mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-11-04 11:42:15 +00:00
2f733f33f5
* feat(omniroute): add OmniRoute add-on v3.8.52 * docs(omniroute): fix markdown list spacing and table formatting * fix(omniroute): sanitize nginx log format, drop json sub_filter, and drop privileges when PUID configured * fix(omniroute): use --clear-groups in setpriv to allow numeric PUID without passwd entry * fix(omniroute): ensure cp error stops migration before rm -rf deletes data * refactor(omniroute): simplify and align with repo architecture based on maintainer review * omniroute: keep upstream CSP, fix healthcheck, drop non-Supervisor fallbacks - ingress.conf: rewrite only frame-ancestors 'none' -> 'self' in upstream's CSP (nginx map) instead of replacing it with a broad one - Dockerfile: healthcheck used '&>' which dash (/bin/sh) parses as a background job, so it could never fail; use '>/dev/null 2>&1' - drop :-/ingress, :-8099, :-0.0.0.0 and || true fallbacks - delete 20-config_location.sh (only created the mounted /config) - config.yaml: no empty INITIAL_PASSWORD default; OMNIROUTE_MEMORY_MB int - CHANGELOG/README: port 20128 is opt-in; TZ and password have no default Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * omniroute: wrap long config.yaml lines Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: BirdNET-Go Addon Builder <addon-builder@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
1.6 KiB
Plaintext
46 lines
1.6 KiB
Plaintext
# Upstream's CSP with only frame-ancestors 'none' relaxed to 'self' (see below).
|
|
# An empty value, when upstream sends no CSP, makes add_header send nothing.
|
|
map $upstream_http_content_security_policy $omniroute_csp {
|
|
default $upstream_http_content_security_policy;
|
|
"~*^(?<csp_pre>.*)frame-ancestors\s+'none'(?<csp_post>.*)$" "${csp_pre}frame-ancestors 'self'${csp_post}";
|
|
}
|
|
|
|
server {
|
|
listen %%interface%%:%%port%% default_server;
|
|
listen 20128 default_server;
|
|
|
|
client_max_body_size 0;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_buffering off;
|
|
proxy_read_timeout 30m;
|
|
proxy_send_timeout 30m;
|
|
|
|
# Upstream sends X-Frame-Options: DENY and frame-ancestors 'none' on every route
|
|
# (its DASHBOARD_ALLOW_EMBED switch is build-time only), which blocks the Home
|
|
# Assistant ingress iframe. Allow same-origin framing, keep the rest of its CSP.
|
|
proxy_hide_header X-Frame-Options;
|
|
proxy_hide_header Content-Security-Policy;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Content-Security-Policy $omniroute_csp always;
|
|
|
|
location = / {
|
|
proxy_pass http://127.0.0.1:20129%%ingress_entry%%;
|
|
}
|
|
|
|
location %%ingress_entry%% {
|
|
proxy_pass http://127.0.0.1:20129;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:20129%%ingress_entry%%/;
|
|
}
|
|
}
|