GitHub bot : README updated

* fix(templates): forward the container stop to services supervised by ha_entrypoint

When ha_entrypoint.sh is PID 1 (init: false add-ons on images without
s6-overlay: comicarr, komga, degoog, ...), terminate() signals only its
direct children. Those are the per-service restart-loop subshells, which
died on SIGTERM without passing it on; PID 1 then exited and the kernel
SIGKILLed every service. No service ever got a chance to shut down cleanly.

Each loop now runs its service (and the restart delay) in the background,
traps TERM/INT, forwards SIGTERM to that process, waits for it to exit, and
leaves the loop instead of restarting it. The "Termination signal received"
line the postgres add-ons sed into is unchanged.

Implementation drafted by Codex (gpt-5.6-sol), reviewed and tested here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(templates): stop the service's whole process group, and wait for it to empty

A run file that does not exec its daemon only had its wrapper shell
signalled: portainer_agent's own run file, and LinuxServer's svc-transmission
in base images we cannot edit. Each loop subshell now runs with job control
(set -m), so every service is its own process group; the stop is sent to the
group and PID 1 waits until the group is empty, so the daemon drains instead
of being SIGKILLed when PID 1 exits. Docker's stop timeout still bounds it.

Revision drafted by Codex (gpt-5.6-sol); the group-drain wait was added after
a PID-1 test showed the daemon got TERM but was killed mid-drain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/references/traps.md

@@ -226,7 +226,7 @@ against an allow-list and aborts on anything else: `--disable-dev-shm-usage` pro
 (`packages/lib/utils/processStartFlags.ts`; it accepts `--no-sandbox`, `--ozone-platform=`,
 `--disable-gpu` and a few others). The build-time `grep` that "verified" the flag only proved
 the text was in the wrapper, not that the app tolerated it. Check the app's argument parser before
-passing a Chromium flag to anything that is not Chromium itself (joplin_desktop, PR #3112).
+passing a Chromium flag to anything that is not Chromium itself (joplin_desktop, PR #3112, fixed in the follow-up PR).
 
 ## CI and review bots
 

.github/workflows/daily_ai_fix.yaml

@@ -125,7 +125,7 @@ jobs:
 
       - name: Analyse and fix
         if: steps.batch.outputs.count != '0'
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange. The scheduled path

.github/workflows/on_claude_mention.yml

@@ -64,7 +64,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # AI_PR_TOKEN, not GITHUB_TOKEN, so a PR Claude opens triggers CI.

.github/workflows/on_issue_approved.yaml

@@ -135,7 +135,7 @@ jobs:
 
       - name: Execute the plan
         if: steps.bundle.outputs.has_plan == 'true'
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange, which 401s whenever

.github/workflows/on_issues_ai_triage.yaml

@@ -166,7 +166,7 @@ jobs:
         id: classify
         if: github.event_name != 'issue_comment' || steps.claim.outputs.go == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Without this the action falls back to the OIDC -> Claude App token

.github/workflows/on_pr_coderabbit.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Address CodeRabbit comments
         if: steps.claim.outputs.go == 'true'
-        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64  # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange, which 401s whenever

