fix(startup): use stable internal service addresses

CHANGELOG.md

@@ -1,5 +1,3 @@
-## [1.76.2](https://github.com/homarr-labs/homarr/compare/v1.76.1...v1.76.2) (2026-08-27)
-
 ## [1.76.1](https://github.com/homarr-labs/homarr/compare/v1.76.0...v1.76.1) (2026-08-26)
 
 ## [1.76.0](https://github.com/homarr-labs/homarr/compare/v1.75.0...v1.76.0) (2026-08-21)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homarr",
-  "version": "1.76.2",
+  "version": "1.76.1",
   "private": true,
   "scripts": {
     "build": "cross-env CI=true turbo build",

packages/core/src/infrastructure/http/index.ts

@@ -5,4 +5,5 @@ export {
   createCustomCheckServerIdentity,
   createHttpsAgentAsync,
   fetchWithTrustedCertificatesAsync,
+  mergeHeadersWithUserAgent,
 } from "./request";

packages/core/src/infrastructure/http/request.ts

@@ -13,6 +13,19 @@ import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
 
 import type { TrustedCertificateHostname } from "../certificates/hostnames";
 import { withTimeoutAsync } from "./timeout";
+
+import packageJson from "../../../../../package.json";
+
+export const getDefaultUserAgent = () => `Homarr/${packageJson.version} (+https://homarr.dev)`;
+
+export const mergeHeadersWithUserAgent = (headers: unknown): Headers => {
+  const mergedHeaders = new Headers(headers as HeadersInit);
+  if (!mergedHeaders.has("user-agent")) {
+    mergedHeaders.set("user-agent", getDefaultUserAgent());
+  }
+  return mergedHeaders;
+};
+
 export const createCustomCheckServerIdentity = (
   trustedHostnames: TrustedCertificateHostname[],
 ): typeof checkServerIdentity => {
@@ -72,22 +85,18 @@ export const fetchWithTrustedCertificatesAsync = async (
       undefined,
       options?.bodyTimeout !== undefined ? { bodyTimeout: options.bodyTimeout } : undefined,
     ));
+  const buildFetchOptions = (fetchOptions: Omit<RequestInit, "dispatcher" | "bodyTimeout" | "timeout">) => ({
+    ...fetchOptions,
+    headers: mergeHeadersWithUserAgent(fetchOptions.headers) as unknown as RequestInit["headers"],
+  });
   if (options?.timeout) {
     const { bodyTimeout: _bodyTimeout, dispatcher: _dispatcher, ...fetchOptions } = options;
     return await withTimeoutAsync(
-      async (signal) =>
+      async (signal) => fetch(url, { ...buildFetchOptions(fetchOptions), signal, dispatcher: agent }),
-        fetch(url, {
-          ...fetchOptions,
-          signal,
-          dispatcher: agent,
-        }),
       options.timeout,
     );
   }
 
   const { bodyTimeout: _bodyTimeout, dispatcher: _dispatcher, ...fetchOptions } = options ?? {};
-  return fetch(url, {
+  return fetch(url, { ...buildFetchOptions(fetchOptions), dispatcher: agent });
-    ...fetchOptions,
-    dispatcher: agent,
-  });
 };

packages/core/src/test/infrastructure/http/request.spec.ts

@@ -0,0 +1,120 @@
+// @vitest-environment node
+
+import { createServer } from "node:http";
+import type { Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import type { RequestInit } from "undici";
+
+import { describe, expect, test, vi } from "vitest";
+
+import { fetchWithTrustedCertificatesAsync, mergeHeadersWithUserAgent } from "@homarr/core/infrastructure/http";
+
+vi.mock("@homarr/core/infrastructure/certificates", () => ({
+  getAllTrustedCertificatesAsync: vi.fn(async () => []),
+  getTrustedCertificateHostnamesAsync: vi.fn(async () => []),
+}));
+
+describe("mergeHeadersWithUserAgent", () => {
+  test("should keep existing headers when given a Headers instance", () => {
+    // Arrange
+    const headers = new Headers({ "x-api-key": "some-api-key", Accept: "application/json" });
+
+    // Act
+    const merged = mergeHeadersWithUserAgent(headers);
+
+    // Assert
+    expect(merged.get("x-api-key")).toBe("some-api-key");
+    expect(merged.get("accept")).toBe("application/json");
+    expect(merged.get("user-agent")).toContain("Homarr/");
+  });
+
+  test("should keep existing headers when given a record", () => {
+    // Arrange
+    const headers = { "x-api-key": "some-api-key", Accept: "application/json" };
+
+    // Act
+    const merged = mergeHeadersWithUserAgent(headers);
+
+    // Assert
+    expect(merged.get("x-api-key")).toBe("some-api-key");
+    expect(merged.get("accept")).toBe("application/json");
+    expect(merged.get("user-agent")).toContain("Homarr/");
+  });
+
+  test("should keep existing headers when given a tuple array", () => {
+    // Arrange
+    const headers: [string, string][] = [
+      ["x-api-key", "some-api-key"],
+      ["Accept", "application/json"],
+    ];
+
+    // Act
+    const merged = mergeHeadersWithUserAgent(headers);
+
+    // Assert
+    expect(merged.get("x-api-key")).toBe("some-api-key");
+    expect(merged.get("accept")).toBe("application/json");
+    expect(merged.get("user-agent")).toContain("Homarr/");
+  });
+
+  test("should not override an existing user-agent in any casing", () => {
+    // Arrange
+    const headers = new Headers({ "USER-AGENT": "custom-agent" });
+
+    // Act
+    const merged = mergeHeadersWithUserAgent(headers);
+
+    // Assert
+    expect(merged.get("user-agent")).toBe("custom-agent");
+  });
+
+  test("should fall back to the default user agent when no headers are provided", () => {
+    // Act
+    const merged = mergeHeadersWithUserAgent(undefined);
+
+    // Assert
+    expect(merged.get("user-agent")).toContain("Homarr/");
+  });
+});
+
+const startCaptureServerAsync = async (): Promise<{
+  server: Server;
+  getReceivedHeaders: () => Record<string, string | string[] | undefined>;
+  port: number;
+}> => {
+  let receivedHeaders: Record<string, string | string[] | undefined> = {};
+  const server = createServer((req, res) => {
+    receivedHeaders = req.headers;
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end("{}");
+  });
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const port = (server.address() as AddressInfo).port;
+  return {
+    server,
+    port,
+    getReceivedHeaders: () => receivedHeaders,
+  };
+};
+
+describe("fetchWithTrustedCertificatesAsync", () => {
+  test("should deliver a Headers instance with all headers to the remote server", async () => {
+    // Arrange - the @immich/sdk hands over a Headers instance after merging its defaults
+    const { server, port, getReceivedHeaders } = await startCaptureServerAsync();
+    const headers = new Headers({ "x-api-key": "immich-api-key", Accept: "application/json" });
+
+    // Act
+    try {
+      const response = await fetchWithTrustedCertificatesAsync(`http://127.0.0.1:${port}/api/server/statistics`, {
+        headers: headers as unknown as RequestInit["headers"],
+      });
+
+      // Assert
+      expect(response.status).toBe(200);
+      expect(getReceivedHeaders()["x-api-key"]).toBe("immich-api-key");
+      expect(getReceivedHeaders()["user-agent"]).toContain("Homarr/");
+    } finally {
+      server.close();
+    }
+  });
+});