📚 Ingress and API authentification

[MelleD]

Hello,

do you use a third party app to upload, e.g. Paperparrot or Paperless Swift?
https://github.com/paperless-ngx/paperless-ngx/wiki/Affiliated-Projects

I tried to add a long living bearer token in HA and include it as a header in the request. But unfortunately I can't get through. Can I access the paperless UI without going to home assistant?

[BenoitAnastay]

Yes, you will have to go on the addon configuration tab then enable a port.

There is no way to disable Home Assistant auth for an ingress endpoint such as API, that why we need to enable direct access.

If I add the HA auth to Paperless through ingress i'll probably add a port that will only be usable for API

[MelleD]

@BenoitAnastay thanks let me try :)

[MelleD]

Nice works, but the sidebar ist now not working anymore.
"Ingress is disabled because you opended a port".

Is it possible to not adjust the URL for the sidebar? Maybe internal url + port or a properties to customize the url so that you can continue to use the sidebar?

Or maybe provide both e.g. EVCC provide the ingress and also the UI on port 7070. So you can use the sidebar and the UI directly with the port.
https://github.com/evcc-io/hassio-addon

[BenoitAnastay]

Have you updated the add-on to the last release?

[MelleD]

Ah lol. Sorry didn't see the last release.
But interesting, I only installed it yesterday, why didn't I get 1.1.3 straight away and I don't see an update either.

[BenoitAnastay]

My apologies, it wasn't pushed to the repository, I don't know why

[MelleD]

No problem. When it's available I'll test the new version :)

[BenoitAnastay]

It's updated, there was a weird bug on GitHub side 1.1.2 was stuck as last release even though 1.2.3 was tagged last 🤔🤷‍♂️

[MelleD]

Works thank you a lot

[MelleD]

Interesting one if i have no token and login directly. I get this error (maybe this is the issue why i get no connection from the mobile app).

If I use first the HA instance and login it works

[BenoitAnastay]

It's #69 issue.

On network configuration https://my.home-assistant.io/redirect/network/

You can manually set internal URL to http://homeassistant.local:8123

Then restart home assistant, you may need to do the same for external_url it will also extract base host to set the direct access to the list of allowed URLs

[MelleD]

And if add as URL: http://homeassistant.local:7071/ then it's the other way around :).

[MelleD]

It's #69 issue.

Are you sure?
Maybe i have just to set this
https://docs.paperless-ngx.com/configuration/#PAPERLESS_CSRF_TRUSTED_ORIGINS
to http://homeassistant.local:8123/,http://homeassistant.local:7071

[BenoitAnastay]

There's a script integrated that will set this automatically using defined external url and internal url

paperless-home-assistant-addon/paperless-ngx/rootfs/etc/s6-overlay/s6-rc.d/init-paperless/run

Lines 33 to 37 in 33fb5f3

	# Get all possible URLs
	result=$(bashio::api.supervisor GET /core/api/config true || true)
	urls+=("$(bashio::info.hostname)")
	urls+=("$(bashio::jq "$result" '.internal_url' | cut -d'/' -f3 | cut -d':' -f1)")
	urls+=("$(bashio::jq "$result" '.external_url' | cut -d'/' -f3 | cut -d':' -f1)")

As you can see I forgot to append .local to the hostname (and yes it's hardcoded in Home Assistant)

[MelleD]

Iam not using the external url, because my instance is just locally available or with the internal url over VPN (tailscale)

so IMHO what is missing, is when a port is set the in the config also to add this url
e.g. internal url + defined port in my case http://homeassistant.local:7071

EDIT:
Ah it's here:
urls

The addon port is in my case the 7071, correct?

[BenoitAnastay]

The addon port is in my case the 7071, correct?

Yes it's taking the value form the one you put in your addon configuration

[MelleD]

Ok got it.
Then I think with the issue #69 there are two missing urls.
a) the url with .local and default port (8123)
b) the url with .local and add on port

As long as that isn't fixed, I'll try it myself. But now I can't log in at all. Now I'm confused :D
PAPERLESS_CSRF_TRUSTED_ORIGINS=http://homeassistant.local:8123,http://homeassistant.local:7071
or is it not possible do override it?

[BenoitAnastay]

This setting can be set in /addons_config/ca5234a0_paperless-ngx/paperless.conf

there are two missing urls
This is already the case it does extract the host and use both schemes and ports, I just forgot to add .local to hostname

It should also work with IPs

[MelleD]

This setting can be set in /addons_config/ca5234a0_paperless-ngx/paperless.conf

Yes I know I also set this PAPERLESS_OCR_USER_ARGS={"invalidate_digital_signatures": true}. This worked, but not the PAPERLESS_CSRF_TRUSTED_ORIGINS.

It should also work with IPs

You are right, then 4 :)

[BenoitAnastay]

You can enable DEBUG to have a more verbose error message

[MelleD]

I have no luck so far with the config file. Maybe I just wait for your fix and test again.
"Paper Less" app works so far. The other two are not working but one should be enough :D...
I have just a limit to upload files >10MB was not working. I think this a nginx limit body size limit, correct?

[BenoitAnastay]

I'll open another issue for nginx upload limit, the #69 is planned to be fixed with tomorrow update