.templates/ha_entrypoint.sh

@@ -437,9 +437,34 @@ if $PID1; then
     (
       restart_count=0
       max_restarts=5
+      # terminate() signals only PID 1's direct children, which are these loop subshells.
+      # Give each background job its own process group and forward the stop to the whole
+      # group, so wrappers and their daemons can shut down before PID 1 exits.
+      set -m
+      stopping=false
+      service_pid=
+      trap 'stopping=true; [ -z "$service_pid" ] || kill -TERM -- "-$service_pid" 2>/dev/null || true' TERM INT
+      wait_for_service() {
+        local pid="$service_pid"
+        if $stopping; then
+          kill -TERM -- "-$pid" 2>/dev/null || true
+        fi
+        _svc_rc=0
+        wait "$pid" 2>/dev/null || _svc_rc=$?
+        if $stopping; then
+          wait "$pid" 2>/dev/null || true
+          # A run file that does not exec its daemon dies first; wait for the whole group
+          while kill -0 -- "-$pid" 2>/dev/null; do sleep 0.2; done
+          service_pid=
+          return 1
+        fi
+        service_pid=
+      }
       while true; do
         _svc_rc=0
-        "$runfile" || _svc_rc=$?
+        "$runfile" &
+        service_pid=$!
+        wait_for_service || break
         if [ "$_svc_rc" -eq 126 ] && [ -n "${BASHIO_LIB:-}" ]; then
           echo "Direct exec of $runfile failed (rc=126, likely E2BIG), retrying via source..."
           _svc_rc=0
@@ -448,7 +473,9 @@ if $PID1; then
             . "$BASHIO_LIB" 2>/dev/null || true
             # shellcheck disable=SC1090
             . "$runfile"
-          ) || _svc_rc=$?
+          ) &
+          service_pid=$!
+          wait_for_service || break
         fi
         rc=$_svc_rc
         if [ "$rc" -eq 0 ]; then
@@ -461,7 +488,9 @@ if $PID1; then
           break
         fi
         echo -e "\e[38;5;214m$(date) WARNING: $runfile exited (code $rc), restarting (#${restart_count}/${max_restarts}) in 5s...\e[0m"
-        sleep 5
+        sleep 5 &
+        service_pid=$!
+        wait_for_service || break
       done
     ) &
   done

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 143
+- In the repository : 145
 - Installed : 286452
 
 ### Top 3
@@ -329,6 +329,14 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
+✓ ![image](https://api.iconify.design/mdi/magnify.svg) [Degoog](degoog/) : Search aggregator that queries many engines at once, with themes and a plugin store
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fdegoog%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fdegoog%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+
 ✓  [Elasticsearch server](elasticsearch/) : Free and Open, Distributed, RESTful Search Engine
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Felasticsearch%2Fconfig.yaml)
@@ -564,6 +572,16 @@ If you want to do add the repository manually, please follow the procedure highl
 ![amd64][amd64-badge]
 ![ingress][ingress-badge]
 
+✓ ![image](https://api.iconify.design/mdi/notebook-edit.svg) [Joplin Desktop](joplin_desktop/) : Joplin desktop note-taking app accessible via any modern web browser
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjoplin_desktop%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjoplin_desktop%2Fupdater.json)
+![aarch64no][aarch64no-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+![smb][smb-badge]
+![localdisks][localdisks-badge]
+
 ✓  [Joplin Server](joplin/) : Self-hosted open source note-taking application
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjoplin%2Fconfig.yaml)

birdnet-go-dev/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 20261013.1 (13-10-2026)
+
+- Rebuild against the current open PRs of the fork, after fixing two that did not compile: the species-workspace PR called an undefined `isSpectrogramFileFor` (now the shared `specfile` grammar), and the reanalyze PR called `DetectionCache.Flush`, which does not exist (now `Invalidate`). The 20261006 and first 20261013 builds failed on those and were auto-reverted.
+
 ## 20260929.1 (30-09-2026)
 - New `INGRESS_SKIP_AUTH` option (default `false`): when `true`, BirdNET-Go no longer asks for its own login when opened through the Home Assistant sidebar (ingress), since Home Assistant has already signed you in. Direct access on port 8080 still requires the login.
 - Security: the ingress web server now only accepts connections from the Home Assistant Supervisor, as Home Assistant requires.

