ingres-si/ingressi v2.9.0

Ingressi v2.9.0

on GitHub

Changes

• PROXY protocol on ports 80 and 443. Host defaults → Trusted proxies → PROXY protocol from lists the TCP load balancers in front of Caddy (HAProxy in TCP mode, a cloud network load balancer, OPNsense, another Caddy with layer4) that open each connection with a PROXY protocol header, v1 or v2. Access logs, access lists, geo blocking, rate limits, the WAF, analytics and the addresses that skip sign-in then see the visitor, not the balancer. Only the listed addresses may send the header, and from them it is optional.
• Rate limits count each client separately. A host's rate limit keyed on the client address used a placeholder Caddy does not have, so it was empty and every client shared one allowance. The limit now applies to each client address.
• Response headers for every response. The Response headers card under Host defaults sets or removes headers on every response of the main server: every host, requests for unknown hosts and error responses. Removing Server and Via hides Caddy's own headers and an upstream's Server header.
• Geo blocking follows the rules its page shows. A turned-off global geo config no longer applies to hosts with rules of their own in merge mode, Use these ranges for geo blocking too reaches every host's geo rules, and the host editor and the protection coverage report agree with the Geo pill.
• The sign-in portal takes a username or an email address. Users created with a real email address could not sign in at the portal. It now accepts the sign-in username, the email address or the portal name (<name>@localhost), in any case (#368).
• Dependency updates. better-auth 1.7.12 and its passkey plugin 1.7.13, the Anthropic SDK 1.1, maplibre-gl 6.15, nodemailer 10.2, swagger-ui-react 5.34, the Caddy image's base images and the ionos DNS module.

Images

docker pull ghcr.io/ingres-si/ingressi-web:2.9.0
docker pull ghcr.io/ingres-si/ingressi-caddy:2.9.0
docker pull ghcr.io/ingres-si/ingressi-l4-port-manager:2.9.0

For linux/amd64 and linux/arm64. Each image is signed with Sigstore cosign and carries an SBOM and a build provenance attestation. To verify, with cosign 3 or later:

cosign verify ghcr.io/ingres-si/ingressi-web:2.9.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/ingres-si/ingressi/\.github/workflows/docker-build-trusted\.yml@refs/(heads|tags)/'

The CycloneDX SBOM of the source tree is attached below.

Upgrading

Back up the data volumes, then run docker compose pull && docker compose up -d. No database migration. Read the upgrade notes: rate limits, geo blocking on hosts with their own rules and response headers behave differently.

Donations

Ingressi is free. If it saves you time or money, please consider supporting it: GitHub Sponsors or Ko-fi.