v4.2.2: token dialog and sidebar link fixes

🐛 Fixes

• API tokens: a new token can no longer be lost by a stray click. While the
  token is shown, clicking outside the dialog or pressing Escape no longer
  closes it. The token is shown only once and can't be revoked on its own, so
  closing it by accident left a valid token nobody had. Close the dialog with
  "Done" or the close button. (patch 0005)
• Sidebar: menu and dashboard links now open in a new tab. Their addresses
  lacked the Home Assistant ingress path, so "Open in new tab", middle-click
  and Ctrl/Cmd-click led to a Home Assistant error page. Normal clicks and
  port 81 were not affected. (patch 0004)

📝 Documentation

• The add-on's Documentation tab now covers the sidebar and API tokens.
• Corrected the 4.2.1 notes: Node.js 22.23.4 fixes 6 CVEs, not 7.

These came out of a review of the fork's own v4.1.0–v4.2.1 changes. Nothing
else changed: Nginx Proxy Manager 2.16.0, nginx 1.31.8, Node.js 22.23.4,
certbot 5.9.0 and debian-base 9.5.2 are all still the latest.

✅ Verification

Built and tested on real aarch64 hardware running Home Assistant OS: the
token dialog stays open on an outside click or Escape, menu and dashboard links
open in a new tab from the sidebar, and port 81 and the sidebar work as
before.

v4.2.1: Node.js 22.23.4 security update

⬆️ Security update: Node.js 22.23.4

• Node.js 22.23.3 → 22.23.4 (nodejs=22.23.4-1nodesource1). This is a
  Node.js security release: 6 CVEs fixed in http, tls, dns, crypto, the
  permission model and brotli, plus bundled OpenSSL 3.5.9, newer root
  certificates and undici 6.29.1. The Nginx Proxy Manager backend runs on Node.js.
• apache2-utils 2.4.68-1~deb13u1 → 2.4.69-1~deb13u1 (Debian security
  update). Its CVEs are in Apache HTTP Server modules; the add-on only uses the
  htpasswd tool, so this is housekeeping.

Both pins are ahead of upstream, whose automated updates missed the Node.js
security release. Everything else is unchanged and already the latest:
Nginx Proxy Manager 2.16.0, nginx 1.31.8, certbot 5.9.0, debian-base 9.5.2.

✅ Verification

Built and tested on real aarch64 hardware running Home Assistant OS: the
container runs Node.js v22.23.4, API tokens still authenticate, and port 81
and the sidebar work.

v4.2.0: API tokens in the user menu

✨ API tokens in the user menu

Scripts can now get a longer-lived API token from the interface. Open the user
menu → "API Tokens", confirm your password (and two-factor code, when
enabled), choose how long the token lasts — 1 day, 7 days, 30 days, 90 days,
1 year, 2 years or 3 years — and copy the token. It is shown once.

curl -H "Authorization: Bearer <token>" http://<home-assistant>:81/api/nginx/proxy-hosts

How it works

• New patch 0005-Patch-add-API-tokens-to-the-user-menu: POST /api/tokens
  and POST /api/tokens/2fa accept an optional expiry from the list above.
  Logins without it still last 1 day.
• No database changes, so the patch can be dropped cleanly if upstream ships
  stored tokens (NginxProxyManager/nginx-proxy-manager#5975).

🔒 Security

• GET /api/tokens (token refresh) no longer accepts ?expiry=. Upstream let
  any logged-in session swap its token for one of any lifetime without the
  password. A refresh now always lasts 1 day; longer tokens need the password.

ℹ️ Good to know

• Tokens aren't stored, so they can't be listed or revoked one by one.
  Changing the user's password ends every token issued before it, and
  disabling the user ends all of its tokens.
• A token acts as its user, with that user's permissions. For scripts, create
  a dedicated user with only the permissions it needs.
• A 2- or 3-year token can expire a few hours before the displayed time
  (upstream computes the two slightly differently).

✅ Verification

Built and tested on real aarch64 hardware running Home Assistant OS: a
token from the user menu authenticates API calls on port 81, a wrong password
shows an error without logging out, and login/logout and the sidebar still
work.

v4.1.0 — Home Assistant ingress (show in sidebar)

✨ Show Nginx Proxy Manager in the Home Assistant sidebar

The add-on now supports Home Assistant ingress. Turn on "Show in
sidebar" on the add-on page and the interface opens inside Home Assistant.
That also works over HTTPS and remote access, with no extra port to open. The
admin port 81 keeps working exactly as before.

Upstream declined ingress support
(hassio-addons#649), so this is a fork-only feature.

How it works

• New patch 0004-Patch-support-Home-Assistant-ingress makes the Nginx
  Proxy Manager frontend base-path aware. It builds with a relative base and
  reads its path prefix at runtime from an ingress-path meta tag; the API
  client, the router and the image paths use it. On port 81 the prefix is
  empty, so nothing changes there.
• New rootfs/etc/nginx/conf.d/ingress.conf: an nginx server on the
  ingress port 8099 that only the Supervisor can reach. It serves the
  interface and fills in the meta tag from the X-Ingress-Path header. Port
  8099 is not exposed on the host.
• config.yaml: ingress: true, ingress_port: 8099,
  panel_icon: mdi:web. "Open Web UI" now opens the interface through ingress.

