ingres-si/ingressi v2.0.0

Ingressi v2.0.0

on GitHub

Caddy Proxy Manager is now Ingressi. This is the first release under the new name and the first with paid editions. The core stays MIT-licensed, with no limits on hosts, nodes or users.

Images

docker pull ghcr.io/ingres-si/ingressi-web:2.0.0
docker pull ghcr.io/ingres-si/ingressi-caddy:2.0.0
docker pull ghcr.io/ingres-si/ingressi-l4-port-manager:2.0.0

For linux/amd64 and linux/arm64. Each image is signed with Sigstore cosign and carries an SBOM and a build provenance attestation. To verify, with cosign 3 or later:

cosign verify ghcr.io/ingres-si/ingressi-web:2.0.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/ingres-si/ingressi/\.github/workflows/docker-build-trusted\.yml@refs/(heads|tags)/'

No source SBOM is attached to this release; v2.0.1 has one.

Upgrading

Back up the data volumes, then run docker compose pull && docker compose up -d. Database migrations run on start.

• Old names keep working: headers, cookie and database file. upgrading-to-ingressi.md lists every rename.
• Forward auth sends X-Ingressi-* headers to upstreams. The X-CPM-* headers are still sent, with the same values, and are deprecated.
• Prometheus metrics label the main Caddy server server="ingressi" instead of server="cpm".
• Changes since v1.13: upgrade notes.

New in the Community edition

• Redesigned dashboard: an overview that lists what needs attention, traffic analytics with saved views, security events with the reason each request was stopped, a full-page host editor that shows changes before saving, and a command palette.
• Multi-factor authentication with an authenticator app or a passkey.
• Rate limiting per host and path.
• PostgreSQL as an alternative to SQLite, with a tool that copies an existing install.
• Host tags, ordered access-list rules, and one list of blocked sources for all hosts.
• A hash chain on the audit log, and passphrase-encrypted configuration export and import.
• An anonymous usage ping, off until an administrator turns it on.

Paid editions

Homelab, Business and Enterprise add alerting, configuration history and rollback, the AI analyst, SAML single sign-on and enforced SSO, custom roles, audit streaming, scheduled backups, compliance reports, change approvals, access reviews, LDAP and SCIM, fleet management, high availability, air-gapped installs, white-label and API monetization. Prices and editions: ingres.si/pricing. A license never affects traffic.

License keys sold on ingres.si need v2.0.1 or later.