docs(mealie): drop wrong env_vars advice from changelog

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/references/traps.md

@@ -16,6 +16,7 @@ workflows and lint rules — that is not repeated here.
 - [Versioning](#versioning)
 - [Chromium / Electron under Xvfb](#chromium--electron-under-xvfb)
 - [CI and review bots](#ci-and-review-bots)
+- [Logging in as the Home Assistant user](#logging-in-as-the-home-assistant-user)
 
 ---
 
@@ -353,3 +354,19 @@ not because the config exempts them — don't cite the config as a reason to ign
 **Separate new lint findings from pre-existing ones** by linting the same file at `origin/master`
 and diffing the result sets — otherwise you chase warnings that were already there.
 `scripts/validate.sh --vs-master` does this.
+
+## Logging in as the Home Assistant user
+
+An app that trusts `X-Remote-User-Name` (the Supervisor sets it on every ingress request) lets
+anyone who can reach the app log in as any user, admins included, unless every path except
+Supervisor ingress is closed. Stripping the header on the published port is not enough. Two
+other paths remain:
+
+- **The app's own port.** It is usually bound to `0.0.0.0`, so any container on the hassio
+  network reaches it without going through nginx.
+- **The ingress listener.** It listens on the add-on IP, which every other add-on can reach.
+
+Restrict the ingress server to `allow 172.30.32.2; deny all;`. If the app supports a proxy
+secret, have only `ingress.conf` send a per-boot one; that covers the app's port and the
+published port with no rebinding. Codex caught both remaining paths on mealie #3151 after a
+9090-only header strip. `calibre_web` and `guacamole` predate this lesson.

mealie/CHANGELOG.md

@@ -1,4 +1,9 @@
  
+## v3.29.0.1 (2026-10-25)
+- New option `login_with_ha_user` (on by default): the Ingress panel logs in as the Mealie user matching your Home Assistant username, through Mealie's reverse proxy auth. Unmatched users get the normal login page
+- Only the ingress server can use it: it sends Mealie a per-boot shared secret (`REVERSE_PROXY_AUTH_SECRET`), and the ingress listener now accepts only the Supervisor
+- Reverse proxy auth through the direct web port is no longer possible: a proxy you run in front of port 9090 cannot send the per-boot secret
+
 ## v3.29.0 (2026-10-24)
 - README: document logging in with the Home Assistant user through Ingress (reverse proxy auth)
 - Fix build: the v3.29.0 frontend imports locale files from the backend tree, so clone and build inside the full repository

mealie/README.md

@@ -57,6 +57,7 @@ Configurations can be done through the app webUI, except for the following optio
 | `BASE_URL` | str | | Optional external base URL |
 | `DATA_DIR` | str | `/config` | Data directory path |
 | `ALLOW_SIGNUP` | bool | `true` | Allow new user signup |
+| `login_with_ha_user` | bool | `true` | Log in through Ingress as your Home Assistant username |
 
 To configure Gunicorn's `--forwarded-allow-ips` setting for trusted reverse proxies, manually add a `FORWARDED_ALLOW_IPS` entry to your add-on configuration (comma-separated IPs). It is optional and hidden from the default options tab. For example: `FORWARDED_ALLOW_IPS: "192.168.1.1,10.0.0.1"`
 
@@ -84,26 +85,15 @@ You can add environment variables by creating `/homeassistant/addons_config/xxx-
 
 The complete list of options can be found here: https://nightly.mealie.io/documentation/getting-started/installation/backend-config/
 
-### Log in with your Home Assistant user (reverse proxy auth)
+### Log in with your Home Assistant user
 
-Since Mealie v3.29.0, the Ingress panel can sign you in automatically with your Home Assistant user. Home Assistant Ingress sends the logged-in user's name in the `X-Remote-User-Name` header; add these entries to the `env_vars` option:
+With `login_with_ha_user` (on by default), the Ingress panel signs you in automatically as the Mealie user whose username matches your Home Assistant username. It uses Mealie's [reverse proxy auth](https://mealie.io/documentation/getting-started/installation/backend-config/#reverse-proxy-auth) with the `X-Remote-User-Name` header that Home Assistant Ingress sends.
 
