Updater bot : openproject updated to 17.7.2 (upstream 17.7.2)

A single failing matrix leg in the builder reverts the entire push, so any
transient error inside a build silently undoes a good version bump.

Observed on zoneminder 1.38.4 (run 31678876409, attempt 1): the aarch64 leg
failed after 44 s inside the ha_autoapps.sh layer with

  curl: (92) HTTP/2 stream 1 was not closed cleanly: REFUSED_STREAM (err 7)
  gzip: stdin: unexpected end of file
  tar: Error is not recoverable: exiting now

while the amd64 leg built and pushed 1.38.4 to GHCR. revert-on-failure then
pushed 0ee26fc72 reverting the bump; a manual re-run of the same source went
fully green. Because that re-run flips the run conclusion to success, these
incidents do not even show up in run-conclusion statistics.

The build-image step is now run tolerantly (continue-on-error) and repeated
once when the first attempt fails. Only a second failure reaches
revert-on-failure, so genuinely broken add-ons are still reverted, one build
later than before.

The retry is unconditional rather than gated on the log text looking
transient: BuildKit reformats error strings and registry/runner failures
spell themselves many different ways, so a text classifier would eventually
stop reverting real breakage. It is also cheap - the add-ons that fail
deterministically on every push (ente, comixed, binance-trading-bot) each
fail in 16-34 s.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/SKILL.md

@@ -11,6 +11,16 @@ description: >-
 
 # Home Assistant add-on workflow
 
+**Answer style.** Chat replies are terse: no pleasantries, no tool-call narration, no decorative
+tables or emoji, no dumped logs — quote the shortest decisive line, and don't re-read or re-print
+what is already in context. Fragments and dropped articles are fine. Never compressed: uncertainty
+markers ("likely", "assumed", "not verified"), negations (`not`/`never`/`no`/`only`), numbers,
+units, technical terms, code blocks, error strings — step 9's Verified/Checked/Assumed distinction
+outranks brevity every time. Write in full prose, not fragments, for security warnings,
+irreversible-action confirmations, and any multi-step sequence a fragment could make ambiguous.
+Persisted text is prose too: commits, CHANGELOG entries, PR bodies, review-thread replies, the
+step 10 report.
+
 Triage first, then one of two paths:
 
 - **Light** — typo/doc fixes, CHANGELOG edits, version bumps, one-file edits at ladder levels

.github/addon_submitters.json

@@ -1,5 +1,6 @@
 {
   "aurral": "petruknw",
+  "bentopdf": "ToledoEM",
   "cleanuparr": "PierreNa",
   "gitea": "baldarn",
   "kometa": "akrigator",
@@ -8,7 +9,10 @@
   "manyfold": "ToledoEM",
   "navidrome": "baldarn",
   "netalertx": "jokob-sk",
-  "nginx proxy manager": "ToledoEM",
+  "nginx_webserver_proxy": "ToledoEM",
+  "obsidian_syncserver_npm": "ToledoEM",
+  "obsidian_syncserver_solo": "ToledoEM",
+  "obsidian_syncserver_ssl": "ToledoEM",
   "openproject": "baldarn",
   "resiliosync": "tyjtyj",
   "spotweb": "woutercoppens",

.github/workflows/onpr_check-pr.yaml

@@ -91,7 +91,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: 🔎 Run Home Assistant Add-on Lint
-        uses: frenck/action-addon-linter@f6bef06a4cee6c67924b0a70be643aacb8500a43
+        uses: frenck/action-addon-linter@v2
         with:
           path: "./${{ matrix.addon }}"
 
@@ -193,15 +193,15 @@ jobs:
 
       - name: 💽 Create addon build-args
         id: build_args
-        shell: bash
         run: |
-          {
-            echo "armhf=BUILD_FROM=$(jq -r .build_from.armhf // empty ${{ steps.information.outputs.build }})"
-            echo "armv7=BUILD_FROM=$(jq -r .build_from.armv7 // empty ${{ steps.information.outputs.build }})"
-            echo "aarch64=BUILD_FROM=$(jq -r .build_from.aarch64 // empty ${{ steps.information.outputs.build }})"
-            echo "amd64=BUILD_FROM=$(jq -r .build_from.amd64 // empty ${{ steps.information.outputs.build }})"
-            echo "i386=BUILD_FROM=$(jq -r .build_from.i386 // empty ${{ steps.information.outputs.build }})"
-          } >> "$GITHUB_OUTPUT"
+          build_file="${{ steps.information.outputs.build }}"
+          case "$build_file" in
+            *.yaml|*.yml) build_json="$(yq -o=json '.' "$build_file")" ;;
+            *)            build_json="$(cat "$build_file")" ;;
+          esac
+          for arch in armhf armv7 aarch64 amd64 i386; do
+            echo "${arch}=BUILD_FROM=$(printf '%s' "$build_json" | jq -r --arg a "$arch" '.build_from[$a] // empty')"
+          done >> "$GITHUB_OUTPUT"
 
       - name: 🏗️ Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/onpush_builder.yaml

@@ -114,7 +114,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
       - name: Run Home Assistant Add-on Lint
-        uses: frenck/action-addon-linter@f6bef06a4cee6c67924b0a70be643aacb8500a43
+        uses: frenck/action-addon-linter@v2
         with:
           path: "./${{ matrix.addon }}"
 
@@ -285,8 +285,52 @@ jobs:
             echo "${{ matrix.arch }} is not a valid architecture for ${{ matrix.addon }}, skipping build."
           fi
 
+      # A single failing leg here auto-reverts the whole push (revert-on-failure
+      # below), so a transient error inside the build - a truncated download in
+      # a RUN layer, a registry hiccup - silently undoes a perfectly good
+      # version bump. Seen on zoneminder 1.38.4 (run 31678876409): the aarch64
+      # leg died on "curl: (92) HTTP/2 stream 1 was not closed cleanly:
+      # REFUSED_STREAM", the commit was reverted, and a manual re-run of the
+      # identical source then went green. (A lost runner or a cancelled job is
+      # not covered by this - no later step gets to run at all.)
+      #
+      # So: build once tolerantly, and only let a second failure reach the
+      # revert. A genuinely broken add-on fails twice and is still reverted,
+      # one build later. Retrying is unconditional rather than gated on the
+      # log text looking "transient" - BuildKit reformats error strings and
+      # registry/runner failures spell themselves a dozen ways, so classifying
+      # by log text would silently stop reverting real breakage. It is also
+      # cheap: the add-ons that fail deterministically on every push each fail
+      # in 16-34 s.
       - name: Build ${{ matrix.addon }} add-on
+        id: build
         if: steps.info.outputs.build_arch == 'true' && steps.info.outputs.has_dockerfile == 'true'
+        continue-on-error: true
+        uses: home-assistant/builder/actions/build-image@2026.06.0
+        with:
+          arch: ${{ matrix.arch }}
+          cache-gha: "false"
+          cache-gha-scope: ${{ matrix.addon }}-${{ matrix.arch }}
+          context: ./${{ matrix.addon }}
+          file: ${{ steps.info.outputs.dockerfile }}
+          image: ${{ steps.info.outputs.image }}
+          image-tags: |
+            ${{ steps.info.outputs.version }}
+            latest
+          version: ${{ steps.info.outputs.version }}
+          push: "true"
+          cosign: "false"
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+          labels: ${{ steps.info.outputs.labels }}
+          build-args: ${{ steps.info.outputs.build_args }}
+
+      # Keep these inputs identical to the first attempt above - this step is
+      # that attempt, run a second time, and nothing else. There is deliberately
+      # no pause in between: re-running the earlier layers already spaces the
+      # two network windows apart, and a sleep step would only add somewhere
+      # else for the retry to be skipped from.
+      - name: Build ${{ matrix.addon }} add-on (retry after failed attempt)
+        if: steps.build.outcome == 'failure'
         uses: home-assistant/builder/actions/build-image@2026.06.0
         with:
           arch: ${{ matrix.arch }}

.templates/ha_entrypoint.sh

@@ -173,9 +173,13 @@ fi
 ####################################
 
 BASHIO_LIB=""
+BASHIO_LIB_FULL=false
 for f in /usr/lib/bashio/bashio.sh /usr/lib/bashio/lib.sh /usr/src/bashio/bashio.sh /usr/local/lib/bashio/bashio.sh; do
   if [ -f "$f" ]; then
     BASHIO_LIB="$f"
+    # The real library, which talks to the Supervisor. The standalone shim below only reads
+    # environment variables, which matters to wait_for_supervisor().
+    BASHIO_LIB_FULL=true
     break
   fi
 done
@@ -188,6 +192,83 @@ if [ -z "$BASHIO_LIB" ]; then
   done
 fi
 
