Hauser v0.4.0-beta.6

Release identity

Version	0.4.0-beta.6
Git tag	v0.4.0-beta.6 (annotated, 77cc73ca)
Source commit	818fc227bcaa24ca0f3118d16c0688b787d391b3
Image	ghcr.io/ralleur/hauser@sha256:2c854874f0837798d62387e0f394253fddec015db6b0bbad5df0a787e5779c4a
Also tagged	:v0.4.0-beta.6 and :0.4.0-beta.6 (same manifest; the Supervisor resolves the unprefixed tag)
Platforms	linux/amd64, linux/arm64
Config schema	v3, with the v1 → v3 migration path included

What changed

Fixed — setup activation rejected on non-allowlisted hostnames (#8)

POST /api/setup/activate and every other direct-browser API route (setup,
proxy, config, household-config, family data, ambient, ablage, notion bridge,
song library) checked the Origin header only against the static
HMI_ALLOWED_ORIGINS allowlist. Installations reached through a hostname not
in that list — for example the Home Assistant App's default
homeassistant.local:4173 — got 403 SETUP_REQUEST_FORBIDDEN on every setup
request, blocking onboarding entirely.

A request is now also accepted whenever its Origin header matches the
request's own effective Host header exactly (same origin, independent of
hostname), on top of the existing static allowlist. Cross-origin requests are
still rejected.

Installation or update

Back up before changing images. For the App, create a Home Assistant backup
that includes Hauser; for Compose, run ./scripts/backup.sh.

Fresh Compose install:

git clone https://github.com/ralleur/hauser.git
cd hauser
docker compose up -d

Update from v0.4.0-beta.5:

./scripts/backup.sh
git pull
docker compose pull
docker compose up -d

Home Assistant OS App: the App Store offers 0.4.0-beta.6 once the
repository is refreshed; existing installations are offered the update
because the manifest version changed.

Rollback to the previous release by immutable reference:

ghcr.io/ralleur/hauser@sha256:963564a36c4e6be32d9feded0dd99694200d6454164956f23516c3821d0dc528

Verification evidence

All results below are from the release preflight and the tag workflow for
this exact commit, plus a manual post-publish pull of the published digest.

Check	Result
Unit tests	1122 passed (86 files)
Typecheck (svelte-check)	0 errors, 0 warnings
Production build, demo build, Pages build	pass
Container: setup-required start	setup_required=PASS
Container: schema migration v1 → v3	migration_v1_to_v3=PASS
Container: backup and restore	backup_restore=PASS
Container: invalid config stays fail-closed	invalid_config=PASS
Container: failed migration stays fail-closed	invalid_migration=PASS
Post-publish pull of the exact digest	pass — pulled by digest, container reports healthy, /api/health returns setup_required, UI serves HTTP 200
Published image carries this fix	verified — against the running published container, POST /api/setup/activate with a foreign Origin still returns 403, while a same-origin request now reaches request handling (400 on an empty body, not 403)
Image labels	org.opencontainers.image.version=0.4.0-beta.6, revision=818fc227bcaa24ca0f3118d16c0688b787d391b3

Known limitations

• The static HMI_ALLOWED_ORIGINS allowlist remains available and still takes
  precedence for setups that deliberately front the App behind a different
  origin (e.g. a reverse proxy that rewrites Host).
• No external real-home installation has run on this release. The evidence
  above is maintainer-operated clean-room, container-contract and post-publish
  testing.
• Hauser is not an Ingress application and adds no authentication of its own.
• The App supports amd64 and aarch64 only.

Security and support

Report vulnerabilities as described in SECURITY.md. Hauser
is a self-hosted hobby project with no service-level agreement and no
compatibility promise beyond the documented paths. Do not expose the port
directly to the internet without an authentication and TLS boundary in front
of it.