ingres-si/ingressi v2.8.0

Ingressi v2.8.0

on GitHub

Changes

• Hosts with sign-in can let listed addresses skip it. Skip sign-in from on a host's Access tab takes IP addresses, CIDR ranges and private_ranges for the built-in sign-in, Authentik and other forward-auth servers (bypassSources in the REST API). Listed clients reach the upstream without signing in; the access list, WAF, rate limits and path blocks still apply.
• Telegram is an alert channel.
• A host on a managed certificate shows the served issuer and expiry on its Certificate tab.
• Analytics can be turned off by removing clickhouse from COMPOSE_PROFILES with CLICKHOUSE_PASSWORD left empty; compose no longer stops on the missing password.
• Settings in .env.example reach the web container. AUTH_ALLOW_OAUTH_ROLE_FROM_CLAIMS, LOGIN_*, AUTH_RATE_LIMIT_*, CADDY_TLS_ADDRESS, CERTS_DIRECTORY and the pull replica settings (INSTANCE_SYNC_MODE, INSTANCE_MASTER_URL, INSTANCE_PULL_TOKEN, INSTANCE_PULL_INTERVAL) were ignored when set in .env.

Images

docker pull ghcr.io/ingres-si/ingressi-web:2.8.0
docker pull ghcr.io/ingres-si/ingressi-caddy:2.8.0
docker pull ghcr.io/ingres-si/ingressi-l4-port-manager:2.8.0

For linux/amd64 and linux/arm64. Each image is signed with Sigstore cosign and carries an SBOM and a build provenance attestation. To verify, with cosign 3 or later:

cosign verify ghcr.io/ingres-si/ingressi-web:2.8.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/ingres-si/ingressi/\.github/workflows/docker-build-trusted\.yml@refs/(heads|tags)/'

The CycloneDX SBOM of the source tree is attached below.

Upgrading

Back up the data volumes, copy the updated docker-compose.yml, then run docker compose pull && docker compose up -d. No database migration. Read the upgrade notes.

Donations

Ingressi is free. If it saves you time or money, please consider supporting it: GitHub Sponsors or Ko-fi.