🔨 ✨ Migrate to hassio ingress hybrid setup

thelounge/Dockerfile

@@ -9,6 +9,7 @@ RUN \
         yarn=1.12.3-r0 \
     \
     && apk add --no-cache \
+        nginx=1.14.2-r0	\
         nodejs-current=11.3.0-r0 \
     \
     && yarn global add \

thelounge/config.json

@@ -16,8 +16,11 @@
   "boot": "auto",
   "hassio_api": true,
   "hassio_role": "default",
+  "homeassistant": "0.91.1",
   "homeassistant_api": true,
   "host_network": false,
+  "ingress": true,
+  "ingress_port": 15102,
   "ports": {
     "15100/tcp": 15100
   },

thelounge/rootfs/etc/cont-init.d/15-nginx.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/with-contenv bashio
+# ==============================================================================
+# Community Hass.io Add-ons: Visual Studio Code
+# Configures NGINX for use with code-server
+# ==============================================================================
+declare certfile
+declare keyfile
+
+mkdir -p /var/log/nginx
+
+if bashio::config.true 'ssl'; then
+    certfile=$(bashio::config 'certfile')
+    keyfile=$(bashio::config 'keyfile')
+
+    sed -i "s/%%certfile%%/${certfile}/g" /etc/nginx/nginx-ssl.conf
+    sed -i "s/%%keyfile%%/${keyfile}/g" /etc/nginx/nginx-ssl.conf
+fi

thelounge/rootfs/etc/nginx/nginx-ssl.conf

@@ -0,0 +1,66 @@
+worker_processes  1;
+pid /var/run/nginx.pid;
+error_log stderr;
+env HASSIO_TOKEN;
+env ENABLE_HASSIO_INGRESS;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    access_log         stdout;
+    include            mime.types;
+    default_type       application/octet-stream;
+    sendfile           on;
+    keepalive_timeout  65;
+    resolver           127.0.0.11;
+
+    upstream thelounge {
+        ip_hash;
+        server 127.0.0.1:15100;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        server_name hassio.local;
+        listen 15102 default_server ssl;
+        root /dev/null;
+
+        ssl_certificate /ssl/%%certfile%%;
+        ssl_certificate_key /ssl/%%keyfile%%;
+        ssl_protocols TLSv1.2;
+        ssl_prefer_server_ciphers on;
+        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA;
+        ssl_ecdh_curve secp384r1;
+        ssl_session_timeout  10m;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+        ssl_stapling on;
+        ssl_stapling_verify on;
+
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Robots-Tag none;
+
+        location / {
+            proxy_redirect off;
+            proxy_pass http://thelounge;
+
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Authorization "";
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-NginX-Proxy true;
+        }
+    }
+}

thelounge/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,52 @@
+worker_processes  1;
+pid /var/run/nginx.pid;
+error_log stderr;
+env HASSIO_TOKEN;
+env ENABLE_HASSIO_INGRESS;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    access_log         stdout;
+    include            mime.types;
+    default_type       application/octet-stream;
+    sendfile           on;
+    keepalive_timeout  65;
+    resolver           127.0.0.11;
+
+    upstream thelounge {
+        ip_hash;
+        server 127.0.0.1:15100;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    server {
+        server_name hassio.local;
+        listen 15102 default_server;
+        root /dev/null;
+
+        location / {
+            proxy_redirect off;
+            proxy_pass http://thelounge;
+
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Authorization "";
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-NginX-Proxy true;
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+        }
+    }
+}

thelounge/rootfs/etc/services.d/nginx/finish

@@ -0,0 +1,9 @@
+#!/usr/bin/execlineb -S0
+# ==============================================================================
+# Community Hass.io Add-ons: The Lounge
+# Take down the S6 supervision tree when Nginx fails
+# ==============================================================================
+if -n { s6-test $# -ne 0 }
+if -n { s6-test ${1} -eq 256 }
+
+s6-svscanctl -t /var/run/s6/services

thelounge/rootfs/etc/services.d/nginx/run

@@ -0,0 +1,19 @@
+#!/usr/bin/with-contenv bashio
+# ==============================================================================
+# Community Hass.io Add-ons: The Lounge
+# Runs the Nginx daemon
+# ==============================================================================
+declare -a options
+
+bashio::log.info "Starting Nginx..."
+
+# Enable Hassio Ingress
+export ENABLE_HASSIO_INGRESS=true
+
+options+=(-g "daemon off;")
+
+if bashio::config.true 'ssl'; then
+    options+=(-c /etc/nginx/nginx-ssl.conf)
+fi
+
+exec nginx "${options[@]}"

thelounge/rootfs/etc/services.d/thelounge/run

@@ -8,12 +8,13 @@ export THELOUNGE_HOME=/data/thelounge
 bashio::log.info "Starting The Lounge server.."
 
 exec /usr/local/bin/thelounge start \
-    -c port=15100 \
-    -c https.enable="$(bashio::config 'ssl')" \
+    -c fileUpload=true \
     -c https.ca="/ssl/$(bashio::config 'certfile')" \
     -c https.certificate="/ssl/$(bashio::config 'certfile')" \
+    -c https.enable="$(bashio::config 'ssl')" \
     -c https.key="/ssl/$(bashio::config 'keyfile')" \
-    -c fileUpload=true \
+    -c port=15100 \
     -c prefetch=true \
     -c prefetchStorage=true \
+    -c reverseProxy=true \
     -c theme="$(bashio::config 'default_theme')"