birdnet-go-dev/config.yaml

@@ -129,5 +129,5 @@ slug: birdnet-go-dev
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
 usb: true
-version: "20260929.1"
+version: "20261013.1"
 video: true

degoog/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 1.1.0 (2026-10-13)
+- Initial release, based on upstream degoog-org/degoog 1.1.0 (changelog : https://github.com/degoog-org/degoog/releases)
+- Home Assistant ingress support, and direct access on port 4444, through a bundled nginx reverse proxy

degoog/Dockerfile

@@ -0,0 +1,119 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#           _.------.
+#       _.-`    ('>.-`"""-.
+# '.--'`       _'`   _ .--.)
+#    -'         '-.-';`   `
+#    ' -      _.'  ``'--.
+#        '---`    .-'""`
+#               /`
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+ARG BUILD_VERSION
+ARG BUILD_UPSTREAM="1.1.0"
+FROM ghcr.io/degoog-org/degoog:${BUILD_UPSTREAM}
+
+##################
+# 2 Modify Image #
+##################
+
+USER root
+
+# No S6_* tuning here : the upstream image is a plain oven/bun alpine image with
+# no s6-overlay, so the vars the other addons set would be read by nobody
+
+##################
+# 3 Install apps #
+##################
+
+# Add rootfs
+# Absolute paths on purpose : the upstream image sets WORKDIR /app, so
+# the relative "find ." used by the other addons would miss /etc entirely
+COPY rootfs/ /
+RUN find /etc/cont-init.d /etc/services.d -type f \( -name "*.sh" -o -name "run" \) -print -exec chmod +x {} \;
+
+# Uses /bin for compatibility purposes
+# hadolint ignore=DL4005
+RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
+    if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
+
+# Modules
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh"
+
+# Automatic modules download
+COPY ha_automodules.sh /ha_automodules.sh
+RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
+
+# Manual apps
+ENV PACKAGES="nginx"
+
+# Automatic apps & bashio
+COPY ha_autoapps.sh /ha_autoapps.sh
+RUN chmod 744 /ha_autoapps.sh && /ha_autoapps.sh "$PACKAGES" && rm /ha_autoapps.sh
+
+################
+# 4 Entrypoint #
+################
+
+# The upstream image ships no s6-overlay, so ha_entrypoint runs as pid 1 : it
+# executes /etc/cont-init.d, then supervises /etc/services.d. It replaces the
+# upstream /entrypoint.sh, whose su-exec start services.d/degoog/run reproduces.
+COPY ha_entrypoint.sh /ha_entrypoint.sh
+RUN chmod 0755 /ha_entrypoint.sh
+ENTRYPOINT ["/ha_entrypoint.sh"]
+
+# Install bashio
+COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
+RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+#################
+# 6 Healthcheck #
+#################
+
+# Goes through nginx on the direct port, which maps / onto the app's base path,
+# so one probe covers both processes
+ENV HEALTH_PORT="4444" \
+    HEALTH_URL="/readyz"
+HEALTHCHECK \
+    --interval=30s \
+    --retries=5 \
+    --start-period=90s \
+    --timeout=25s \
+    CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" >/dev/null 2>&1 || exit 1

