From 987c9ade18353a2795bafc5079e4d317545b64fc Mon Sep 17 00:00:00 2001 From: Thomas Date: Sat, 8 Aug 2026 11:16:49 +0200 Subject: [PATCH] fix: make internal nginx proxy tolerate disabled IPv6 (#4596) (#6539) * fix: keep nginx IPv6 listen only when IPv6 is available (#4596) Commit 2c48b1896 (1.45.2) made the internal nginx proxy listen on the IPv6 wildcard ('listen [::]:7575;'), which aborts nginx startup on hosts/VMs with IPv6 disabled: nginx: [emerg] socket() [::]:7575 failed (97: Address family not supported by protocol) A plain revert would reintroduce #2697 and break IPv6-only/dual-stack environments where this listener is required. Instead, only emit the IPv6 listen directive when the host actually has IPv6 configured. Reuse the envsubst step run.sh already performs: compute NGINX_LISTEN_IPV6 from /proc/net/if_inet6 and substitute it into the template. proc files always report size 0, so presence is detected by grepping the file (not 'test -s'). * fix: honor HOMARR_DISABLE_IPV6 override in nginx config generation Review feedback on #6539: give users an explicit opt-out from the IPv6 listener even when the host reports IPv6. The issue reporter (#4596) requested such an env var, and the pattern matches the existing ENABLE_DNS_CACHING IPv6 toggle. Auto-detection behavior is unchanged when the var is unset. Validated in containers: override wins, dual-stack preserved by default, IPv4-only fallback on IPv6-less hosts. --- .../docs/advanced/environment-variables/index.mdx | 15 ++++++++------- nginx.conf | 2 +- scripts/run.sh | 11 ++++++++++- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/apps/docs/docs/advanced/environment-variables/index.mdx b/apps/docs/docs/advanced/environment-variables/index.mdx index e7dc6960d..f2ae41d4b 100644 --- a/apps/docs/docs/advanced/environment-variables/index.mdx +++ b/apps/docs/docs/advanced/environment-variables/index.mdx @@ -25,13 +25,14 @@ This is especially useful for [docker secrets](https://docs.docker.com/engine/sw Using the `PUID` and `PGID` will require you to set the correct permissions on the mounted volumes and if used the docker socket. See more in the [Running as a different user](/docs/advanced/running-as-different-user) documentation. ::: -| Environment Variable | Description | Possible values | Default | -| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | ------- | -| `PUID` | User ID to run the container as | Any valid user ID | `0` | -| `PGID` | Group ID to run the container as | Any valid group ID | `0` | -| `LOG_LEVEL` | Log level to use | `debug` / `info` / `warn` / `error` | `info` | -| `NO_EXTERNAL_CONNECTION` | Disables Homarr's internet-backed requests, including update checks, weather, and RSS feeds | `true` or `false` | `false` | -| `ENABLE_DNS_CACHING` | Enables dns caching. Enabled by default, but if you experience issues with IPv6 or static IPs, see [#4006](https://github.com/homarr-labs/homarr/issues/4006) or disable this flag | `true` or `false` | `true` | +| Environment Variable | Description | Possible values | Default | +| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | ------- | +| `PUID` | User ID to run the container as | Any valid user ID | `0` | +| `PGID` | Group ID to run the container as | Any valid group ID | `0` | +| `LOG_LEVEL` | Log level to use | `debug` / `info` / `warn` / `error` | `info` | +| `NO_EXTERNAL_CONNECTION` | Disables Homarr's internet-backed requests, including update checks, weather, and RSS feeds | `true` or `false` | `false` | +| `ENABLE_DNS_CACHING` | Enables dns caching. Enabled by default, but if you experience issues with IPv6 or static IPs, see [#4006](https://github.com/homarr-labs/homarr/issues/4006) or disable this flag | `true` or `false` | `true` | +| `HOMARR_DISABLE_IPV6` | Disables the IPv6 listener of the internal nginx proxy, even when the host supports IPv6. IPv6 is normally disabled automatically when the host has no IPv6 configured. See [#4596](https://github.com/homarr-labs/homarr/issues/4596) | `true` or `false` | `false` | ## Authentication diff --git a/nginx.conf b/nginx.conf index c1c082777..7754b4087 100644 --- a/nginx.conf +++ b/nginx.conf @@ -5,7 +5,7 @@ events { http { server { listen 7575; - listen [::]:7575; + ${NGINX_LISTEN_IPV6} # Route websockets traffic to port 3001 location /websockets { diff --git a/scripts/run.sh b/scripts/run.sh index 83eff588e..6357c723c 100644 --- a/scripts/run.sh +++ b/scripts/run.sh @@ -24,8 +24,17 @@ export AUTH_SECRET=$(openssl rand -base64 32) # 1. Replace the HOSTNAME in the nginx template file # 2. Create the nginx configuration file from the template # 3. Start the nginx server +# Only listen on IPv6 when the host actually has IPv6 configured (#4596). +# Otherwise nginx aborts with "socket() [::]:7575 failed (97: Address family +# not supported by protocol)". Check HOMARR_DISABLE_IPV6 first so users can +# force IPv4-only even when the host supports IPv6, then probe for IPv6 +# addresses via grep (not -s: proc files always report size 0). export HOSTNAME -envsubst '${HOSTNAME}' < /etc/nginx/templates/nginx.conf > /etc/nginx/nginx.conf +export NGINX_LISTEN_IPV6='' +if [ "${HOMARR_DISABLE_IPV6:-false}" != "true" ] && grep -q . /proc/net/if_inet6 2>/dev/null; then + NGINX_LISTEN_IPV6='listen [::]:7575;' +fi +envsubst '${HOSTNAME} ${NGINX_LISTEN_IPV6}' < /etc/nginx/templates/nginx.conf > /etc/nginx/nginx.conf # Start services in the background and store their PIDs nginx -g 'daemon off;' & NGINX_PID=$!