+##############################
+# Wait for the Supervisor API #
+##############################
+
+# Many cont-init scripts build their nginx ingress config out of bashio::addon.ip_address and
+# bashio::addon.ingress_port. Both come from one GET /addons/self/info, and when that is answered
+# before the Supervisor is ready bashio prints nothing: the add-on then either writes
+# "listen : default_server;" -- which nginx rejects with `invalid port in ":"` -- or aborts under
+# set -e and leaves the %%port%% placeholders in place. Either way the add-on cannot serve ingress.
+# Ask for the same values here, through the same bashio calls, until they come back usable --
+# rather than making 48 add-ons defend themselves against the same empty answer.
+#
+# Going through bashio rather than curl is what makes this reliable rather than merely likely:
+# bashio caches a successful /addons/self/info under ${CACHE_DIR:-/tmp/.bashio}, so once this
+# returns, every later bashio::addon.* call in every cont-init script reads that file instead of
+# asking the Supervisor again. A probe that only proved the API was up a moment ago would leave
+# the very next call free to fail.
+#
+# Bounded and never fatal: an add-on with no SUPERVISOR_TOKEN, or a Supervisor that stays
+# unreachable, still has to start. HA_SUPERVISOR_WAIT (seconds, default 30) sets the ceiling; 0
+# skips the wait. When the Supervisor is already up -- the normal case -- this costs one request.
+
+wait_for_supervisor() {
+  local max="${HA_SUPERVISOR_WAIT:-30}"
+  local started deadline remaining attempt announced=0
+
+  # Nothing to wait for without a token. The standalone shim is excluded too: it answers these
+  # calls from environment variables and never contacts the Supervisor, so it can never satisfy
+  # the probe and would burn the whole ceiling on every boot.
+  [ -n "${SUPERVISOR_TOKEN:-}" ] || return 0
+  [ "${BASHIO_LIB_FULL:-false}" = "true" ] || return 0
+  # bashio's own curl carries no --max-time, so each attempt is bounded from the outside.
+  command -v timeout >/dev/null 2>&1 || return 0
+  # Digits only, then forced to base 10: `test -gt` accepts a zero-padded override like 08, but
+  # arithmetic expansion reads it as octal and fails, which would leave the deadline empty and
+  # spin the loop below forever.
+  case "$max" in '' | *[!0-9]*) return 0 ;; esac
+  max=$((10#$max))
+  [ "$max" -gt 0 ] || return 0
+
+  started=$SECONDS
+  deadline=$((started + max))
+
+  while :; do
+    remaining=$((deadline - SECONDS))
+    if [ "$remaining" -le 0 ]; then
+      echo -e "\e[38;5;214m$(date) WARNING: Supervisor API did not report this add-on's network details within ${max}s, continuing anyway\e[0m"
+      return 0
+    fi
+
+    # No single attempt may outlive the ceiling it is bounded by.
+    attempt=5
+    [ "$remaining" -lt "$attempt" ] && attempt="$remaining"
+
+    # One call is enough to settle all of them: bashio fetches the whole /addons/self/info object
+    # and caches it, so a populated ip_address means ingress_port and the rest are cached too.
+    # Run in a child shell so bashio's globals and traps stay out of the entrypoint; its own error
+    # logging is dropped because a failed attempt here is expected, not news.
+    # shellcheck disable=SC2016
+    if timeout "$attempt" bash -c '. "$1" && [ -n "$(bashio::addon.ip_address)" ]' \
+      _ "$BASHIO_LIB" >/dev/null 2>&1; then
+      [ "$announced" -eq 0 ] || echo "Supervisor API ready after $((SECONDS - started))s"
+      return 0
+    fi
+
+    if [ "$announced" -eq 0 ]; then
+      echo "Waiting for the Supervisor API to report this add-on's network details..."
+      announced=1
+    fi
+
+    # Skipped when the attempt already consumed what was left, so the sleep cannot overshoot.
+    [ "$((deadline - SECONDS))" -gt 0 ] && sleep 1
+  done
+}
+
+wait_for_supervisor
+
 ####################
 # Starting scripts #
 ####################

COMMUNITY_SUBMITTED_ADDONS.md

@@ -8,6 +8,7 @@ When an issue mentions one of these add-ons (in the title or body), a GitHub Act
 
 | Add-on folder | Initial submitter |
 | --- | --- |
+| `bentopdf` | [@ToledoEM](https://github.com/ToledoEM) |
 | `emby` | [@petersendev](https://github.com/petersendev) |
 | `gitea` | [@baldarn](https://github.com/baldarn) |
 | `kometa` | [@akrigator](https://github.com/akrigator) |
@@ -15,6 +16,10 @@ When an issue mentions one of these add-ons (in the title or body), a GitHub Act
 | `manyfold` | [@ToledoEM](https://github.com/ToledoEM) |
 | `navidrome` | [@baldarn](https://github.com/baldarn) |
 | `netalertx` | [@jokob-sk](https://github.com/jokob-sk) |
+| `nginx_webserver_proxy` | [@ToledoEM](https://github.com/ToledoEM) |
+| `obsidian_syncserver_npm` | [@ToledoEM](https://github.com/ToledoEM) |
+| `obsidian_syncserver_solo` | [@ToledoEM](https://github.com/ToledoEM) |
+| `obsidian_syncserver_ssl` | [@ToledoEM](https://github.com/ToledoEM) |
 | `openproject` | [@baldarn](https://github.com/baldarn) |
 | `resiliosync` | [@tyjtyj](https://github.com/tyjtyj) |
 | `spotweb` | [@woutercoppens](https://github.com/woutercoppens) |

README.md

@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 137
+- In the repository : 141
 - Installed : 325872
 
 ### Top 3
@@ -567,6 +567,16 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
+✓ ![image](https://api.iconify.design/mdi/book-open-page-variant.svg) [Komga](komga/) : Free and open source comics/mangas media server
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fkomga%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fkomga%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+![smb][smb-badge]
+![localdisks][localdisks-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/speedometer.svg) [LibreSpeed](librespeed/) : A very lightweight speed test implemented in Javascript, using XMLHttpRequest and Web Workers
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Flibrespeed%2Fconfig.yaml)
@@ -708,6 +718,27 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
+✓  [Obsidian Sync Server](obsidian_syncserver_solo/) : Self-hosted Obsidian LiveSync backend on CouchDB. Plain HTTP — put your own reverse proxy in front for TLS.
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_solo%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_solo%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
+✓  [Obsidian Sync Server NPM](obsidian_syncserver_npm/) : Self-hosted Obsidian LiveSync backend on CouchDB, bundled with Nginx Proxy Manager for TLS and certificate management.
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_npm%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_npm%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
+✓  [Obsidian Sync Server SSL](obsidian_syncserver_ssl/) : Self-hosted Obsidian LiveSync backend on CouchDB, serving HTTPS with your own certificates from /ssl. Supports mobile Obsidian.
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_ssl%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_ssl%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
 ✓  [Omada (obsolete)](zzz_archived_omada/) : TP-Link Omada Controller (obsolete, use https://github.com/jkunczik/home-assistant-omada)
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fzzz_archived_omada%2Fconfig.yaml)

aurral/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.4.0 (2026-08-13)
+- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
+ 
 ## 2.1.0 (2026-08-08)
 - Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
  

aurral/config.yaml

@@ -1,5 +1,5 @@
 name: Aurral
-version: "2.1.0"
+version: "2.4.0"
 slug: aurral
 description: >-
   Self-hosted music discovery, request management, flows, and playlist

aurral/updater.json

@@ -1,9 +1,9 @@
 {
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "aurral",
   "source": "github",
   "upstream_repo": "lklynet/aurral",
-  "upstream_version": "2.1.0",
+  "upstream_version": "2.4.0",
   "github_beta": false
 }

birdnet-pipy/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 0.8.6 (2026-08-13)
+- Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
+ 
 ## 0.8.5 (2026-08-01)
 - Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
  

birdnet-pipy/config.yaml

@@ -96,4 +96,4 @@ schema:
   ssl: bool?
 slug: birdnet-pipy
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
-version: "0.8.5"
+version: "0.8.6"

birdnet-pipy/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-01",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "birdnet-pipy",
   "source": "github",
   "upstream_repo": "Suncuss/BirdNET-PiPy",
-  "upstream_version": "0.8.5"
+  "upstream_version": "0.8.6"
 }

browser_brave/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.93.136-ls122 (2026-08-13)
+- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
+ 
 ## 1.93.134-ls121 (2026-08-08)
 - Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
  

browser_brave/config.yaml

@@ -69,5 +69,5 @@ slug: brave
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.93.134-ls121"
+version: "1.93.136-ls122"
 video: true

