rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ingress-nginx): force-ssl-redirect=true globally

Browse Source 
Our Ingress objects intentionally omit per-rule tls: blocks (single wildcard
cert served via --default-ssl-certificate). nginx-ingress's normal ssl-redirect
setting only forces HTTPS 301 for hosts with an explicit TLS block on their own
Ingress resource - since none of ours do, plain http://*.riotpiao.com requests
were served directly instead of redirected, exposing every client-facing
console (forgejo, authentik, argocd, grafana, vault, etc.) over plaintext HTTP.

force-ssl-redirect forces the redirect globally regardless of per-ingress TLS
block presence. Verified fix works (tested via manual patch then reverted -
confirmed 308 redirects to https:// on forgejo/authentik/argocd) before
committing via GitOps.
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:02 -07:00
parent d0c150eab9
commit 8bca21e8ab
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/bootstrap/ingress/nginx-values.yaml
+10
View File
@@ -57,6 +57,16 @@ controller:
keepalive-timeout: "65"
keepalive-requests: "100"
# force-ssl-redirect: our Ingress objects intentionally omit per-rule `tls:`
# blocks (single wildcard cert served via default-ssl-certificate above).
# nginx-ingress's normal `ssl-redirect` only forces HTTPS for hosts that have
# an explicit TLS block on their own Ingress resource — since none of ours do,
# plain http://*.riotpiao.com requests were being served directly instead of
# 301-redirected to https://, silently serving every client-facing console
# over plaintext HTTP. force-ssl-redirect forces the redirect globally
# regardless of per-ingress TLS block presence.
force-ssl-redirect: "true"
resources:
requests:
cpu: 50m