degoog/README.md

@@ -0,0 +1,68 @@
+# Home Assistant Add-on: Degoog
+
+Self-hosted search aggregator: one query, results from many search engines, with themes and a
+plugin store.
+
+[Degoog](https://github.com/degoog-org/degoog) works like SearXNG: it sends your search to the
+engines you pick and merges what they return. Engines, plugins, themes and autocomplete
+providers are installed from its built-in store.
+
+## About
+
+- Results from many engines at once, merged into one page
+- Engines, plugins, themes and transports installed from git-based store repositories
+- Bangs, shortcuts, autocomplete and an optional local result indexer
+- Works as your browser's default search engine (OpenSearch)
+
+## Installation
+
+1. Add this repository to Home Assistant.
+2. Install the **Degoog** add-on.
+3. Set `DEGOOG_SETTINGS_PASSWORDS` (see below), then start the add-on.
+4. Open it from the sidebar (ingress), or at `http://homeassistant:4444`.
+5. Go to **Settings → Store** and install at least one search engine: a fresh install has none,
+   so searches return no web results until you do.
+
+## Configuration
+
+| Option | Description |
+|--------|-------------|
+| `DEGOOG_SETTINGS_PASSWORDS` | Password for the settings and admin pages. Several passwords can be given, comma separated. If empty, Degoog generates a new one-off password at every start and prints it in the add-on log. |
+| `PUID` / `PGID` | User Degoog runs as, and owner of its data directory. Defaults to `0` (root). |
+| `TZ` | Timezone, e.g. `Europe/Paris`. |
+| `env_vars` | Extra environment variables passed to Degoog, e.g. `DEGOOG_PUBLIC_INSTANCE` or `DEGOOG_I18N`. See the [upstream list](https://degoog-org.github.io/docs/environment-variables.html) and the [wiki](https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2). |
+
+The add-on sets `DEGOOG_BASE_URL`, `DEGOOG_DATA_DIR`, `DEGOOG_PORT` and `DEGOOG_BIND_ADDRESS`
+itself, and clears `DEGOOG_UNIX_SOCKET`, because ingress, the direct port and the health check
+are built around them: setting them in `env_vars` has no effect.
+
+## Ingress, direct access and search-engine use
+
+Degoog serves every page under a base path. The add-on sets that base path to the Home Assistant
+ingress path, so ingress needs no rewriting, and the bundled nginx maps port `4444` onto the same
+path. As a result, pages opened on port `4444` show an address such as
+`http://homeassistant:4444/api/hassio_ingress/<token>/search?q=...`. That is expected, and the
+short form keeps working too.
+
+To use Degoog as your browser's search engine, use the direct port, not the Home Assistant
+sidebar url, for example `http://homeassistant:4444/search?q=%s`. Ingress urls only work inside
+a logged-in Home Assistant session.
+
+Behind nginx every client appears to Degoog as `127.0.0.1`, so its per-IP rate limits apply to
+all users together. Its bot trap never bans private addresses, so this cannot lock you out. If
+you put the add-on behind your own reverse proxy and want per-client limits, add
+`DEGOOG_DISTRUST_PROXY=0` in `env_vars`. Degoog then trusts the `X-Forwarded-For` header, which
+clients can forge, so only do this when port `4444` is reachable only through your proxy.
+
+## Data
+
+Settings, installed extensions and the index database live in `/config` inside the add-on.
+Home Assistant maps that to this add-on's own configuration directory,
+`/addon_configs/<repository_id>_degoog`, and it is included in add-on backups. It is the
+equivalent of the upstream `./data:/app/data` compose volume, so the contents of an existing
+`data` folder can be copied in as is.
+
+## Support
+
+- [Degoog upstream project](https://github.com/degoog-org/degoog)
+- [Add-on repository issues](https://github.com/alexbelgium/hassio-addons/issues)

degoog/apparmor.txt

@@ -0,0 +1,66 @@
+
+#include <tunables/global>
+
+profile degoog_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# Entrypoint stack
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /tmp/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explicit allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

degoog/build.json

@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "ghcr.io/degoog-org/degoog:latest",
+    "amd64": "ghcr.io/degoog-org/degoog:latest"
+  }
+}

degoog/config.yaml

@@ -0,0 +1,32 @@
+arch:
+  - aarch64
+  - amd64
+description:
+  Search aggregator that queries many engines at once, with themes and a
+  plugin store
+image: ghcr.io/alexbelgium/degoog-{arch}
+ingress: true
+init: false
+map:
+  - addon_config:rw
+name: Degoog
+options:
+  env_vars: []
+  PGID: 0
+  PUID: 0
+panel_icon: mdi:magnify
+ports:
+  4444/tcp: 4444
+ports_description:
+  4444/tcp: Web interface
+schema:
+  DEGOOG_SETTINGS_PASSWORDS: password?
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  PGID: int
+  PUID: int
+  TZ: str?
+slug: degoog
+url: https://github.com/alexbelgium/hassio-addons/tree/master/degoog
+version: "1.1.0"