browser_brave/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "brave",
   "source": "github",
   "upstream_repo": "linuxserver/docker-brave",
-  "upstream_version": "1.93.134-ls121"
+  "upstream_version": "1.93.136-ls122"
 }

browser_chromium/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 2026.08.13 (2026-08-13)
+- Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
+- Upstream tag : version-e8713bf7
+ 
 ## 2026.08.01.1 (2026-08-01)
 - Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
 - Upstream tag : version-e2e1ec9c

browser_chromium/config.yaml

@@ -71,5 +71,5 @@ slug: chromium
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2026.08.01.1"
+version: "2026.08.13"
 video: true

browser_chromium/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-08-01",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "chromium",
   "source": "github",
   "upstream_repo": "linuxserver/docker-chromium",
-  "upstream_version": "version-e2e1ec9c"
+  "upstream_version": "version-e8713bf7"
 }

browserless_chrome/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.55.4 (2026-08-13)
+- Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
+ 
 ## 2.55.3 (2026-08-08)
 - Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
  

browserless_chrome/config.yaml

@@ -86,5 +86,5 @@ schema:
 slug: browserless_chrome
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/browserless_chrome
-version: "2.55.3"
+version: "2.55.4"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]/docs"

browserless_chrome/updater.json

@@ -1,9 +1,9 @@
 {
   "github_tagfilter": "v",
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "browserless_chrome",
   "source": "github",
   "upstream_repo": "browserless/chrome",
-  "upstream_version": "2.55.3"
+  "upstream_version": "2.55.4"
 }

calibre_web/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 0.6.27 (2026-08-13)
+- Update to latest version from linuxserver/docker-calibre-web (changelog : https://github.com/linuxserver/docker-calibre-web/releases)
 
 ## 0.6.26-2 (2026-04-06)
 - Fix: Install calibre (calibredb) at build time to fix 500 error when downloading books

calibre_web/config.yaml

@@ -116,5 +116,5 @@ schema:
 slug: calibre-web
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/calibre_web
-version: "0.6.26-2"
+version: "0.6.27"
 video: true

calibre_web/updater.json

@@ -1,9 +1,9 @@
 {
-  "last_update": "2026-02-07",
+  "last_update": "2026-08-13",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "calibre-web",
   "source": "github",
   "upstream_repo": "linuxserver/docker-calibre-web",
-  "upstream_version": "0.6.26"
+  "upstream_version": "0.6.27"
 }

claude_desktop/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 07308544 (2026-08-13)
+- Update to latest version from aaddrick/claude-desktop-debian (changelog : https://github.com/aaddrick/claude-desktop-debian/releases)
+- Upstream tag : v3.2.2+claude1.28929.0
+ 
 ## 07308543 (2026-08-08)
 - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
 - Upstream tag : debiantrixie-version-07308543

claude_desktop/config.yaml

@@ -136,5 +136,5 @@ schema:
 slug: claude_desktop
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "07308543"
+version: "07308544"
 video: true

claude_desktop/updater.json

@@ -1,9 +1,9 @@
 {
   "source": "github",
-  "upstream_repo": "linuxserver/docker-baseimage-selkies",
+  "upstream_repo": "aaddrick/claude-desktop-debian",
   "github_fulltag": true,
   "slug": "claude_desktop",
   "paused": false,
-  "upstream_version": "debiantrixie-version-07308543",
-  "last_update": "2026-08-08"
+  "upstream_version": "v3.2.2+claude1.28929.0",
+  "last_update": "2026-08-13"
 }

cleanuparr/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.10.5 (2026-08-13)
+- Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
+ 
 ## 2.10.3 (2026-08-08)
 - Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
  

cleanuparr/Dockerfile

@@ -11,7 +11,7 @@
 #=== Home Assistant Addon ===#
 
 # ARGs used in FROM must be declared before any FROM instruction
-ARG BUILD_UPSTREAM="2.10.3"
+ARG BUILD_UPSTREAM="2.10.5"
 
 #################
 # 1 Build Image #

cleanuparr/config.yaml

@@ -91,5 +91,5 @@ schema:
   TZ: str?
 slug: cleanuparr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
-version: "2.10.3"
+version: "2.10.5"
 webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"

cleanuparr/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "cleanuparr",
   "source": "github",
   "upstream_repo": "Cleanuparr/Cleanuparr",
-  "upstream_version": "2.10.3"
+  "upstream_version": "2.10.5"
 }

collabora/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 26.04.3.1.1 (2026-08-13)
+- Update to latest version from collabora/code
+ 
 ## 26.04.2.4.1 (2026-07-26)
 - Rebuild on a Debian base: upstream turned collabora/code into a distroless image with no shell, which broke the addon build entirely. collabora/code stays the tracked upstream image in build.json, but is now a build stage whose payload is copied onto ghcr.io/hassio-addons/debian-base, and the addon ships its own launcher in place of the removed /start-collabora-online.sh
 - build.json names the architecture explicitly again (`collabora/code:latest-amd64` and `collabora/code:latest-arm64`). The builder never passes `--platform`, so the tag is the only thing that decides which binaries land in the addon

collabora/config.yaml

@@ -48,5 +48,5 @@ schema:
   username: str
 slug: collabora
 url: https://github.com/alexbelgium/hassio-addons
-version: "26.04.2.4.1"
+version: "26.04.3.1.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:9980]/browser/dist/admin/admin.html"

collabora/updater.json

@@ -1,9 +1,9 @@
 {
   "github_exclude": "sha256",
-  "last_update": "2026-07-26",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "collabora",
   "source": "dockerhub",
   "upstream_repo": "collabora/code",
-  "upstream_version": "26.04.2.4.1"
+  "upstream_version": "26.04.3.1.1"
 }

elasticsearch/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 8.19.20 (2026-08-13)
+- Update to latest version from elastic/elasticsearch (changelog : https://github.com/elastic/elasticsearch/releases)
 ## 8.19.19.2 (21-07-2026)
 - Minor bugs fixed
  

elasticsearch/Dockerfile

@@ -14,7 +14,7 @@
 # 1 Build Image #
 #################
 
-ARG BUILD_UPSTREAM="8.19.19"
+ARG BUILD_UPSTREAM="8.19.20"
 # Pull from Elastic's own registry (multi-arch, published atomically with the
 # GitHub release the updater tracks) rather than the Docker Hub "library"
 # mirror, whose arm64/aarch64 tag lags hours behind and breaks the aarch64

elasticsearch/config.yaml

@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: "8.19.19.2"
+version: "8.19.20"

elasticsearch/updater.json

@@ -1,10 +1,10 @@
 {
   "github_fulltag": false,
   "github_tagfilter": "v8.19",
-  "last_update": "2026-07-21",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "elasticsearch",
   "source": "github",
   "upstream_repo": "elastic/elasticsearch",
-  "upstream_version": "8.19.19"
+  "upstream_version": "8.19.20"
 }

emby_beta/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 4.10.0.24 (2026-08-13)
+- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
+ 
 ## 4.10.0.22 (2026-08-01)
 - Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
  

emby_beta/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="4.10.0.22"
+ARG BUILD_UPSTREAM="4.10.0.24"
 FROM ${BUILD_FROM}
 
 ##################

emby_beta/config.yaml

@@ -122,5 +122,5 @@ schema:
 slug: emby_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/emby
-version: "4.10.0.22"
+version: "4.10.0.24"
 video: true

emby_beta/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-08-01",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "emby",
   "source": "github",
   "upstream_repo": "linuxserver/docker-emby",
-  "upstream_version": "4.10.0.22"
+  "upstream_version": "4.10.0.24"
 }

ente/CHANGELOG.md

@@ -1,3 +1,7 @@
+ 
+## 4.4.26 (2026-08-13)
+- Update to latest version from ente/ente (changelog : https://github.com/ente/ente/releases)
+- Upstream tag : 1.3.61
 ## 4.4.25 (2026-08-08)
 - Update to latest version from ente/ente (changelog : https://github.com/ente/ente/releases)
 - Fix build failure: upstream renamed the `ente-io` org to `ente`, so the base image is now `ghcr.io/ente/server` (GHCR does not follow the rename)

ente/config.yaml

@@ -131,6 +131,6 @@ schema:
 slug: ente
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "4.4.25"
+version: "4.4.26"
 video: true
 webui: http://[HOST]:[PORT:3000]

ente/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "false",
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "ente",
   "source": "github",
   "upstream_repo": "ente/ente",
-  "upstream_version": "4.4.25"
+  "upstream_version": "1.3.61"
 }