ℹ️ Good to know

• The sidebar and port 81 have separate logins. The interface keeps its
  login in the browser's per-site storage, and the sidebar runs under Home
  Assistant's address, so log in once in each.

✅ Verification

Built and tested on real aarch64 hardware running Home Assistant OS: the
interface opens from the sidebar, and port 81 keeps working.

v4.0.1 — certbot 5.9.0 + debian-base 9.5.2

Maintenance release — catches up to upstream HEAD (hassio-addons PR hassio-addons#778, hassio-addons#779).

⬆️ Upgrades

• certbot 5.8.0 → 5.9.0 (installed in the /opt/certbot pip venv via
  ARG CERTBOT_VERSION).
• Base image ghcr.io/hassio-addons/debian-base 9.5.1 → 9.5.2
  (ARG BUILD_FROM).

No other dependency changed: nginx is already at the latest nginx.org mainline
1.31.8, and the Nginx Proxy Manager app stays at 2.16.0.

✅ Verification

Built and ran clean on real aarch64 hardware running Home Assistant OS.

v4.0.0 — Debian re-sync (Nginx Proxy Manager 2.16.0)

Re-sync with the re-architected upstream add-on. Upstream solved the Nginx
Proxy Manager v2.13+ frontend rewrite (webpack → Vite) by rebasing the whole
add-on from Alpine onto Debian; this release adopts that work.

⚠️ Breaking / major changes

• Base image switched from Alpine to Debian — now builds on
  ghcr.io/hassio-addons/debian-base:9.5.1 (Debian trixie). Supported
  architectures are unchanged (aarch64, amd64); 32-bit ARM remains dropped
  (since v3.0.0).
• Nginx Proxy Manager app v2.12.4 → v2.16.0 (frontend is now Vite +
  React 19 + TypeScript).
• nginx 1.30.2 (Alpine, stable) → 1.31.8 (nginx.org mainline Debian repo).
  The stream module is compiled in statically, so nginx-mod-stream is gone.
• Node.js 24 (Alpine) → 22 (NodeSource); the old webpack-era
  NODE_OPTIONS=--openssl-legacy-provider workaround is removed (Vite build).
• certbot now installed in a pip venv at /opt/certbot (certbot 5.8.0),
  pinned via PIP_CONSTRAINT, instead of the Alpine certbot package.
• Dependencies are now Debian apt packages (pinned to Debian trixie)
  instead of Alpine apk pins.

🔁 Patches

• Replaced the 6 Alpine-era patches with upstream's current 3
  (data-to-config-folder, keep-log-files-out-of-the-config-share,
  certbot-plugin-install-failures-at-startup). The old node-sass / webpack /
  sass-loader patches are obsolete under Vite; the logrotate and nginx
  root-user fixes are now carried by upstream itself.

🗂 Fork specifics

• Root repository.yaml (so this single add-on installs as a custom
  repository), config.yaml url pointing at this fork, and a single
  ARG BUILD_FROM base (no build.yaml).
• config.yaml map: uses the current spec's object form
  (type: app_config / read_only: false) instead of the deprecated
  addon_config:rw short form — same /config mount, no Supervisor
  deprecation warning.

✅ Verification

Built and ran clean on real aarch64 hardware (Home Assistant OS 18.4,
HA Core 2026.11.0b2, Supervisor 2026.10.5): the Vite yarn build, the
nginx.org / NodeSource apt repos, and certbot in its venv all succeeded; the
NPM backend came up on port 3000, database migrations ran, and logrotate was
clean.

v3.0.0 — base 21 / nginx 1.30 (drops armv7)

⚠️ Breaking change

armv7 (32-bit ARM) support has been dropped. The Home Assistant base image no longer ships 32-bit builds from version 19 onward. Devices that need armv7 must stay on the 2.x series.

Supported architectures: aarch64, amd64.

⬆️ Upgrades

• Base image ghcr.io/hassio-addons/base 18.2.0 → 21.0.0 (Alpine 3.22 → 3.24)
• nginx 1.28.0-r3 → 1.30.2-r1 (current stable branch; nginx-mod-stream matched)
• Node.js 22.16.0 → 24.16.0
• npm 11.3.0 → 11.12.1
• Python 3.12.12 → 3.14.5
• py3-pip 25.1.1 → 26.1.2
• certbot 4.0.0 → 5.6.0
• OpenSSL 3.5.4 → 3.5.7
• Plus build-base, git, libffi-dev, apache2-utils, libcap, logrotate re-pinned to Alpine 3.24.

🧪 Verify before deploying

The frontend yarn build (Node 22 → 24) and certbot (4 → 5) are the highest-risk areas of this bump — build and smoke-test on amd64/aarch64 before rolling out.

🤖 Generated with Claude Code