible via any modern web browser
@@ -817,6 +1032,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![ingress][ingress-badge]
![ingress][ingress-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Webtrees](webtrees/) : web's leading on-line collaborative genealogy application
✓ [Webtrees](webtrees/) : web's leading on-line collaborative genealogy application
@@ -825,6 +1042,8 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
![MariaDB][mariadb-badge]
![MariaDB][mariadb-badge]
![smb][smb-badge]
![localdisks][localdisks-badge]
✓ [Wger](wger/) : manage your personal workouts, weight and diet plans
✓ [Wger](wger/) : manage your personal workouts, weight and diet plans
@@ -837,7 +1056,7 @@ If you want to do add the repository manually, please follow the procedure highl
✓ [zzz_archived - Plex meta manager](zzz_archived_plex_meta_manager/) : Python script to update metadata information for movies, shows, and collections as well as automatically build collections
✓ [zzz_archived - Plex meta manager](zzz_archived_plex_meta_manager/) : Python script to update metadata information for movies, shows, and collections as well as automatically build collections
@@ -893,10 +1149,9 @@ If you want to do add the repository manually, please follow the procedure highl
![aarch64][aarch64-badge]
![aarch64][aarch64-badge]
![amd64][amd64-badge]
![amd64][amd64-badge]
✓ [zzz_archived - Vaultwarden](zzz_archived_bitwarden/) : Deprecated - please use community version
✓ [zzz_archived - Tor with bridges](zzz_archived_tor/) : Protect your privacy and access Home Assistant via Tor
## description: Automatic addons update by aligning version tag with upstream releases 3.19.15 (08-12-2025)
## 2026.06 (05-06-2026)
- Minor bugs fixed
## 2026.05 (30-05-2026)
- Update lastversion to 3.6.12
## 3.19.16 (2026-01-10)
- Add config option to choose ISO8601 (YYYY-MM-DD) or DD-MM-YYYY dates for last_update/changelog entries
## 3.19.15 (2025-12-08)
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- Improve Codeberg handling with a Gitea API fallback when lastversion lacks custom host support
- Improve Codeberg handling with a Gitea API fallback when lastversion lacks custom host support
## 3.19.12 (2025-11-18)
## 3.19.12 (18-11-2025)
- Added support for configuring extra environment variables through the `env_vars` option.
- Added support for configuring extra environment variables through the `env_vars` option.
@@ -37,7 +37,8 @@ This script allows to automatically update addons based on upstream new releases
The installation of this add-on is pretty straightforward and not different in
The installation of this add-on is pretty straightforward and not different in
comparison to installing any other Hass.io add-on.
comparison to installing any other Hass.io add-on.
1.[Add my Hass.io add-ons repository][repository] to your Hass.io instance.
1. Add my add-ons repository to your home assistant instance (in supervisor addons store at top right, or click button below if you have configured my HA)
[](https://my.home-assistant.io/redirect/supervisor_add_addon_repository/?repository_url=https%3A%2F%2Fgithub.com%2Falexbelgium%2Fhassio-addons)
1. Install this add-on.
1. Install this add-on.
1. Configure the add-on to your preferences, see below
1. Configure the add-on to your preferences, see below
1. Click the `Save` button to store your configuration.
1. Click the `Save` button to store your configuration.
@@ -81,6 +82,7 @@ repository: 'name/repo' coming from github
gituser:your github username
gituser:your github username
gitapi:your github api token(classic) https://github.com/settings/tokens
gitapi:your github api token(classic) https://github.com/settings/tokens
gitmail:your github email
gitmail:your github email
date_iso8601:true# use ISO8601 dates (YYYY-MM-DD) instead of DD-MM-YYYY
[Aurral](https://github.com/lklynet/aurral) is a self-hosted music discovery, request management, flows, and playlist importing app for Lidarr with library-aware recommendations.
This addon is based on the docker image <https://github.com/lklynet/aurral>
## Configuration
| Option | Default | Description |
|---|---|---|
| `download_folder` | `/share/aurral/downloads` | Path where Aurral writes flow downloads. Must be under `/share`. |
| `weekly_flow_folder` | `weekly-flow` | Subfolder name appended to `download_folder` for weekly flow files. The full path will be `download_folder/weekly_flow_folder`. |
## Installation
1. Add my add-ons repository to your home assistant instance (in supervisor addons store at top right, or click button below if you have configured my HA)
[](https://my.home-assistant.io/redirect/supervisor_add_addon_repository/?repository_url=https%3A%2F%2Fgithub.com%2Falexbelgium%2Fhassio-addons)