degoog/rootfs/etc/cont-init.d/20-config_location.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+# Degoog keeps its settings, plugins, themes, engines and sqlite indexer in its
+# data directory. services.d/degoog/run points DEGOOG_DATA_DIR at /config, the
+# addon_config mount, which matches the upstream compose file's
+# "./data:/app/data" volume : an existing data folder can be copied in as is.
+bashio::log.info "Data stored in /config"
+
+# Recursive, like the upstream entrypoint does for /app/data : plugins and
+# themes are installed by the app itself, so a PUID change must hand them over
+# too. Numbered 20- so it sorts after 00-global_var.sh, which exports PUID/PGID.
+chown -R "${PUID:-0}:${PGID:-0}" /config

degoog/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+#################
+# NGINX SETTING #
+#################
+declare ingress_interface
+declare ingress_port
+declare ingress_entry
+
+ingress_port=$(bashio::addon.ingress_port)
+ingress_interface=$(bashio::addon.ip_address)
+ingress_entry=$(bashio::addon.ingress_entry)
+sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf
+sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf
+sed -i "s|%%ingress_entry%%|${ingress_entry}|g" /etc/nginx/servers/ingress.conf

degoog/rootfs/etc/nginx/includes/mime.types

@@ -0,0 +1,96 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

degoog/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,48 @@
+
+# Run nginx in foreground.
+daemon off;
+
+# This is run inside Docker.
+user root;
+
+# Pid storage location.
+pid /var/run/nginx.pid;
+
+# Set number of worker processes.
+worker_processes 1;
+
+# Enables the use of JIT for regular expressions to speed-up their processing.
+pcre_jit on;
+
+# Write error log to Hass.io add-on log.
+error_log /proc/1/fd/1 error;
+
+# Load dynamic modules.
+include /etc/nginx/modules-enabled/*.conf;
+
+# Max num of simultaneous connections by a worker process.
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/includes/mime.types;
+
+    # No access log : request lines carry every search query
+    access_log              off;
+    client_max_body_size    4G;
+    default_type            application/octet-stream;
+    gzip                    on;
+    keepalive_timeout       65;
+    sendfile                on;
+    server_tokens           off;
+    tcp_nodelay             on;
+    tcp_nopush              on;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    include /etc/nginx/servers/*.conf;
+}

degoog/rootfs/etc/nginx/servers/ingress.conf

@@ -0,0 +1,50 @@
+server {
+    # Ingress, and the direct port. Both are served the same way : Degoog runs
+    # with its base path set to the ingress entry (services.d/degoog/run), and
+    # Home Assistant strips that entry before forwarding, so it is put back here.
+    listen %%interface%%:%%port%% default_server;
+    listen 4444 default_server;
+
+    client_max_body_size 0;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    # Search results are sent to the page as server-sent events
+    proxy_buffering off;
+    proxy_read_timeout 30m;
+    proxy_send_timeout 30m;
+
+    # The one url upstream builds without its base path
+    # (src/server/routes/pages/render.tsx)
+    proxy_set_header Accept-Encoding "";
+    sub_filter 'src="/public/t.js' 'src="%%ingress_entry%%/public/t.js';
+
+    # Degoog answers <entry>/ with a redirect to the slashless <entry>, which
+    # Home Assistant does not route : ask for the slashless form directly.
+    location = / {
+        proxy_pass http://127.0.0.1:4445%%ingress_entry%%;
+    }
+
+    # Links in the pages already carry the entry ; only the direct port sees
+    # them, since ingress strips it. No trailing slash, so the bare entry
+    # (the target of Degoog's own trailing-slash redirect) matches too.
+    location %%ingress_entry%% {
+        proxy_pass http://127.0.0.1:4445;
+    }
+
+    # Transport websockets are the only routes upstream mounts outside its base
+    # path (src/server/index.ts)
+    location /ws/ {
+        proxy_pass http://127.0.0.1:4445;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:4445%%ingress_entry%%/;
+    }
+}