-```yaml
-env_vars:
-  - name: REVERSE_PROXY_AUTH_ENABLED
-    value: "true"
-  - name: REVERSE_PROXY_AUTH_HEADER
-    value: X-Remote-User-Name
-```
-
-A Mealie user with the same username as your Home Assistant user must already exist. To create it automatically instead, add one more entry:
-
-```yaml
-  - name: REVERSE_PROXY_AUTH_SIGNUP_ENABLED
-    value: "true"
-```
-
-Warning: Mealie trusts this header completely, and the direct web port (9090 by default) forwards it unchanged. Anyone who can reach that port could log in as any user, including an admin. When enabling this, disable the port in the add-on's Network section and use Ingress only. The REST sensor and camera examples below use that direct port, so they will not work once it is disabled. See the [upstream documentation](https://mealie.io/documentation/getting-started/installation/backend-config/#reverse-proxy-auth).
+- If no Mealie user has that username, the normal login page is shown. To create the user automatically instead, add `REVERSE_PROXY_AUTH_SIGNUP_ENABLED` with value `true` to the `env_vars` option.
+- Matching ignores case, and also accepts the Mealie user's email.
+- Any Home Assistant user who can open the panel gets the matching Mealie account, admins included.
+- Only Ingress can log in this way: it sends Mealie a secret generated at each start, so requests through the direct web port (9090 by default) always get the normal Mealie login.
+- Set `login_with_ha_user: false` to turn it off.
 
 ## Integration with HA
 

mealie/config.yaml

@@ -85,6 +85,7 @@ map:
 name: Mealie
 options:
   env_vars: []
+  login_with_ha_user: true
   ALLOW_SIGNUP: true
   DATA_DIR: /config
   PGID: 1000
@@ -104,6 +105,7 @@ schema:
       value: str?
   ALLOW_SIGNUP: bool
   FORWARDED_ALLOW_IPS: str?
+  login_with_ha_user: bool?
   BASE_URL: str?
   DATA_DIR: str?
   PGID: int
@@ -114,4 +116,4 @@ schema:
 slug: mealie
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "v3.29.0"
+version: "v3.29.0.1"

mealie/rootfs/etc/nginx/servers/ingress.conf

@@ -3,6 +3,10 @@
     include /etc/nginx/includes/server_params.conf;
     include /etc/nginx/includes/proxy_params.conf;
 
+    # Only the Supervisor may reach ingress: it sets the X-Remote-User-Name header Mealie trusts
+    allow 172.30.32.2;
+    deny all;
+
     # https://emby.media/community/index.php?/topic/104238-playback-error-no-compatible-streams-are-currently-available/&do=findComment&comment=1097946
     proxy_buffering off;
     gzip_static off;
@@ -22,6 +26,7 @@
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Mealie-Reverse-Proxy-Secret "%%proxy_auth_secret%%";
       proxy_set_header Accept-Encoding "";
       proxy_read_timeout 90;
       add_header X-Frame-Options "SAMEORIGIN";

mealie/rootfs/run.txt

@@ -118,6 +118,22 @@ if bashio::config.has_value "FORWARDED_ALLOW_IPS"; then
     bashio::log.info "Configured FORWARDED_ALLOW_IPS for Gunicorn"
 fi
 
+# Log in through Ingress as the Home Assistant user: the Supervisor sends its username with every
+# ingress request (X-Remote-User-Name). Mealie only trusts it with a per-boot secret that only the
+# ingress nginx server sends, so the direct ports cannot spoof it. No Mealie user with that name
+# leaves the normal login page.
+proxy_auth_secret=""
+if bashio::config.false "login_with_ha_user"; then
+    export REVERSE_PROXY_AUTH_ENABLED=false
+else
+    proxy_auth_secret="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
+    export REVERSE_PROXY_AUTH_ENABLED=true
+    export REVERSE_PROXY_AUTH_HEADER=X-Remote-User-Name
+    export REVERSE_PROXY_AUTH_SECRET="$proxy_auth_secret"
+    bashio::log.info "Ingress logs in as the Home Assistant username"
+fi
+sed -i "s|%%proxy_auth_secret%%|${proxy_auth_secret}|g" /etc/nginx/servers/ingress.conf
+
 # Unset allow_signup
 
 if bashio::config.false "ALLOW_SIGNUP"; then