2. Install this add-on.
3. Click the `Save` button to store your configuration.
4. Set the `download_folder` option to your preferred path.
5. Optionally set `weekly_flow_folder` to customise the weekly flow subfolder name.
6. Start the add-on.
7. Check the logs of the add-on to see if everything went well.
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.80.0 (2026-06-05)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.70.0 (06-12-2025)
## 1.79.0 (2026-05-19)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.78.0 (2026-05-16)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.77.1 (2026-05-09)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.77.0 (2026-05-02)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.76.0 (2026-04-11)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.75.1 (2026-03-26)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.74.0 (2026-03-12)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.73.0 (2026-02-14)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.72.1 (2026-01-30)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.71.0 (2025-12-20)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.70.0 (2025-12-06)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
## 1.69.0 (15-11-2025)
## 1.69.0 (2025-11-15)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
## 1.68.0 (11-10-2025)
## 1.68.0 (2025-10-11)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.67.0 (04-10-2025)
## 1.67.0 (2025-10-04)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.66.1 (13-09-2025)
## 1.66.1 (2025-09-13)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.65.0 (09-08-2025)
## 1.65.0 (2025-08-09)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.64.0 (25-07-2025)
## 1.64.0 (2025-07-25)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.63.1 (13-06-2025)
## 1.63.1 (2025-06-13)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.62.0 (10-05-2025)
## 1.62.0 (2025-05-10)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.61.0 (19-04-2025)
## 1.61.0 (2025-04-19)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.60.0 (22-03-2025)
## 1.60.0 (2025-03-22)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.59.0 (08-03-2025)
## 1.59.0 (2025-03-08)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.58.0 (01-02-2025)
## 1.58.0 (2025-02-01)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.57.0 (11-01-2025)
## 1.57.0 (2025-01-11)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.56.1 (04-01-2025)
## 1.56.1 (2025-01-04)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.56.0 (28-12-2024)
## 1.56.0 (2024-12-28)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.54.0 (21-12-2024)
## 1.54.0 (2024-12-21)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.53.1 (14-12-2024)
## 1.53.1 (2024-12-14)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.52.0 (07-12-2024)
## 1.52.0 (2024-12-07)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.51.1 (30-11-2024)
## 1.51.1 (2024-11-30)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.50.0 (16-11-2024)
## 1.50.0 (2024-11-16)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.49.0 (09-11-2024)
## 1.49.0 (2024-11-09)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.48.0 (26-10-2024)
## 1.48.0 (2024-10-26)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.47.1 (12-10-2024)
## 1.47.1 (2024-10-12)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.46.1 (14-09-2024)
## 1.46.1 (2024-09-14)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.45.0 (31-08-2024)
## 1.45.0 (2024-08-31)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.44.0 (27-07-2024)
## 1.44.0 (2024-07-27)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.43.0 (22-06-2024)
## 1.43.0 (2024-06-22)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.42.0 (11-05-2024)
## 1.42.0 (2024-05-11)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.41.0 (20-04-2024)
## 1.41.0 (2024-04-20)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
## 1.40.1 (30-03-2024)
## 1.40.1 (2024-03-30)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- Update to latest version from autobrr/autobrr (changelog : https://github.com/autobrr/autobrr/releases)
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
## 0.10.1-hafix4 (18-11-2025)
## 0.10.1-hafix4 (2025-11-18)
- Minor bugs fixed
- Minor bugs fixed
## 0.10.1-hafix3 (18-11-2025)
## 0.10.1-hafix3 (2025-11-18)
- Added support for configuring extra environment variables via the `env_vars` option alongside config.yaml.
- Added support for configuring extra environment variables via the `env_vars` option alongside config.yaml.
