admin/Meal-Planner

Public Access

Fork 0

Files

T

admin 7838c49721

CI / backend (pytest + alembic) (push) Has been cancelled

Details

CI / frontend (build) (push) Has been cancelled

Details

feat(auth): harden sessions + HA Ingress support

- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH,
  require_session uses secrets.compare_digest and respects trusted-network
  opt-in, main.py adds require_family_session middleware gating all /api/
  routes except auth/admin/email-vote-token paths
- docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH
  through to backend + scheduler (fixes env-file changes not reaching runtime)
- frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename,
  vite base './'), Login redirect honors APP_BASE_PATH
- nginx: no-cache headers on root + /assets/
- docs: Home Assistant Ingress install/troubleshooting + plan file
- tests: test_auth expects 401 on no-session GET

Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true
(HA is the auth boundary; MealPlanner must not be port-forwarded directly).

2026-06-30 16:11:33 -07:00

1.9 KiB

Raw Blame History

Home Assistant Ingress

MealPlanner can be exposed through Home Assistant by installing the mealplanner-ingress add-on. The add-on is an authenticated Ingress proxy to the existing MealPlanner Docker deployment; it does not run the database, backend, or frontend itself.

Install

In Home Assistant, go to Settings -> Add-ons -> Add-on Store -> Repositories.
Add this repository URL: https://git.research.bike/admin/Meal-Planner.git.
Install MealPlanner Ingress from the add-on store.
Set upstream_url to the LAN URL for the existing MealPlanner nginx service, for example http://192.168.1.54:8082.
Start the add-on and open the MealPlanner sidebar item.

Required MealPlanner Env

Set these in MealPlanner's .env before exposing it through Home Assistant:

ADMIN_TOKEN=<random-admin-token>
SESSION_PASSWORD=<family-shared-password>
SECRET_KEY=<random-secret>
SESSION_COOKIE_SECURE=false
TRUSTED_NETWORK_AUTO_AUTH=true

Home Assistant is the authentication boundary in this setup. TRUSTED_NETWORK_AUTO_AUTH=true removes the extra MealPlanner password prompt, so do not port-forward MealPlanner directly.

Network Model

Public Internet -> Home Assistant auth/MFA -> Ingress -> MealPlanner LAN URL.
Do not port-forward MealPlanner directly.
Keep the existing MealPlanner compose stack bound to the LAN only.

Troubleshooting

could not read Username: the Git repository is not anonymously cloneable from Home Assistant. Make the repository public, or use a separate public add-on repository.
not a valid app repository: Home Assistant cloned the repository, but did not find valid add-on metadata. Confirm repository.yaml exists at the repository root and mealplanner-ingress/config.yaml exists on the default branch.
Short/clipped display: do not use an embedded WebURL card for this app. Use the MealPlanner Ingress add-on sidebar item so Home Assistant proxies the full UI.

1.9 KiB Raw Blame History