epicgamesfree/CHANGELOG.md

@@ -1,4 +1,8 @@
  
+## 2026.08.13 (2026-08-13)
+- Update to latest version from charlocharlie/epicgames-freegames
+- Upstream tag : debian-2026-08-13
+ 
 ## 2026.08.04 (2026-08-04)
 - Update to latest version from charlocharlie/epicgames-freegames
 - Upstream tag : debian-2026-08-04

epicgamesfree/config.yaml

@@ -88,5 +88,5 @@ schema:
 slug: epicgamesfree
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2026.08.04"
+version: "2026.08.13"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]"

epicgamesfree/updater.json

@@ -2,10 +2,10 @@
   "dockerhub_by_date": true,
   "dockerhub_list_size": 2,
   "github_exclude": "-",
-  "last_update": "2026-08-04",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "epicgamesfree",
   "source": "dockerhub",
   "upstream_repo": "charlocharlie/epicgames-freegames",
-  "upstream_version": "debian-2026-08-04"
+  "upstream_version": "debian-2026-08-13"
 }

grav/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.0.18 (2026-08-13)
+- Update to latest version from linuxserver/docker-grav (changelog : https://github.com/linuxserver/docker-grav/releases)
+ 
 ## 2.0.17 (2026-08-08)
 - Update to latest version from linuxserver/docker-grav (changelog : https://github.com/linuxserver/docker-grav/releases)
  

grav/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="2.0.17"
+ARG BUILD_UPSTREAM="2.0.18"
 FROM ${BUILD_FROM}
 
 ##################

grav/config.yaml

@@ -89,5 +89,5 @@ schema:
 slug: grav
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.0.17"
+version: "2.0.18"
 webui: "[PROTO:ssl]://[HOST]:[PORT:80]"

grav/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": false,
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "grav",
   "source": "github",
   "upstream_repo": "linuxserver/docker-grav",
-  "upstream_version": "2.0.17"
+  "upstream_version": "2.0.18"
 }

jackett/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 0.24.2404 (2026-08-13)
+- Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
+ 
 ## 0.24.2342 (2026-08-08)
 - Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
  

jackett/config.yaml

@@ -106,5 +106,5 @@ schema:
 slug: jackett_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/jackett
-version: "0.24.2342"
+version: "0.24.2404"
 webui: http://[HOST]:[PORT:9117]

jackett/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "jackett",
   "source": "github",
   "upstream_repo": "linuxserver/docker-jackett",
-  "upstream_version": "0.24.2342"
+  "upstream_version": "0.24.2404"
 }

kometa/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.4.7 (2026-08-13)
+- Update to latest version from linuxserver/docker-kometa (changelog : https://github.com/linuxserver/docker-kometa/releases)
+ 
 ## 2.4.6 (2026-08-01)
 - Update to latest version from linuxserver/docker-kometa (changelog : https://github.com/linuxserver/docker-kometa/releases)
  

kometa/config.yaml

@@ -96,4 +96,4 @@ schema:
 slug: kometa
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/kometa
-version: "2.4.6"
+version: "2.4.7"

kometa/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-01",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "kometa",
   "source": "github",
   "upstream_repo": "linuxserver/docker-kometa",
-  "upstream_version": "2.4.6"
+  "upstream_version": "2.4.7"
 }

komga/CHANGELOG.md

@@ -0,0 +1,23 @@
+ 
+## 1.26.3 (2026-08-13)
+- Update to latest version from gotson/komga (changelog : https://github.com/gotson/komga/releases)
+## 1.26.1.4 (12-08-2026)
+- Minor bugs fixed
+## 1.26.1.3 (2026-08-12)
+
+- Fix : 401 errors after a successful login through ingress. Komga scopes its session cookies to its servlet context path (`Path=/komga`), which the browser never sends back from the ingress url, so every request after the login was anonymous. Nginx now rewrites the cookie path onto the ingress entry
+
+## 1.26.1.2 (2026-08-12)
+
+- Fix : local disks (`localdisks`) and SMB shares failed to mount with `cannot mount /dev/sdX read-only`. Without an `apparmor.txt` the add-on ran under Docker's default AppArmor profile, which denies `mount` and raw block device access. Ships the same profile as the other add-ons that mount disks
+
+## 1.26.1.1 (2026-08-11)
+
+- Bound the nginx readiness probes (`--connect-timeout` / `--max-time`) so a stalled connection cannot hang the wait, and log a warning when Komga has not answered within 15 minutes
+
+## 1.26.1 (2026-08-11)
+
+- Initial release, based on gotson/komga ([changelog](https://github.com/gotson/komga/releases))
+- Ingress support : Komga is served on the `/komga` servlet context path, nginx prefixes it back with the ingress entry
+- Supports local disks and SMB network shares for libraries (`localdisks` / `networkdisks` options)
+- Supports extra environment variables via the `env_vars` option, see the [documentation](https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2)

komga/Dockerfile

@@ -0,0 +1,121 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#           _.------.
+#       _.-`    ('>.-`"""-.
+# '.--'`       _'`   _ .--.)
+#    -'         '-.-';`   `
+#    ' -      _.'  ``'--.
+#        '---`    .-'""`
+#               /`
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+ARG BUILD_VERSION
+ARG BUILD_UPSTREAM="1.26.3"
+FROM ${BUILD_FROM}
+ENV BASHIO_VERSION=0.14.3
+
+##################
+# 2 Modify Image #
+##################
+
+# No S6_* tuning here : the upstream image ships no s6-overlay, so the vars the
+# other addons set would be read by nobody
+
+# Komga is served from a fixed servlet context path. Ingress strips its own
+# prefix before forwarding, and Komga renders absolute asset urls, so nginx
+# needs a stable subpath to prefix back. See rootfs/etc/nginx/servers/ingress.conf
+ENV SERVER_SERVLET_CONTEXTPATH="/komga"
+
+##################
+# 3 Install apps #
+##################
+
+# Add rootfs
+# Absolute paths on purpose : the upstream image sets WORKDIR /app, so the
+# relative "find ." used by the other addons would miss /etc entirely
+COPY rootfs/ /
+RUN find /etc/cont-init.d /etc/services.d -type f \( -name "*.sh" -o -name "run" \) -print -exec chmod +x {} \;
+
+# Uses /bin for compatibility purposes
+# hadolint ignore=DL4005
+RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
+    if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
+
+# Modules
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh"
+
+# Automatic modules download
+COPY ha_automodules.sh /ha_automodules.sh
+RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
+
+# Manual apps
+ENV PACKAGES="nginx"
+
+# Automatic apps & bashio
+COPY ha_autoapps.sh /ha_autoapps.sh
+RUN chmod 744 /ha_autoapps.sh && /ha_autoapps.sh "$PACKAGES" && rm /ha_autoapps.sh
+
+################
+# 4 Entrypoint #
+################
+
+# The upstream image is a plain jre image without s6-overlay, so ha_entrypoint
+# runs as pid 1 : it executes /etc/cont-init.d, then supervises /etc/services.d
+COPY ha_entrypoint.sh /ha_entrypoint.sh
+RUN chmod 777 /ha_entrypoint.sh
+ENTRYPOINT ["/ha_entrypoint.sh"]
+
+# Install bashio
+COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
+RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+#################
+# 6 Healthcheck #
+#################
+
+# Komga is a jvm app, first boot builds the database : leave it time to settle
+ENV HEALTH_PORT="25600" \
+    HEALTH_URL="/komga/"
+HEALTHCHECK \
+    --interval=30s \
+    --retries=5 \
+    --start-period=180s \
+    --timeout=25s \
+    CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" >/dev/null 2>&1 || exit 1

