Public Access
admin
7838c49721
- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH, require_session uses secrets.compare_digest and respects trusted-network opt-in, main.py adds require_family_session middleware gating all /api/ routes except auth/admin/email-vote-token paths - docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH through to backend + scheduler (fixes env-file changes not reaching runtime) - frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename, vite base './'), Login redirect honors APP_BASE_PATH - nginx: no-cache headers on root + /assets/ - docs: Home Assistant Ingress install/troubleshooting + plan file - tests: test_auth expects 401 on no-session GET Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true (HA is the auth boundary; MealPlanner must not be port-forwarded directly).
19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
# Home Assistant Ingress Add-on
|
|
|
|
## Goal
|
|
Expose MealPlanner through Home Assistant Ingress while keeping MealPlanner off the public Internet.
|
|
|
|
## Tasks
|
|
- [x] Add HA add-on metadata and nginx proxy wrapper -> Verify: `mealplanner-ingress/config.yaml`, `Dockerfile`, `run.sh` exist.
|
|
- [x] Make frontend path-prefix aware for Ingress -> Verify: Vite base, router basename, and API base derive from `/api/hassio_ingress/...`.
|
|
- [x] Re-enable session enforcement for family API routes -> Verify: missing session returns 401 unless `TRUSTED_NETWORK_AUTO_AUTH=true`.
|
|
- [x] Document install and env settings -> Verify: `docs/home-assistant-ingress.md` exists.
|
|
- [x] Run backend/frontend focused checks.
|
|
- [x] Push add-on repository metadata -> Verify: anonymous shallow clone contains `repository.yaml` and `mealplanner-ingress/config.yaml`.
|
|
|
|
## Done When
|
|
- [x] Add-on config validates enough to build in Home Assistant.
|
|
- [x] Frontend builds.
|
|
- [x] Backend auth tests/import checks pass.
|
|
- [x] Home Assistant accepts the repository.
|