## 0.10.1-hafix2 (01-08-2025)
## 0.10.1-hafix2 (2025-08-01)
- Minor bugs fixed
- Minor bugs fixed
## 0.10.1+hafix (26-04-2025)
## 0.10.1+hafix (2025-04-26)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
## 0.10.1-2 (23-11-2024)
## 0.10.1-2 (2024-11-23)
- Minor bugs fixed
- Minor bugs fixed
## 0.10.1 (23-11-2024)
## 0.10.1 (2024-11-23)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
## 0.9.5_updated (06-08-2024)
## 0.9.5_updated (2024-08-06)
- Minor bugs fixed
- Minor bugs fixed
## 0.9.5 (27-04-2024)
## 0.9.5 (2024-04-27)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
- Update to latest version from ckulka/baikal-docker (changelog : https://github.com/ckulka/baikal-docker/releases)
## 0.9.4-3 (26-04-2024)
## 0.9.4-3 (2024-04-26)
- ⚠ MAJOR CHANGE : switch to the new config logic from homeassistant. Your configuration files will have migrated from /config/hassio_addons/baikal to a folder only accessible from my Filebrowser addon called /addon_configs/something-baikal. This avoids the addon to mess with your homeassistant configuration folder, and allows to backup the options. Migration of data, custom configs, and custom scripts should be automatic. Please be sure to update all your links however ! For more information, see here : https://developers.home-assistant.io/blog/2023/11/06/public-addon-config/
- ⚠ MAJOR CHANGE : switch to the new config logic from homeassistant. Your configuration files will have migrated from /config/hassio_addons/baikal to a folder only accessible from my Filebrowser addon called /addon_configs/something-baikal. This avoids the addon to mess with your homeassistant configuration folder, and allows to backup the options. Migration of data, custom configs, and custom scripts should be automatic. Please be sure to update all your links however ! For more information, see here : https://developers.home-assistant.io/blog/2023/11/06/public-addon-config/
## 0.9.4-2 (14-01-2024)
## 0.9.4-2 (2024-01-14)
- Minor bugs fixed
- Minor bugs fixed
## 0.9.4+msmtpfix (30-12-2023)
## 0.9.4+msmtpfix (2023-12-30)
- Update to latest version from ckulka/baikal-docker
- Update to latest version from ckulka/baikal-docker
## 0.9.4 (23-12-2023)
## 0.9.4 (2023-12-23)
- Update to latest version from ckulka/baikal-docker
- Update to latest version from ckulka/baikal-docker
## 0.9.3+msmtp (04-11-2023)
## 0.9.3+msmtp (2023-11-04)
- Update to latest version from ckulka/baikal-docker
- Update to latest version from ckulka/baikal-docker
- Implemented healthcheck
- Implemented healthcheck
## 0.9.3 (13-12-2022)
## 0.9.3 (2022-12-13)
- Update to latest version from ckulka/baikal-docker
- Update to latest version from ckulka/baikal-docker
- WARNING : update to supervisor 2022.11 before installing
- WARNING : update to supervisor 2022.11 before installing
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
## 2025.06.06 (03-06-2025)
## 2025.06.06 (2025-06-03)
- Minor bugs fixed
- Minor bugs fixed
## 2025.06.05 (03-06-2025)
## 2025.06.05 (2025-06-03)
- Minor bugs fixed
- Minor bugs fixed
## 2025.06.04 (02-06-2025)
## 2025.06.04 (2025-06-02)
- Minor bugs fixed
- Minor bugs fixed
## 2025.06.02 (02-06-2025)
## 2025.06.02 (2025-06-02)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.18 (29-04-2025)
## 2025.04.18 (2025-04-29)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.17 (29-04-2025)
## 2025.04.17 (2025-04-29)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.16 (28-04-2025)
## 2025.04.16 (2025-04-28)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.15 (28-04-2025)
## 2025.04.15 (2025-04-28)
- Major refactor : based now on BirdNET-Pi. Please backup before update
- Major refactor : based now on BirdNET-Pi. Please backup before update
## 2025.04.11 (19-04-2025)
## 2025.04.11 (2025-04-19)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.10 (14-04-2025)
## 2025.04.10 (2025-04-14)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.09 (11-04-2025)
## 2025.04.09 (2025-04-11)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.08 (11-04-2025)
## 2025.04.08 (2025-04-11)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.04 (11-04-2025)
## 2025.04.04 (2025-04-11)
- Minor bugs fixed
- Minor bugs fixed
## 2025.04.02 (11-04-2025)
## 2025.04.02 (2025-04-11)
- Activate NO_NOISE_MODEL option to use the high fidelity models
- Activate NO_NOISE_MODEL option to use the high fidelity models
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.5.5 (2026-02-04)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.5.4-1 (2026-01-08)
- ⚠ MAJOR CHANGE : switch to the new config logic from homeassistant. Your configuration files will have migrated from /config/addons_config/bazarr to a folder only accessible from my Filebrowser addon called /addon_configs/xxx-bazarr. This avoids the addon to mess with your homeassistant configuration folder, and allows to backup the options. Migration of data should be automatic. Please be sure to update all your links however ! For more information, see here : https://developers.home-assistant.io/blog/2023/11/06/public-addon-config/
## 1.5.4 (2026-01-08)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
- Added support for configuring extra environment variables via the `env_vars` add-on option alongside config.yaml. See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