komga/README.md

@@ -0,0 +1,70 @@
+# Home Assistant Add-on: Komga
+
+Free and open source comics/mangas media server.
+
+[Komga](https://komga.org) organizes your comics, mangas, BDs, magazines and ebooks, serves them
+through a web reader, and exposes OPDS, Kobo sync and a REST API for third-party readers
+(Tachiyomi/Mihon, Panels, Chunky, ...).
+
+## About
+
+- Browse and read CBZ, CBR, PDF and EPUB files from any browser
+- Import metadata, edit series/books, build collections and read lists
+- Multi-user, with per-user library restrictions and age ratings
+- OPDS v1/v2, Kobo sync, and a documented REST API
+
+## Installation
+
+1. Add this repository to Home Assistant.
+2. Install the **Komga** add-on.
+3. Start the add-on and open it from the sidebar (ingress), or on port `25600` at
+   `http://homeassistant:25600/komga`.
+4. Create the initial user account when the web interface asks for it.
+5. Add a library pointing at your comics, for example `/media/comics` or `/share/comics`.
+
+The first start takes longer than usual: Komga is a JVM application and builds its database and
+search index on first boot.
+
+## Configuration
+
+| Option | Description |
+|--------|-------------|
+| `PUID` / `PGID` | Ownership applied to the add-on configuration directory. Defaults to `0` (root). |
+| `TZ` | Timezone, e.g. `Europe/Paris`. |
+| `localdisks` | Local disks to mount, e.g. `sda1` or a disk label. |
+| `networkdisks` | SMB shares to mount, e.g. `//192.168.1.2/comics`. Mounted under `/mnt`. |
+| `cifsusername` / `cifspassword` / `cifsdomain` | Credentials for the SMB shares. |
+| `smbv1` | Allow the legacy SMBv1 protocol. |
+| `env_vars` | Extra environment variables passed to Komga. See the [wiki](https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2). |
+
+Most Komga settings can be passed through `env_vars` using the upstream naming, see the
+[Komga configuration options](https://komga.org/docs/installation/configuration/). A common one:
+
+- `JAVA_TOOL_OPTIONS` = `-Xmx1g` — cap the JVM heap on small machines.
+
+`SERVER_SERVLET_CONTEXTPATH` and `SERVER_PORT` are reserved by the add-on: ingress is built
+around the `/komga` path on port 25600, and overriding either breaks the sidebar panel.
+
+## Ingress and URLs
+
+Komga is served from the `/komga` subpath so that it works behind Home Assistant ingress:
+
+- from the Home Assistant sidebar: ingress, no extra setup
+- directly: `http://homeassistant:25600/komga`
+
+External clients — OPDS readers, Kobo sync, Tachiyomi/Mihon, Panels — must use the direct
+`http://homeassistant:25600/komga` url. Ingress is browser-session based, so those clients cannot
+authenticate through it.
+
+
+## Data
+
+Komga's database, logs and search index live in `/config` inside the add-on, which Home Assistant
+maps to this add-on's own configuration directory — `/addon_configs/<repository_id>_komga`, browsable
+with the Filebrowser add-on. They survive add-on updates. Libraries stay where you put them, under
+`/media`, `/share` or a mounted disk.
+
+## Support
+
+- [Komga upstream project](https://github.com/gotson/komga)
+- [Add-on repository issues](https://github.com/alexbelgium/hassio-addons/issues)

komga/apparmor.txt

@@ -0,0 +1,68 @@
+
+#include <tunables/global>
+
+profile komga_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# Entrypoint stack
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /tmp/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explicit allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}

komga/build.json

@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "gotson/komga:latest",
+    "amd64": "gotson/komga:latest"
+  }
+}

komga/config.yaml

@@ -0,0 +1,104 @@
+arch:
+  - aarch64
+  - amd64
+description: Free and open source comics/mangas media server
+devices:
+  - /dev/dri
+  - /dev/dri/card0
+  - /dev/dri/card1
+  - /dev/dri/renderD128
+  - /dev/vchiq
+  - /dev/video10
+  - /dev/video11
+  - /dev/video12
+  - /dev/video13
+  - /dev/video14
+  - /dev/video15
+  - /dev/video16
+  - /dev/ttyUSB0
+  - /dev/sda
+  - /dev/sdb
+  - /dev/sdc
+  - /dev/sdd
+  - /dev/sde
+  - /dev/sdf
+  - /dev/sdg
+  - /dev/nvme
+  - /dev/nvme0
+  - /dev/nvme0n1
+  - /dev/nvme0n1p1
+  - /dev/nvme0n1p2
+  - /dev/nvme0n1p3
+  - /dev/nvme1n1
+  - /dev/nvme1n1p1
+  - /dev/nvme1n1p2
+  - /dev/nvme1n1p3
+  - /dev/nvme2n1
+  - /dev/nvme2n1p1
+  - /dev/nvme2n1p2
+  - /dev/nvme2n3p3
+  - /dev/mmcblk
+  - /dev/fuse
+  - /dev/sda1
+  - /dev/sdb1
+  - /dev/sdc1
+  - /dev/sdd1
+  - /dev/sde1
+  - /dev/sdf1
+  - /dev/sdg1
+  - /dev/sda2
+  - /dev/sdb2
+  - /dev/sdc2
+  - /dev/sdd2
+  - /dev/sde2
+  - /dev/sdf2
+  - /dev/sdg2
+  - /dev/sda3
+  - /dev/sdb3
+  - /dev/sda4
+  - /dev/sdb4
+  - /dev/sda5
+  - /dev/sda6
+  - /dev/sda7
+  - /dev/sda8
+  - /dev/nvme0
+  - /dev/nvme1
+  - /dev/nvme2
+image: ghcr.io/alexbelgium/komga-{arch}
+ingress: true
+ingress_entry: komga/next
+init: false
+map:
+  - addon_config:rw
+  - media:rw
+  - share:rw
+name: Komga
+options:
+  env_vars: []
+  PGID: 0
+  PUID: 0
+panel_icon: mdi:book-open-page-variant
+ports:
+  25600/tcp: 25600
+ports_description:
+  25600/tcp: Web interface (path /komga)
+privileged:
+  - SYS_ADMIN
+  - DAC_READ_SEARCH
+schema:
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  PGID: int
+  PUID: int
+  TZ: str?
+  cifsdomain: str?
+  cifspassword: str?
+  cifsusername: str?
+  localdisks: str?
+  networkdisks: str?
+  smbv1: bool?
+slug: komga
+udev: true
+url: https://github.com/alexbelgium/hassio-addons/tree/master/komga
+version: "1.26.3"

komga/rootfs/etc/cont-init.d/20-config_location.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+# Komga stores its database, logs and search index in KOMGA_CONFIGDIR, which the
+# upstream image sets to /config -- that is the addon_config mount
+
+CONFIG_LOCATION="/config"
+bashio::log.info "Config stored in $CONFIG_LOCATION"
+
+mkdir -p "$CONFIG_LOCATION"
+# Numbered 20- on purpose : it must sort after 00-global_var.sh, which is what
+# exports PUID/PGID from the addon options. The upstream image sets neither, so
+# the fallbacks only apply when the module is absent.
+chown -R "${PUID:-0}:${PGID:-0}" "$CONFIG_LOCATION"

komga/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+#################
+# NGINX SETTING #
+#################
+declare ingress_interface
+declare ingress_port
+declare ingress_entry
+
+ingress_port=$(bashio::addon.ingress_port)
+ingress_interface=$(bashio::addon.ip_address)
+ingress_entry=$(bashio::addon.ingress_entry)
+sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf
+sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf
+sed -i "s|%%ingress_entry%%|${ingress_entry}|g" /etc/nginx/servers/ingress.conf

komga/rootfs/etc/nginx/includes/mime.types

@@ -0,0 +1,96 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

komga/rootfs/etc/nginx/includes/resolver.conf

@@ -0,0 +1 @@
+resolver 127.0.0.11 ipv6=off;

komga/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,56 @@
+
+# Run nginx in foreground.
+daemon off;
+
+# This is run inside Docker.
+user root;
+
+# Pid storage location.
+pid /var/run/nginx.pid;
+
+# Set number of worker processes.
+worker_processes 1;
+
+# Enables the use of JIT for regular expressions to speed-up their processing.
+pcre_jit on;
+
+# Write error log to Hass.io add-on log.
+error_log /proc/1/fd/1 error;
+
+# Load allowed environment vars
+env HASSIO_TOKEN;
+
+# Load dynamic modules.
+include /etc/nginx/modules-enabled/*.conf;
+
+# Max num of simultaneous connections by a worker process.
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/includes/mime.types;
+
+    log_format hassio '[$time_local] $status '
+                        '$http_x_forwarded_for($remote_addr) '
+                        '$request ($http_user_agent)';
+
+    access_log              /proc/1/fd/1 hassio;
+    client_max_body_size    4G;
+    default_type            application/octet-stream;
+    gzip                    on;
+    keepalive_timeout       65;
+    sendfile                on;
+    server_tokens           off;
+    tcp_nodelay             on;
+    tcp_nopush              on;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    include /etc/nginx/includes/resolver.conf;
+
+    include /etc/nginx/servers/*.conf;
+}

