Public Access
admin
7838c49721
- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH, require_session uses secrets.compare_digest and respects trusted-network opt-in, main.py adds require_family_session middleware gating all /api/ routes except auth/admin/email-vote-token paths - docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH through to backend + scheduler (fixes env-file changes not reaching runtime) - frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename, vite base './'), Login redirect honors APP_BASE_PATH - nginx: no-cache headers on root + /assets/ - docs: Home Assistant Ingress install/troubleshooting + plan file - tests: test_auth expects 401 on no-session GET Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true (HA is the auth boundary; MealPlanner must not be port-forwarded directly).
1.0 KiB
1.0 KiB
Home Assistant Ingress Add-on
Goal
Expose MealPlanner through Home Assistant Ingress while keeping MealPlanner off the public Internet.
Tasks
- Add HA add-on metadata and nginx proxy wrapper -> Verify:
mealplanner-ingress/config.yaml,Dockerfile,run.shexist. - Make frontend path-prefix aware for Ingress -> Verify: Vite base, router basename, and API base derive from
/api/hassio_ingress/.... - Re-enable session enforcement for family API routes -> Verify: missing session returns 401 unless
TRUSTED_NETWORK_AUTO_AUTH=true. - Document install and env settings -> Verify:
docs/home-assistant-ingress.mdexists. - Run backend/frontend focused checks.
- Push add-on repository metadata -> Verify: anonymous shallow clone contains
repository.yamlandmealplanner-ingress/config.yaml.
Done When
- Add-on config validates enough to build in Home Assistant.
- Frontend builds.
- Backend auth tests/import checks pass.
- Home Assistant accepts the repository.