degoog/rootfs/etc/services.d/degoog/run

@@ -0,0 +1,24 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+# Every route Degoog serves, and every url it generates, lives under
+# DEGOOG_BASE_URL. Setting it to the ingress entry makes the pages correct under
+# ingress as they are ; nginx maps the direct port onto the same path.
+# The listener is forced because nginx and the healthcheck are built around it.
+DEGOOG_BASE_URL="$(bashio::addon.ingress_entry)"
+export DEGOOG_BASE_URL
+export DEGOOG_DATA_DIR=/config
+export DEGOOG_PORT=4445
+export DEGOOG_BIND_ADDRESS=127.0.0.1
+unset DEGOOG_UNIX_SOCKET
+
+# Started here rather than through the upstream /entrypoint.sh : 00-global_var.sh
+# injects the env_vars option right after that script's shebang, which would put
+# a user's DEGOOG_PORT or DEGOOG_DATA_DIR back over the values above. The same
+# block lands at the top of this file, before them. The entrypoint's only other
+# work is a chown of /app/data, which is unused here (20-config_location.sh).
+bashio::log.info "Starting Degoog..."
+cd /app
+exec su-exec "${PUID:-0}:${PGID:-0}" bun run src/server/index.ts

degoog/rootfs/etc/services.d/nginx/run

@@ -0,0 +1,7 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+bashio::log.info "Starting NGinx..."
+exec nginx

degoog/updater.json

@@ -0,0 +1,10 @@
+{
+  "github_beta": "false",
+  "github_fulltag": false,
+  "last_update": "2026-10-13",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "degoog",
+  "source": "github",
+  "upstream_repo": "degoog-org/degoog",
+  "upstream_version": "1.1.0"
+}

joplin/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 3.7.2.1 (2026-10-13)
+
+- Add optional SSL: set `ssl: true` with `certfile`/`keyfile` from /ssl to serve the web interface over https on port 22300 (#3114)
+
 ## 3.7.2 (2026-09-12)
 - Update to latest version from etechonomy/joplin-server (changelog : https://github.com/etechonomy/joplin-server/releases)
 

joplin/Dockerfile

@@ -56,7 +56,7 @@ COPY ha_automodules.sh /ha_automodules.sh
 RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
 