komga/rootfs/etc/nginx/servers/ingress.conf

@@ -0,0 +1,67 @@
+server {
+    listen %%interface%%:%%port%% default_server;
+
+    client_max_body_size 0;
+
+    # Home Assistant opens the ingress panel at <ingress_entry>/ and forwards it
+    # as / , but Komga only answers below its servlet context path (/komga), so
+    # bounce the panel there. absolute_redirect off keeps the Location relative
+    # to the HA host instead of nginx's own listen address.
+    location = / {
+        absolute_redirect off;
+        return 302 %%ingress_entry%%/komga/;
+    }
+
+    location / {
+        add_header Access-Control-Allow-Origin *;
+        proxy_connect_timeout 30m;
+        proxy_send_timeout 30m;
+        proxy_read_timeout 30m;
+        proxy_pass http://127.0.0.1:25600;
+
+        # Komga pushes live events over SSE (/komga/sse/v1/events), which must
+        # not be buffered or the UI stops refreshing until the buffer fills
+        proxy_buffering off;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+
+        # Spring redirects /komga to /komga/ ; the Location it produces is
+        # absolute against the upstream address, so rewrite it back onto the
+        # ingress path (the second rule covers an already relative Location).
+        absolute_redirect off;
+        proxy_redirect http://127.0.0.1:25600/ %%ingress_entry%%/;
+        proxy_redirect / %%ingress_entry%%/;
+
+        # Komga scopes its cookies to the servlet context path
+        # (Set-Cookie: ...; Path=/komga). The browser lives under the ingress
+        # entry, so such a cookie is never sent back : login succeeds, then
+        # every following request arrives anonymous and Komga answers 401.
+        proxy_cookie_path /komga %%ingress_entry%%/komga;
+        proxy_cookie_path / %%ingress_entry%%/;
+
+        # Komga renders its index page with Thymeleaf @{...} link expressions,
+        # so every asset url and window.resourceBaseUrl carry the context path
+        # (/komga). Ingress strips its own prefix before forwarding, so the
+        # browser needs that prefix added back. Only text/html is rewritten
+        # (the nginx default for sub_filter_types) : the SPA derives its api
+        # origin and router base from resourceBaseUrl at runtime, so json
+        # responses and book pages stream through untouched.
+        proxy_set_header Accept-Encoding "";
+        sub_filter_once off;
+        sub_filter "/komga" "%%ingress_entry%%/komga";
+
+        # The epub/divina reader fetches a Readium manifest whose links Komga
+        # builds with ServletUriComponentsBuilder.fromCurrentContextPath(), so
+        # they are fully absolute against the upstream address nginx talks to
+        # (http://127.0.0.1:25600/komga). Rewriting them to a root relative
+        # ingress path also fixes the scheme : Home Assistant may be served over
+        # https, and an absolute http:// link would be blocked as mixed content.
+        # Only the json/xml document types are added here, so book pages are
+        # never scanned.
+        sub_filter "http://127.0.0.1:25600/komga" "%%ingress_entry%%/komga";
+        sub_filter_types application/json application/webpub+json
+                         application/divina+json application/opds+json
+                         application/atom+xml;
+    }
+}

komga/rootfs/etc/services.d/komga/run

@@ -0,0 +1,17 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+# Same invocation as the upstream image entrypoint (gotson/komga), which is
+# replaced by ha_entrypoint.sh so that cont-init.d and nginx can run too.
+# SERVER_SERVLET_CONTEXTPATH is set in the Dockerfile, see ingress.conf.
+
+bashio::log.info "Starting Komga (served on the /komga path, see the addon documentation)"
+
+cd /app
+exec java \
+    -Dspring.profiles.include=docker \
+    --enable-native-access=ALL-UNNAMED \
+    -jar application.jar \
+    --spring.config.additional-location=file:/config/

komga/rootfs/etc/services.d/nginx/run

@@ -0,0 +1,34 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+# ==============================================================================
+
+# Wait for komga to answer before nginx starts serving ingress. First boot
+# builds the database, so leave a wide margin, but poll rather than call
+# bashio::net.wait_for : bashio takes (port host timeout) while the bundled
+# bashio-standalone.sh takes (host port timeout), and picking the wrong one
+# would either fail instantly or block for the whole timeout.
+# The per probe timeouts keep the 15 minute ceiling real : without them a
+# half open connection would hang a single probe, and the loop, forever.
+# A wall clock deadline, not an attempt count : a failed probe costs up to
+# max-time on top of the sleep, so counting attempts would stretch the wait to
+# roughly twice the advertised ceiling.
+komga_ready=false
+deadline=$((SECONDS + 900))
+while [ "$SECONDS" -lt "$deadline" ]; do
+    if curl -sf --connect-timeout 2 --max-time 5 -o /dev/null "http://127.0.0.1:25600/komga/"; then
+        komga_ready=true
+        break
+    fi
+    sleep 5
+done
+
+# Deliberately not fatal : nginx serving a 502 tells the user something is wrong
+# and starts working by itself once komga finally answers, while refusing to
+# start would take ingress down for good after ha_entrypoint gives up retrying.
+if [ "$komga_ready" != true ]; then
+    bashio::log.warning "Komga did not answer within 15 minutes. Starting NGinx anyway : ingress will return 502 until it does."
+fi
+
+bashio::log.info "Starting NGinx..."
+exec nginx

komga/updater.json

@@ -0,0 +1,9 @@
+{
+  "github_beta": "false",
+  "last_update": "2026-08-13",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "komga",
+  "source": "github",
+  "upstream_repo": "gotson/komga",
+  "upstream_version": "1.26.3"
+}

maintainerr/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 3.22.1 (2026-08-13)
+- Update to latest version from maintainerr/maintainerr (changelog : https://github.com/maintainerr/maintainerr/releases)
+ 
 ## 3.22.0 (2026-08-08)
 - Update to latest version from maintainerr/maintainerr (changelog : https://github.com/maintainerr/maintainerr/releases)
  

maintainerr/Dockerfile

@@ -11,7 +11,7 @@
 #=== Home Assistant Addon ===#
 
 # ARGs used in FROM must be declared before any FROM instruction
-ARG BUILD_UPSTREAM="3.22.0"
+ARG BUILD_UPSTREAM="3.22.1"
 
 ############################
 # 0) Tools stage           #

maintainerr/config.yaml

@@ -88,5 +88,5 @@ schema:
   TZ: str?
 slug: maintainerr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/maintainerr
-version: "3.22.0"
+version: "3.22.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:6246]"

maintainerr/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "maintainerr",
   "source": "github",
   "upstream_repo": "maintainerr/maintainerr",
-  "upstream_version": "3.22.0"
+  "upstream_version": "3.22.1"
 }

nextcloud/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 34.0.3 (2026-08-13)
+- Update to latest version from linuxserver/docker-nextcloud (changelog : https://github.com/linuxserver/docker-nextcloud/releases)
+ 
 ## 34.0.2 (2026-07-25)
 - Update to latest version from linuxserver/docker-nextcloud (changelog : https://github.com/linuxserver/docker-nextcloud/releases)
  

nextcloud/config.yaml

@@ -151,5 +151,5 @@ slug: nextcloud_ocr
 uart: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/nextcloud
-version: "34.0.2"
+version: "34.0.3"
 webui: https://[HOST]:[PORT:443]

nextcloud/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-07-25",
+  "last_update": "2026-08-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "nextcloud",
   "source": "github",
   "upstream_repo": "linuxserver/docker-nextcloud",
-  "upstream_version": "34.0.2"
+  "upstream_version": "34.0.3"
 }

obsidian_syncserver_npm/CHANGELOG.md

@@ -0,0 +1,19 @@
+## 3.5.2.1 (12-08-2026)
+- Minor bugs fixed
+# Changelog
+
+
+## 3.5.2.1
+
+- Pin the Nginx Proxy Manager base image to 2.15.1 instead of tracking :latest, so builds are reproducible and the CouchDB runtime copied in from couchdb:3.5.2 keeps a known-compatible Debian trixie ABI
+
+## 3.5.2
+
+- Initial release: couchdb:3.5.2 as an Obsidian Self-hosted LiveSync backend, bundled with Nginx Proxy Manager for TLS and certificate management
+- NPM admin UI on port 81; HTTPS on 443; CouchDB also reachable directly on 5984
+- Seeds a default nginx host proxying to CouchDB with the settings LiveSync needs: Authorization header passthrough and WebSocket upgrade
+- Applies the CouchDB configuration LiveSync requires on every start: single-node cluster, CORS for Obsidian app origins, mandatory authentication, 4 GB max request size, 50 MB max document size
+- Creates the vault database automatically
+- Generates and persists a strong admin password when none is set
+- Stores data under /config/obsidian-syncserver/data so it survives reinstalls and is included in Home Assistant backups
+- Symlinks /etc/letsencrypt to /data so NPM certificates persist across restarts

