From 27eecb65de6211c8605158d25aa9747dca77bf3f Mon Sep 17 00:00:00 2001 From: root Date: Fri, 30 Jan 2026 15:02:40 +0200 Subject: [PATCH] Ingress: terminal landing page + external gateway link; add gateway_public_url; bump 0.4.3 --- moltbot_assistant/config.yaml | 7 ++- moltbot_assistant/nginx.conf.tpl | 101 +++++++++++++------------------ moltbot_assistant/run.sh | 8 ++- 3 files changed, 52 insertions(+), 64 deletions(-) diff --git a/moltbot_assistant/config.yaml b/moltbot_assistant/config.yaml index fe45c0f..35768d3 100644 --- a/moltbot_assistant/config.yaml +++ b/moltbot_assistant/config.yaml @@ -1,5 +1,5 @@ name: Moltbot Assistant -version: "0.4.2" +version: "0.4.3" slug: moltbot_assistant description: Run Moltbot Assistant (Clawdbot-compatible) as a Home Assistant add-on. url: https://github.com/techartdev/ClawdHAAddOn @@ -38,6 +38,10 @@ options: gateway_port: 18789 gateway_token: "" + # Public base URL for opening the Gateway Web UI in a new tab (not embedded). + # Example: "https://vanevihomeha.duckdns.org:38123" or "http://192.168.1.10:18789" + gateway_public_url: "" + # Run `clawdbot doctor --fix` on startup (useful after upgrades; slows restarts) run_doctor_on_start: false @@ -65,6 +69,7 @@ schema: gateway_bind: list(loopback|lan) gateway_port: int gateway_token: str? + gateway_public_url: str? run_doctor_on_start: bool homeassistant_token: str? mikrotik_host: str diff --git a/moltbot_assistant/nginx.conf.tpl b/moltbot_assistant/nginx.conf.tpl index 2d44950..b752cfe 100644 --- a/moltbot_assistant/nginx.conf.tpl +++ b/moltbot_assistant/nginx.conf.tpl @@ -33,73 +33,54 @@ http { proxy_set_header X-Forwarded-Proto $scheme; } - # Gateway UI - # IMPORTANT: We must not redirect to an absolute "/..." path because Home Assistant Ingress - # strips the ingress prefix before forwarding to the add-on. An absolute Location would jump - # out of ingress (to the HA host root). So we use a *relative* redirect. - - # Only redirect the root document to add token in the browser URL. + # Landing page (shown inside HA Ingress) + # - Shows the web terminal (if enabled) + # - Provides a button to open the Gateway Web UI in a separate tab (not embedded) location = / { - if ($arg_token = "") { - # Force a trailing slash via a relative redirect. - return 302 ./?token=__GATEWAY_TOKEN__; - } + default_type text/html; - # Proxy the gateway UI. - proxy_pass http://127.0.0.1:18789; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; + # NOTE: __GATEWAY_PUBLIC_URL__ is configured via add-on option gateway_public_url. + # We keep it flexible because the right URL depends on how the user exposes HA/gateway + # (Nabu Casa, DuckDNS, LAN, etc.). - # Debug: expose the ingress path nginx sees (from HA) to the browser. - # Remove once confirmed. - add_header X-Debug-Ingress-Path $http_x_ingress_path always; - - # Inject the correct WS URL when running behind HA Ingress. - # HA provides a per-session ingress proxy path in X-Ingress-Path (usually /api/hassio_ingress/). - # The UI loaded at /hassio/ingress/ cannot be used as a WS endpoint on some setups, - # but /api/hassio_ingress/ *can* proxy websocket upgrades. - # - # We inject a small script to override the UI's saved websocket URL to: - # wss:/// - # so the browser connects same-origin + through HA's ingress proxy. - proxy_set_header Accept-Encoding ""; - sub_filter_types text/html; - sub_filter_once on; - sub_filter '' ''; - sub_filter '__INGRESS_PATH__' "$http_x_ingress_path"; + return 200 ' + Moltbot Assistant + + +
+

Moltbot Assistant

+
+ Open Gateway Web UI + Open Terminal (full page) +
+
+ Tip: The gateway UI is intentionally opened outside of Ingress to avoid websocket/proxy issues. + Configure gateway_public_url in the add-on options. +
+
+ +
+
+ '; } - # WebSocket endpoint compatibility: - # Some clients/UIs assume a dedicated /ws path. The gateway websocket endpoint - # itself is at /, so we map /ws -> / when proxying. - location /ws { - proxy_pass http://127.0.0.1:18789/; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_read_timeout 3600s; - proxy_send_timeout 3600s; - } + # (Optional) Gateway UI via ingress has been intentionally removed. + # See landing page link that opens the gateway in a separate tab. - # Everything else (assets, api, etc.) just proxy through. + # Everything else: 404 location / { - proxy_pass http://127.0.0.1:18789; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; + return 404; } } } diff --git a/moltbot_assistant/run.sh b/moltbot_assistant/run.sh index 8dc48f0..ec468ab 100644 --- a/moltbot_assistant/run.sh +++ b/moltbot_assistant/run.sh @@ -16,6 +16,7 @@ MODEL_PRIMARY=$(jq -r '.model_primary // "openai-codex/gpt-5.2"' "$OPTIONS_FILE" GW_BIND=$(jq -r '.gateway_bind // "loopback"' "$OPTIONS_FILE") GW_PORT=$(jq -r '.gateway_port // 18789' "$OPTIONS_FILE") GW_TOKEN=$(jq -r '.gateway_token // empty' "$OPTIONS_FILE") +GW_PUBLIC_URL=$(jq -r '.gateway_public_url // empty' "$OPTIONS_FILE") HA_TOKEN=$(jq -r '.homeassistant_token // empty' "$OPTIONS_FILE") BRAVE_KEY=$(jq -r '.brave_api_key // empty' "$OPTIONS_FILE") ENABLE_TERMINAL=$(jq -r '.enable_terminal // false' "$OPTIONS_FILE") @@ -279,16 +280,17 @@ fi # Render nginx config from template with the gateway token. # NOTE: This intentionally exposes the token in the browser URL via a redirect. # This matches Clawdbot Control UI's current expectations. -GW_TOKEN="$GW_TOKEN" python3 - <<'PY' +GW_TOKEN="$GW_TOKEN" GW_PUBLIC_URL="$GW_PUBLIC_URL" python3 - <<'PY' import os from pathlib import Path tpl = Path('/etc/nginx/nginx.conf.tpl').read_text() token = os.environ.get('GW_TOKEN','') -if not token: - print('WARN: gateway_token is empty; ingress UI will redirect with an empty token and Control UI will not authenticate.') +public_url = os.environ.get('GW_PUBLIC_URL','') conf = tpl.replace('__GATEWAY_TOKEN__', token) +conf = conf.replace('__GATEWAY_PUBLIC_URL__', public_url) + Path('/etc/nginx/nginx.conf').write_text(conf) PY