 # Manual apps
-ENV PACKAGES="procps sqlite3 postgresql-client"
+ENV PACKAGES="procps sqlite3 postgresql-client nginx"
 
 # Automatic apps & bashio
 COPY ha_autoapps.sh /ha_autoapps.sh

joplin/README.md

@@ -46,6 +46,9 @@ Webui can be found at `<your-ip>:22300`.
 |--------|------|---------|-------------|
 | `APP_BASE_URL` | str | `http://your_domain:port` | Base public URL where the service will be running |
 | `data_location` | str | `/config/addons_config/joplin` | Path where Joplin data is stored |
+| `ssl` | bool | `false` | Serve the web interface over https on port 22300 |
+| `certfile` | str | `fullchain.pem` | Certificate file in `/ssl` (used when `ssl` is true) |
+| `keyfile` | str | `privkey.pem` | Private key file in `/ssl` (used when `ssl` is true) |
 | `DB_CLIENT` | str | | Database client type. Only `pg` (PostgreSQL) is supported. MariaDB/MySQL is NOT supported. |
 | `POSTGRES_HOST` | str | | PostgreSQL server hostname |
 | `POSTGRES_PORT` | int | | PostgreSQL server port |
@@ -82,6 +85,15 @@ MAILER_NOREPLY_NAME: "Joplin Server"
 MAILER_NOREPLY_EMAIL: "noreply@yourdomain.com"
 ```
 
+### HTTPS
+
+Joplin Server only accepts requests whose host (and port) match `APP_BASE_URL` exactly. To reach it securely from outside:
+
+1. Put your certificate and key in `/ssl` (the DuckDNS and Let's Encrypt add-ons already write `fullchain.pem` and `privkey.pem` there).
+2. Set `ssl: true` (and `certfile`/`keyfile` if your files have other names).
+3. Set `APP_BASE_URL` to the exact URL you will type, for example `https://yourname.duckdns.org:22300`.
+4. Forward port 22300 on your router to Home Assistant, restart the add-on, and use that same URL in browsers and in the Joplin clients. Use it on your LAN too: if that fails at home, your router lacks hairpin NAT, so add a local DNS entry pointing the domain to your Home Assistant IP.
+
 ### Database Setup
 
 Joplin Server uses SQLite by default, but for production use, PostgreSQL is recommended.

joplin/config.yaml

@@ -70,11 +70,15 @@ image: ghcr.io/alexbelgium/joplin-{arch}
 map:
   - config:rw
   - share:rw
+  - ssl
 name: Joplin Server
 options:
   env_vars: []
   APP_BASE_URL: http://your_domain:port
+  certfile: fullchain.pem
   data_location: /config/addons_config/joplin
+  keyfile: privkey.pem
+  ssl: false
 ports:
   22300/tcp: 22300
 ports_description:
@@ -100,9 +104,12 @@ schema:
   POSTGRES_PASSWORD: str?
   POSTGRES_PORT: int?
   POSTGRES_USER: str?
+  certfile: str?
   data_location: str?
+  keyfile: str?
+  ssl: bool?
 slug: joplin
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "3.7.2"
+version: "3.7.2.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:22300]"

joplin/rootfs/etc/cont-init.d/99-run.sh

@@ -141,6 +141,20 @@ bashio::config.has_value 'MAILER_ENABLED' && export MAILER_ENABLED="$(bashio::co
 export APP_BASE_URL="$(bashio::config 'APP_BASE_URL')"
 export ALLOWED_HOSTS="*"
 
+# -------------------
+# SSL
+# -------------------
+if bashio::config.true 'ssl'; then
+    bashio::config.require.ssl
+    sed -i "s|%%certfile%%|$(bashio::config 'certfile')|g" /etc/nginx/joplin.conf
+    sed -i "s|%%keyfile%%|$(bashio::config 'keyfile')|g" /etc/nginx/joplin.conf
+    # nginx terminates TLS on 22300 and proxies to Joplin on 22301
+    export APP_PORT=22301
+    nginx -c /etc/nginx/joplin.conf -t -q || bashio::exit.nok "Invalid ssl certificate or key, check certfile and keyfile"
+    nginx -c /etc/nginx/joplin.conf &
+    bashio::log.info "Ssl enabled, please use https for connection"
+fi
+
 bashio::log.info 'Starting Joplin. Initial user is "admin@localhost" with password "admin"'
 
 cd /home/joplin || exit 1

joplin/rootfs/etc/nginx/joplin.conf

@@ -0,0 +1,42 @@
+# TLS front-end for Joplin, only started when ssl is enabled.
+# Run nginx in foreground.
+daemon off;
+worker_processes auto;
+
+# Write error log to Hass.io add-on log.
+error_log /proc/1/fd/1 error;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    access_log off;
+    server_tokens off;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        listen 22300 ssl;
+        client_max_body_size 0;
+
+        ssl_certificate /ssl/%%certfile%%;
+        ssl_certificate_key /ssl/%%keyfile%%;
+
+        location / {
+            proxy_pass http://127.0.0.1:22301;
+            proxy_http_version 1.1;
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+    }
+}

joplin_desktop/CHANGELOG.md

@@ -1,4 +1,7 @@
 
+## 3.7.21.1 (2026-10-11)
+- Fix Joplin not opening ("An error occurred: Unknown flag: --disable-dev-shm-usage"): Joplin only accepts its own list of command-line flags, so the extra Chromium flag added in 3.7.21 is removed
+
 ## 3.7.21 (2026-10-11)
 - Initial release: Joplin desktop streamed to the browser with Selkies, based on linuxserver/docker-joplin (amd64 only, as Joplin publishes no Linux arm64 build)
 - Shares the Selkies startup scripts with the webtop and claude_desktop add-ons (data location, GPU permissions, ingress, SSL)

joplin_desktop/config.yaml

@@ -103,5 +103,5 @@ schema:
 slug: joplin_desktop
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/joplin_desktop
-version: "3.7.21"
+version: "3.7.21.1"
 video: true