mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-23 13:23:32 +02:00
278eeb931b
* Fix Bazarr ingress: keep redirects relative so they aren't blocked as mixed content Opening the Bazarr panel over HTTPS failed with: Mixed Content: ... requested an insecure frame 'http://<ha_host>:8099/bazarr/'. This request has been blocked Bazarr is Flask-based and answers /bazarr (the ingress entry, which has no trailing slash) with a redirect to /bazarr/, made absolute against the Host nginx sends upstream -- http://127.0.0.1:6767/bazarr/. proxy_redirect's implicit "default" rule strips that prefix, which makes nginx treat the Location as its own; the header filter then re-absolutises it as $scheme://$host:$server_port/... Since $host is the browser's host forwarded by the Supervisor and $server_port is the ingress port (8099, the Supervisor default as no ingress_port is declared), the result is a plain-http URL on a port the browser refuses to frame from an https page. absolute_redirect off keeps the Location relative, and the proxy_redirect rules re-prefix it with the ingress entry so it resolves under /api/hassio_ingress/<token>/. The second rule also covers backends that emit an already-relative Location; external absolute redirects match neither rule and pass through untouched. Verified against a local nginx with a stand-in backend: the pre-fix config reproduces http://<host>:<ingress_port>/bazarr/ exactly, and the fixed config returns /api/hassio_ingress/<token>/bazarr/ for both absolute and relative upstream Locations while leaving an external redirect alone. Also fixes the fallback base_url in services.d/nginx/run, which wrote it without the leading / and so reintroduced the startup crash fixed in 1.5.6-4. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Tighten base_url guard in nginx run script to require the leading slash CodeRabbit review on #2910: the guard `grep -q "base_url.*$slug"` matches both "base_url: bazarr" and "base_url: /bazarr" -- the .* swallows the slash -- so it treated the malformed no-slash form as already correct and never triggered the repair. Require the literal "base_url: /$slug" instead, so a config missing the slash is actually detected and fixed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
43 lines
1.6 KiB
Plaintext
43 lines
1.6 KiB
Plaintext
server {
|
|
listen %%interface%%:%%port%% default_server;
|
|
|
|
#include /etc/nginx/includes/server_params.conf;
|
|
#include /etc/nginx/includes/proxy_params.conf;
|
|
|
|
client_max_body_size 0;
|
|
|
|
location / {
|
|
add_header Access-Control-Allow-Origin *;
|
|
proxy_connect_timeout 30m;
|
|
proxy_send_timeout 30m;
|
|
proxy_read_timeout 30m;
|
|
proxy_pass http://127.0.0.1:6767;
|
|
|
|
# Allow websocket
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
#auth_basic off;
|
|
|
|
# Adjust Location headers in backend redirects
|
|
# Bazarr is Flask-based and answers /bazarr with a redirect to /bazarr/,
|
|
# made absolute against the Host nginx sends upstream, so it reads
|
|
# http://127.0.0.1:6767/bazarr/. proxy_redirect strips that prefix, and
|
|
# nginx then re-absolutises the result as $scheme://$host:$server_port/...
|
|
# i.e. http://<ha_host>:8099/bazarr/ -- blocked by the browser as mixed
|
|
# content inside the ingress iframe. absolute_redirect off keeps it
|
|
# relative; the proxy_redirect rules re-prefix it with the ingress entry
|
|
# (the second rule also covers a redirect that was relative already).
|
|
absolute_redirect off; # Do not add port to redirect
|
|
proxy_redirect http://127.0.0.1:6767/ %%ingress_entry%%/;
|
|
proxy_redirect / %%ingress_entry%%/;
|
|
|
|
# Correct base_url
|
|
proxy_set_header Accept-Encoding "";
|
|
sub_filter_once off;
|
|
sub_filter_types *;
|
|
sub_filter /bazarr %%ingress_entry%%/bazarr;
|
|
}
|
|
|
|
}
|