fix(supervisor): register the advertised address as the discovery host - #21
Merged
Conversation
Registration published the container hostname, on the reasoning that HA Core resolves it via Docker DNS. It does resolve -- but under `host_network: true` that hostname is a per-add-on alias for the host, not a name the panel's leaf certificate was issued for, so a consumer that reaches us by it has no way to verify us. Worse, the integration's `async_step_hassio` deliberately rewrites an existing entry's host to whatever the add-on registers. Observed on ha-test: an entry the user had configured by IP (192.168.65.19) was silently re-pointed at the simulator's add-on hostname, and the later swap to PanelBench then failed hostname verification. The alias also changes when a panel moves between add-ons, where the address does not -- so it is the wrong thing to pin an entry to even when verification would have passed. The advertised address is what the leaf names and what stays constant across the simulator/PanelBench swap, so it is what gets registered. The container hostname remains the fallback when no advertise address is configured: Docker DNS still resolves it, and a panel with no address to publish should stay discoverable rather than register a host of `None`. Threaded from `app.py`, which already holds the address it hands to the certificate generator and the mDNS advertiser, so all three now name the panel the same way.
2.5.1 merged and its add-on image built before this fix was ready, so the fix needs a version of its own: Home Assistant offers an add-on update only when the version string changes, and a second image labelled 2.5.1 would never reach anyone already running it. Version synced across pyproject, config.yaml, Dockerfile and __init__.py by scripts/sync-version.sh from pyproject as the source of truth, and uv.lock regenerated so the recorded project version matches.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on to #20, which merged before this was ready. Released as 2.5.2 rather
than folded into 2.5.1 -- see Why a new version below.
Discovery registered a hostname no certificate names
register_panelpublished the container hostname, on the reasoning that HACore resolves it via Docker DNS. It does resolve -- but under
host_network: truethat hostname is a per-add-on alias for the host, not aname the panel's leaf was issued for, so a consumer that reaches us by it has
no way to verify us.
Worse, the integration's
async_step_hassiodeliberately rewrites an existingentry's host to whatever the add-on registers. Observed on ha-test: an entry
the user had configured by IP (
192.168.65.19) was silently re-pointed at thesimulator's add-on hostname, and the later swap to PanelBench then failed
hostname verification. The alias also changes when a panel moves between
add-ons where the address does not, so it is the wrong thing to pin an entry
to even when verification would have passed.
Now registers the advertised address -- what the leaf names, and what stays
constant across the simulator/PanelBench swap -- threaded in from
app.py,which already holds the address it hands to the certificate generator and the
mDNS advertiser. All three now name the panel the same way.
The container hostname stays as the fallback when no advertise address is
configured: Docker DNS still resolves it, and a panel with no address to
publish should stay discoverable rather than register a host of
None.The simulator is receiving the identical change, with the same constructor
shape (
advertise_address: str | None = None).Why a new version
2.5.1 merged and its add-on image built successfully from
mainbefore thisfix was ready. Home Assistant offers an add-on update only when the version
string changes, so a second image labelled 2.5.1 would never reach anyone
already running it -- the fix would ship and nobody would receive it. Hence
2.5.2, with its own changelog entry.
Testing
Two cases cover the registered host, one per branch: with an address
configured it is the address and specifically not the container alias, and
with none configured it falls back to the alias rather than registering
nothing.
Full suite 392 passed;
pre-commit run --all-filesgreen across all eighthooks;
uv lock --checkpasses after regenerating the lock for the bump.Note on the HTTPS port convention
The task flagged that the simulator is adopting PanelBench's
http + HTTPS_PORT_OFFSETconvention (const.py:20-31) and asked whether anyPanelBench doc claims the two differ. Checked: none does.
README.md:73-78describes the offset-1000 pairing as PanelBench's own behaviour without
contrasting it against the simulator, so no doc change was needed.