9204b31af8
* fix(calibre-web): trust the supervisor range for the ingress auth header Reimplements #3004 from the code as it stood before it, in one statement. #3004 derived the addon's own address and wrote it unconditionally on every start. That address changes across restarts, so the value had to be rewritten each boot, which erased anything the user had added to the same field from the calibre-web admin page -- and a follow-up that preserved their entries needed a merge pass and a record of what had been injected, because a preserved stale address stays trusted after supervisor hands it to another addon. Trusting 172.30.32.0/23 removes the reason for all of it: the range covers whichever address the addon gets, so the value is constant and can be written once. Both forms are listed because calibre-web listens dual-stack and an ipv4 entry never matches an ipv4-mapped address; /119 is the mapped equivalent of /23. The WHERE clause is what keeps it out of the user's way. The list is written only when the range is absent, which is true on a fresh 0.6.27 install and on an install still carrying #3004's per-address list, and false afterwards -- so an entry added in the admin page for a reverse proxy outside the supervisor network survives every later start. The trade-off is that any addon on the supervisor network can now present X-WebAuth-User to port 8083 and be logged in. Maintainer's call, taken knowingly in preference to the machinery the narrow list required. The tolerated failure from #3004 is kept: the column only exists once calibre-web 0.6.27+ has migrated app.db and cont-init runs first, so the statement is allowed to fail and the next start applies it. The sqlite error is now included in the warning rather than dropped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(calibre-web): guard on the mapped range and keep existing entries Addresses the review on #3010, both findings inside the one statement. Codex, Copilot and CodeRabbit all noted the WHERE clause tested only 172.30.32.0/23, so a value carrying the ipv4 range without the mapped form would skip the update forever while ingress stayed rejected -- a plausible state, since that is exactly what someone adds by hand after reading that the supervisor network is the source. Rather than test both, the guard now tests ::ffff:172.30.32.0/119 alone. That is the form ingress actually needs, given calibre-web listens dual-stack, and the form nobody types by hand, so it serves as the marker that this already ran. One substring either way. Copilot and CodeRabbit also noted the assignment replaced the whole column, losing an administrator entry on the first start. The required list is now prepended to the existing value instead of replacing it. No case expression is needed for the empty and NULL cases : the trailing comma that leaves behind is an empty entry, which calibre-web's parser skips. Both together cost one `||coalesce(...)` and a different substring. The statement still runs at most once, and the duplicates it can leave behind are entries calibre-web skips, or addresses inside the range now trusted anyway. Checked against a transcription of cps/reverse_proxy_auth.py from 0.6.27 : every produced value parses with nothing ignored, ::ffff:172.30.33.10 is trusted and ::ffff:192.168.1.99 is not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Home assistant add-on: Calibre-web
I maintain this and other Home Assistant add-ons in my free time: keeping up with upstream changes, HA changes, and testing on real hardware takes a lot of time (and some money). I use around 5-10 of my >110 addons so regularly I install test machines (and purchase some test services such as vpn) that I don't use myself to troubleshoot and improve the addons
If this add-on saves you time or makes your setup easier, I would be very grateful for your support!
Addon informations
Thanks to everyone having starred my repo! To star it click on the image below, then it will be on top right. Thanks!
About
Calibre-web is a web app providing a clean interface for browsing, reading and downloading eBooks using an existing Calibre database. It is also possible to integrate google drive and edit metadata and your calibre library through the app itself.
This addon is based on the docker image https://github.com/linuxserver/docker-calibre-web
Installation
The installation of this add-on is pretty straightforward and not different in comparison to installing any other add-on.
- Add my add-ons repository to your home assistant instance (in supervisor addons store at top right, or click button below if you have configured my HA)
- Install this add-on.
- Click the
Savebutton to store your configuration. - Set the add-on options to your preferences
- Start the add-on.
- Check the logs of the add-on to see if everything went well.
- Open the webUI and adapt the software options
Configuration
Webui can be found at http://homeassistant:PORT or through the sidebar using Ingress. The default username/password is described in the startup log. Configurations can be done through the app webUI, except for the following options.
Default name: admin Default password: admin123
Options
| Option | Type | Default | Description |
|---|---|---|---|
PGID |
int | 0 |
Group ID for file permissions |
PUID |
int | 0 |
User ID for file permissions |
TZ |
str | Timezone (e.g., Europe/London) |
|
DOCKER_MODS |
str | Docker modifications to apply | |
OAUTHLIB_RELAX_TOKEN_SCOPE |
str | OAuth token scope relaxation | |
ingress_user |
str | Username for ingress authentication | |
localdisks |
str | Local drives to mount (e.g., sda1,sdb1,MYNAS) |
|
networkdisks |
str | SMB shares to mount (e.g., //SERVER/SHARE) |
|
cifsusername |
str | SMB username for network shares | |
cifspassword |
str | SMB password for network shares | |
cifsdomain |
str | SMB domain for network shares |
Example Configuration
PGID: 0
PUID: 0
TZ: "Europe/London"
DOCKER_MODS: "linuxserver/mods:universal-calibre"
ingress_user: "admin"
localdisks: "sda1,sdb1"
networkdisks: "//192.168.1.100/books"
cifsusername: "bookuser"
cifspassword: "password123"
cifsdomain: "workgroup"
Mounting Drives
This addon supports mounting both local drives and remote SMB shares:
- Local drives: See Mounting Local Drives in Addons
- Remote shares: See Mounting Remote Shares in Addons
Custom Scripts and Environment Variables
This addon supports custom scripts and environment variables:
- Custom scripts: See Running Custom Scripts in Addons
- env_vars option: Use the add-on
env_varsoption to pass extra environment variables (uppercase or lowercase names). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
Support
Create an issue on github
Illustration
