Changes
- Alert channels and AI providers refuse internal destinations. A webhook, Slack, Teams or ntfy URL and an OpenAI-compatible base URL may not point at a link-local address (where cloud metadata services answer) or at Caddy's admin API. The check runs when the channel is saved and again at delivery, so a channel stored earlier at such an address fails with a message instead of sending. Private LAN addresses stay allowed.
- E-mail validation (the ACME e-mail, an e-mail channel's sender) requires a domain of non-empty labels.
- Internals: Caddy placeholders are stripped from generated configuration by one linear routine instead of a regular expression that was quadratic on a long run of braces; the uploaded-image markup check is case-insensitive by pattern; the remaining CodeQL findings in tests and tooling were cleaned up.
Images
docker pull ghcr.io/ingres-si/ingressi-web:2.4.1
docker pull ghcr.io/ingres-si/ingressi-caddy:2.4.1
docker pull ghcr.io/ingres-si/ingressi-l4-port-manager:2.4.1For linux/amd64 and linux/arm64. Each image is signed with Sigstore cosign and carries an SBOM and a build provenance attestation. To verify, with cosign 3 or later:
cosign verify ghcr.io/ingres-si/ingressi-web:2.4.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github\.com/ingres-si/ingressi/\.github/workflows/docker-build-trusted\.yml@refs/(heads|tags)/'The CycloneDX SBOM of the source tree is attached below.
Upgrading
Back up the data volumes, then run docker compose pull && docker compose up -d. No database migrations. Read the upgrade notes.
Donations
Ingressi is free. If it saves you time or money, please consider supporting it: GitHub Sponsors or Ko-fi.