obsidian_syncserver_npm/DOCS.md

@@ -0,0 +1,95 @@
+# Obsidian Sync Server NPM
+
+CouchDB set up as a backend for the [Self-hosted LiveSync](https://github.com/vrtmrz/obsidian-livesync) plugin in Obsidian, with Nginx Proxy Manager bundled in for TLS and certificate handling.
+
+## How it fits together
+
+Both run in one container under s6 supervision. CouchDB listens on 5984 and holds the vault. Nginx Proxy Manager listens on 80, 81 and 443, and proxies HTTPS through to CouchDB.
+
+On first start the add-on seeds a default nginx host, so port 80 reaches CouchDB before you have configured anything. Create a real proxy host in the admin UI and that takes over.
+
+The seeded config includes the two things LiveSync depends on. `proxy_pass_request_headers on` keeps the `Authorization` header intact, which matters because CouchDB authenticates every request. The `Upgrade` and `Connection` headers allow the long-lived connections replication needs.
+
+Build your own proxy host in the UI and you have to switch Websockets Support on for the same reason.
+
+## Ports
+
+| Port | Use |
+| :--- | :--- |
+| 443 | HTTPS, point Obsidian here |
+| 81 | NPM admin UI |
+| 80 | HTTP, certificate validation and redirect |
+| 5984 | CouchDB directly |
+
+Since this add-on binds 80, 81 and 443, it cannot run alongside the Nginx Proxy Manager + Static Web Server add-on or anything else holding those ports.
+
+## First login
+
+The admin UI on port 81 starts with well-known default credentials: `admin@example.com` and `changeme`. NPM forces a change on first login. Do it before this add-on is reachable by anything you do not control.
+
+## Certificates
+
+NPM keeps certificates in `/etc/letsencrypt`, which this add-on symlinks to `/data/letsencrypt` so they survive restarts and reinstalls.
+
+For a domain that does not resolve publicly, use a DNS Challenge when requesting a Let's Encrypt certificate. HTTP validation needs the domain to reach port 80 from the internet.
+
+## What the add-on configures in CouchDB
+
+A stock CouchDB will not work as a LiveSync backend. On every start this add-on applies the settings the plugin needs, matching what upstream's own provisioning tool does:
+
+| Setting | Value | Why |
+| :--- | :--- | :--- |
+| `chttpd/require_valid_user` | `true` | No anonymous access |
+| `chttpd_auth/require_valid_user` | `true` | No anonymous access to the auth endpoints |
+| `httpd/WWW-Authenticate` | `Basic realm="couchdb"` | Prompts for credentials |
+| `httpd/enable_cors`, `chttpd/enable_cors` | `true` | Obsidian behaves like a browser client |
+| `cors/credentials` | `true` | Lets it send the auth header cross-origin |
+| `cors/origins` | `app://obsidian.md,capacitor://localhost,http://localhost` | Desktop and mobile app origins |
+| `chttpd/max_http_request_size` | `4294967296` | Large vault batches |
+| `couchdb/max_document_size` | `50000000` | Large notes and attachments |
+
+These get re-applied on each start, so editing them by hand in Fauxton will not stick.
+
+## Storage
+
+The vault database lives in `/config/obsidian-syncserver/data` rather than the add-on's `/data` directory, so it survives a reinstall and **gets picked up by Home Assistant backups**. NPM's own database and certificates live in `/data`.
+
+If you did not set a CouchDB password, the generated one is in `/config/obsidian-syncserver/admin_password`.
+
+## Troubleshooting
+
+Check CouchDB directly first. It separates a CouchDB problem from a proxy problem in one command:
+
+```bash
+curl -u admin:YOURPASSWORD http://homeassistant.local:5984/obsidian
+```
+
+If that works, CouchDB is fine and whatever is failing lives in the proxy layer.
+
+If the add-on will not start, look for `ERROR` in the log. A malformed `database` name or an unwritable `/config` both stop startup with a message saying which.
+
+If sync connects and then stalls, WebSocket upgrade is off. Turn on Websockets Support in the proxy host settings.
+
+If everything returns 401 through the proxy but works on 5984, the proxy host is not passing the `Authorization` header through.
+
+If desktop syncs but mobile does not, the certificate is either untrusted by the phone or issued for a different hostname. Check with:
+
+```bash
+openssl s_client -connect your-domain:443 </dev/null | openssl x509 -noout -subject -dates
+```
+
+If the add-on will not start because of a port conflict, something else holds 80, 81 or 443. Stop it, or switch to the plain Obsidian Sync Server behind the proxy you already have.
+
+To see the applied CouchDB configuration:
+
+```bash
+curl -u admin:YOURPASSWORD http://homeassistant.local:5984/_node/_local/_config/cors
+```
+
+## Updates
+
+This add-on tracks two upstream projects, CouchDB and Nginx Proxy Manager, and the repository's updater handles one upstream per add-on. Its version gets bumped by hand rather than by the weekly update workflow.
+
+## Backups
+
+Home Assistant backs up `/config`, which covers the vault database. For a copy you can move elsewhere, use CouchDB replication or export from Fauxton at `http://<host>:5984/_utils`.

obsidian_syncserver_npm/Dockerfile

@@ -0,0 +1,48 @@
+# Global build args must be declared before the first FROM to be usable there.
+ARG BUILD_FROM=jc21/nginx-proxy-manager:2.15.1
+ARG COUCHDB_FROM=couchdb:3.5.2
+
+# Stage 1: source of the CouchDB runtime. CouchDB ships a self-contained
+# release under /opt/couchdb, including its own Erlang runtime (erts-*), so
+# it can be lifted into another image without installing Erlang separately.
+FROM ${COUCHDB_FROM} AS couchdb
+
+# Stage 2: Nginx Proxy Manager, which supplies s6-overlay and the admin UI.
+# Both images are Debian trixie, so the CouchDB release is binary compatible.
+FROM ${BUILD_FROM}
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        jq \
+        openssl \
+        ripgrep \
+        libicu76 \
+        libmozjs-128-0 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=couchdb /opt/couchdb /opt/couchdb
+COPY --from=couchdb /usr/local/bin/docker-entrypoint.sh /docker-entrypoint.sh
+
+# CouchDB refuses to run as root and expects to own its runtime directories.
+RUN groupadd -g 5984 couchdb \
+    && useradd -u 5984 -g couchdb -d /opt/couchdb -s /bin/bash couchdb \
+    && chown -R couchdb:couchdb /opt/couchdb \
+    && chmod +x /docker-entrypoint.sh
+
+COPY run.sh /run.sh
+COPY rootfs /
+RUN chmod +x /run.sh \
+    && chmod +x /etc/s6-overlay/s6-rc.d/couchdb/run \
+    && chmod +x /etc/s6-overlay/s6-rc.d/couchdb/finish \
+    && chmod +x /etc/s6-overlay/s6-rc.d/addon-init/script
+
+ARG BUILD_VERSION
+LABEL \
+  io.hass.version="${BUILD_VERSION}" \
+  io.hass.type="addon" \
+  io.hass.arch="aarch64|amd64"
+
+ENTRYPOINT ["/init"]