## 1.5.3 (27-09-2025)
## 1.5.3 (2025-09-27)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.5.2 (17-05-2025)
## 1.5.2 (2025-05-17)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.5.1 (04-01-2025)
## 1.5.1 (2025-01-04)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.5.0 (28-12-2024)
## 1.5.0 (2024-12-28)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.4.5 (05-10-2024)
## 1.4.5 (2024-10-05)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.4.4 (21-09-2024)
## 1.4.4 (2024-09-21)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.4.3 (08-06-2024)
## 1.4.3 (2024-06-08)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
- Update to latest version from linuxserver/docker-bazarr (changelog : https://github.com/linuxserver/docker-bazarr/releases)
## 1.4.2 (24-02-2024)
## 1.4.2 (2024-02-24)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.4.1 (10-02-2024)
## 1.4.1 (2024-02-10)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.4.0-2 (04-12-2023)
## 1.4.0-2 (2023-12-04)
- Minor bugs fixed
- Minor bugs fixed
## 1.4.0 (02-12-2023)
## 1.4.0 (2023-12-02)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.3.1 (20-10-2023)
## 1.3.1 (2023-10-20)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.3.0 (16-09-2023)
## 1.3.0 (2023-09-16)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.2.4 (22-07-2023)
## 1.2.4 (2023-07-22)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.2.3-2 (16-07-2023)
## 1.2.3-2 (2023-07-16)
- Minor bugs fixed
- Minor bugs fixed
- Armv7 discontinued, pinned to latest working
- Armv7 discontinued, pinned to latest working
## 1.2.3 (15-07-2023)
## 1.2.3 (2023-07-15)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.2.2 (01-07-2023)
## 1.2.2 (2023-07-01)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.2.1 (06-05-2023)
## 1.2.1 (2023-05-06)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.2.0-1 (21-04-2023)
## 1.2.0-1 (2023-04-21)
- Minor bugs fixed
- Minor bugs fixed
- Implemented healthcheck
- Implemented healthcheck
## 1.2.0 (04-03-2023)
## 1.2.0 (2023-03-04)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.1.4 (07-01-2023)
## 1.1.4 (2023-01-07)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.1.3 (06-12-2022)
## 1.1.3 (2022-12-06)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- WARNING : update to supervisor 2022.11 before installing
- WARNING : update to supervisor 2022.11 before installing
## 1.1.2 (18-10-2022)
## 1.1.2 (2022-10-18)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- New feature : localdisks mounting added
- New feature : localdisks mounting added
## 1.1.1 (01-09-2022)
## 1.1.1 (2022-09-01)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.1.0 (05-07-2022)
## 1.1.0 (2022-07-05)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.0.4 (01-05-2022)
## 1.0.4 (2022-05-01)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.0.3 (27-04-2022)
## 1.0.3 (2022-04-27)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- Add codenotary sign
- Add codenotary sign
## 1.0.3 (27-02-2022)
## 1.0.3 (2022-02-27)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 1.0.2 (04-01-2022)
## 1.0.2 (2022-01-04)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
@@ -118,48 +141,48 @@
- Fixed local config
- Fixed local config
- updated to v1.0.2-ls140
- updated to v1.0.2-ls140
## 1.0.2 (01-01-2022)
## 1.0.2 (2022-01-01)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- Cleanup: config base folder changed to /config/addons_config (thanks @bruvv)
- Cleanup: config base folder changed to /config/addons_config (thanks @bruvv)
- New standardized logic for Dockerfile build and packages installation
- New standardized logic for Dockerfile build and packages installation
## 1.0.1 (20-11-2021)
## 1.0.1 (2021-11-20)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- Allow mounting local drives by label. Just pust the label instead of sda1 for example
- Allow mounting local drives by label. Just pust the label instead of sda1 for example
- SMB : accepts several disks separated by commas mounted in /mnt/$sharename
- SMB : accepts several disks separated by commas mounted in /mnt/$sharename
## 1.0.0 (13-10-2021)
## 1.0.0 (2021-10-13)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 0.9.9 (11-09-2021)
## 0.9.9 (2021-09-11)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 0.9.8 (02-09-2021)
## 0.9.8 (2021-09-02)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 0.9.7 (14-08-2021)
## 0.9.7 (2021-08-14)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 0.9.6 (07-08-2021)
## 0.9.6 (2021-08-07)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
## 2.6.2 (07-08-2021)
## 2.6.2 (2021-08-07)
- Update to latest version from alexbelgium/portainer
- Update to latest version from alexbelgium/portainer
## 0.9.6 (21-07-2021)
## 0.9.6 (2021-07-21)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
- Enable smb mounts
- Enable smb mounts
## 0.9.5 (09-05-2021)
## 0.9.5 (2021-05-09)
- Update to latest version from linuxserver/docker-bazarr
- Update to latest version from linuxserver/docker-bazarr
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.