mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-22 04:43:33 +02:00
ca0f78f10e
* fix(portainer): request identity encoding on the ingress listener Portainer compresses its own responses, so every response reached Home Assistant's ingress relay gzipped and chunked, with no Content-Length. Both relay hops (Supervisor api/ingress.py and Core hassio/ingress.py) only take their buffered path for responses carrying a Content-Length under 4 MB; everything else goes through the streaming path, where an aiohttp error surfaces to the browser as 502 Bad Gateway even though the add-on's own nginx logged a 200. proxy_params.conf already stripped Accept-Encoding, but the location block declares its own proxy_set_header directives, and nginx discards every server-level proxy_set_header once a location sets any of its own (the comment above those lines warns about exactly this). The strip was therefore dead config. The same server block serves both the ingress listener and the direct web UI port, so the strip is scoped through a map on $server_port: ingress gets identity, direct access keeps compression. The map keys on the direct-access port rather than the templated ingress port, so the default stays correct if the ingress port ever changes. Verified with a local nginx against the live Portainer backend: - ingress listener, client sending "Accept-Encoding: gzip, deflate" -> identity, Content-Length: 14203 - direct listener, same request -> Content-Encoding: gzip, chunked - direct listener, no Accept-Encoding -> identity, Content-Length - websocket upgrade through ingress still reaches Portainer (401 auth) - nginx -t passes for both the ssl and non-ssl rendered variants Partial mitigation only: vendor.js (5.7 MB) and main.js (7.0 MB) exceed the 4 MB buffering threshold uncompressed and still stream. This supersedes 2.43.0.1, which disabled nginx's own gzip module rather than the compressor that was actually running. Refs #2766 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(portainer): request identity explicitly on the ingress listener Address review feedback: use "identity" rather than an empty value as the map default. Both were verified to produce identity responses with a Content-Length from Portainer, and both leave direct access on 9099 compressed, but "identity" states the intent explicitly instead of relying on the server's choice when no Accept-Encoding is present. Also reword the changelog entry for readability. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>