obsidian_syncserver_npm/README.md

@@ -0,0 +1,101 @@
+# Home assistant add-on: Obsidian Sync Server NPM
+
+![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_npm%2Fconfig.yaml)
+![Ingress](https://img.shields.io/badge/dynamic/yaml?label=Ingress&query=%24.ingress&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_npm%2Fconfig.yaml)
+![Arch](https://img.shields.io/badge/dynamic/yaml?color=success&label=Arch&query=%24.arch&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fobsidian_syncserver_npm%2Fconfig.yaml)
+
+[![Codacy Badge](https://app.codacy.com/project/badge/Grade/9c6cf10bdbba45ecb202d7f579b5be0e)](https://www.codacy.com/gh/alexbelgium/hassio-addons/dashboard?utm_source=github.com&utm_medium=referral&utm_content=alexbelgium/hassio-addons&utm_campaign=Badge_Grade)
+[![GitHub Super-Linter](https://img.shields.io/github/actions/workflow/status/alexbelgium/hassio-addons/weekly-supelinter.yaml?label=Lint%20code%20base)](https://github.com/alexbelgium/hassio-addons/actions/workflows/weekly-supelinter.yaml)
+[![Builder](https://img.shields.io/github/actions/workflow/status/alexbelgium/hassio-addons/onpush_builder.yaml?label=Builder)](https://github.com/alexbelgium/hassio-addons/actions/workflows/onpush_builder.yaml)
+
+Runs CouchDB as a sync backend for the [Self-hosted LiveSync](https://github.com/vrtmrz/obsidian-livesync) plugin in Obsidian, with [Nginx Proxy Manager](https://nginxproxymanager.com/) bundled in to handle TLS.
+
+This add-on is only the server side. Install the companion plugin in Obsidian: <https://community.obsidian.md/plugins/obsidian-livesync>
+
+> [!IMPORTANT]
+>
+> - Before installing or upgrading this add-on or the obsidian livesync plugin, please back up your vault.
+> - Not compatible with other synchronisation solution (including iCloud and Obsidian Sync).
+> - For backups, use [Differential ZIP Backup](https://github.com/vrtmrz/diffzip).
+
+Your vault syncs between your own devices through Home Assistant. No Obsidian Sync subscription, and the notes stay on your network.
+
+This version has everything mobile Obsidian needs in one add-on. NPM requests and renews the certificates and proxies HTTPS through to CouchDB. Pick it if you do not already run a reverse proxy.
+
+| Add-on | TLS | Use when |
+| :--- | :--- | :--- |
+| [Obsidian Sync Server](../obsidian_syncserver_solo/README.md) | none | You already run a reverse proxy |
+| [Obsidian Sync Server SSL](../obsidian_syncserver_ssl/README.md) | CouchDB serves HTTPS from your certificates in `/ssl` | You have certificates on the Home Assistant machine |
+| Obsidian Sync Server NPM (this one) | Bundled Nginx Proxy Manager | You have no proxy and want certificate handling included |
+
+Note that this add-on binds ports 80, 81 and 443. If you already run the Nginx Proxy Manager + Static Web Server add-on, or anything else on those ports, only one of them can be running at a time. In that case use the plain [Obsidian Sync Server](../obsidian_syncserver_solo/README.md) and add a proxy host to the NPM you already have.
+
+## Ports
+
+| Port | Use |
+| :--- | :--- |
+| 443 | HTTPS, point Obsidian here |
+| 81 | Nginx Proxy Manager admin UI |
+| 80 | HTTP, certificate validation and redirect |
+| 5984 | CouchDB directly, for desktop or local tools |
+
+## Installation
+
+1. Add the repository `https://github.com/alexbelgium/hassio-addons` to Home Assistant, then install the add-on.
+2. Set a password under Configuration. Leaving it blank generates one and prints it in the log on first start.
+3. Start the add-on and look for `Ready.` in the log.
+4. Open the NPM admin UI on port 81. The default login is `admin@example.com` with password `changeme`, and NPM makes you change both on first login. Do that now rather than later.
+
+## Getting a real certificate
+
+Port 443 answers out of the box, but with a self-signed certificate that mobile Obsidian will reject. To fix that:
+
+1. In the NPM admin UI, go to SSL Certificates, then Add SSL Certificate, then Let's Encrypt.
+2. Enter the domain name pointing at your Home Assistant machine, plus your email.
+3. If the domain has no public IP, tick Use a DNS Challenge and pick your DNS provider.
+4. Once the certificate is issued, go to Hosts, then Proxy Hosts, then Add Proxy Host:
+   - Domain Names: your domain
+   - Scheme: `http`
+   - Forward Hostname / IP: `127.0.0.1`
+   - Forward Port: `5984`
+   - Websockets Support: on. LiveSync will not sync without it.
+   - On the SSL tab, select your certificate and turn on Force SSL.
+
+## Configuration
+
+```yaml
+username: admin
+password: ""
+database: obsidian
+log_level: info
+```
+
+`username` and `password` are the CouchDB administrator credentials that the LiveSync plugin uses, separate from the NPM admin login. A blank password gets generated on first start and saved to `/config/obsidian-syncserver/admin_password`.
+
+`database` is the CouchDB database holding your vault. The add-on creates it if it does not exist.
+
+`log_level` sets CouchDB log verbosity.
+
+## Connecting Obsidian
+
+Install Self-hosted LiveSync from Obsidian's community plugins. In its settings, pick the manual setup and fill in:
+
+- URI: `https://your-domain`
+- Username and password: the CouchDB credentials above
+- Database name: `obsidian`, unless you changed it
+
+Hit Test Database Connection to check it, then turn on end-to-end encryption with a passphrase. With that on, the server only ever holds ciphertext.
+
+[DOCS.md](DOCS.md) covers troubleshooting.
+
+## Security
+
+CouchDB requires authentication on every request, and NPM's admin UI has its own login that you have to change the first time you use it. Keep this on your LAN unless you have deliberately set up remote access.
+
+## Support
+
+For problems with this add-on (not the upstream CouchDB or Nginx Proxy Manager software), create an issue on [github](https://github.com/alexbelgium/hassio-addons/issues) and tag @ToledoEM
+
+- Obsidian Self-hosted LiveSync plugin → [github.com/vrtmrz/obsidian-livesync](https://github.com/vrtmrz/obsidian-livesync)
+- CouchDB upstream → [couchdb.apache.org](https://couchdb.apache.org/)
+- Nginx Proxy Manager upstream → [github.com/NginxProxyManager/nginx-proxy-manager](https://github.com/NginxProxyManager/nginx-proxy-manager)

obsidian_syncserver_npm/apparmor.txt

@@ -0,0 +1,37 @@
+#include <tunables/global>
+
+profile hassio-addons/obsidian_syncserver_npm flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+  #include <abstractions/nameservice>
+  #include <abstractions/openssl>
+
+  # Baseline profile covering both CouchDB (Erlang VM) and Nginx Proxy
+  # Manager (s6-overlay, nginx, node). Both need broad file and network
+  # access plus the ability to drop privileges.
+  file,
+  network,
+
+  capability chown,
+  capability dac_override,
+  capability fowner,
+  capability kill,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+
+  signal (send) set=(kill,term,int,hup,cont),
+
+  # s6-overlay boot chain
+  /init ix,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /command/** ix,
+  /package/** ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /etc/s6-overlay/** rwix,
+
+  deny /proc/kcore rwklx,
+  deny /proc/sysrq-trigger rwklx,
+  deny /sys/firmware/** rwklx,
+}

obsidian_syncserver_npm/build.yaml

@@ -0,0 +1,4 @@
+---
+build_from:
+  aarch64: jc21/nginx-proxy-manager:2.15.1
+  amd64: jc21/nginx-proxy-manager:2.15.1

obsidian_syncserver_npm/config.yaml

@@ -0,0 +1,34 @@
+name: "Obsidian Sync Server NPM"
+slug: obsidian_syncserver_npm
+image: ghcr.io/alexbelgium/obsidian_syncserver_npm-{arch}
+description: "Self-hosted Obsidian LiveSync backend on CouchDB, bundled with Nginx Proxy Manager for TLS and certificate management."
+version: "3.5.2.1"
+url: "https://github.com/alexbelgium/hassio-addons/tree/master/obsidian_syncserver_npm"
+arch:
+  - amd64
+  - aarch64
+startup: services
+init: false
+ports:
+  5984/tcp: 5984
+  80/tcp: 80
+  81/tcp: 81
+  443/tcp: 443
+ports_description:
+  5984/tcp: "CouchDB HTTP (direct access, desktop Obsidian)"
+  80/tcp: "HTTP (certificate validation and redirect)"
+  81/tcp: "Nginx Proxy Manager admin UI"
+  443/tcp: "HTTPS — use this for mobile Obsidian"
+webui: "http://[HOST]:[PORT:81]"
+map:
+  - addon_config:rw
+options:
+  username: admin
+  password: ""
+  database: obsidian
+  log_level: info
+schema:
+  username: str
+  password: password?
+  database: match(^[a-z][a-z0-9_$()+/-]*$)
+  log_level: list(debug|info|warn|error)

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/addon-init/script

@@ -0,0 +1,20 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+# NPM's own "prepare" service aborts the entire boot if /etc/letsencrypt is
+# not a mount. Home Assistant does not mount it, so point it at /data, which
+# Supervisor persists as a Docker volume.
+#
+# This is an s6-rc oneshot that "prepare" depends on, so it is guaranteed to
+# run first. NPM's image uses s6-overlay v3 and has no /etc/cont-init.d.
+
+if [ ! -L /etc/letsencrypt ]; then
+    mkdir -p /data/letsencrypt
+    if [ -d /etc/letsencrypt ] && [ -n "$(ls -A /etc/letsencrypt 2> /dev/null)" ]; then
+        cp -a /etc/letsencrypt/. /data/letsencrypt/ 2> /dev/null || true
+    fi
+    rm -rf /etc/letsencrypt
+    ln -sf /data/letsencrypt /etc/letsencrypt
+fi
+
+mkdir -p /data/letsencrypt
+echo "[obsidian-syncserver] /etc/letsencrypt -> /data/letsencrypt"

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/addon-init/type

@@ -0,0 +1 @@
+oneshot

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/addon-init/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/addon-init/script

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/couchdb/finish

@@ -0,0 +1,3 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+exit 0

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/couchdb/run

@@ -0,0 +1,3 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+exec /run.sh

obsidian_syncserver_npm/rootfs/etc/s6-overlay/s6-rc.d/couchdb/type

@@ -0,0 +1 @@
+longrun