From c64b437bca9e45604e8193e1509d8c396b7ed21d Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:17:52 -0700 Subject: [PATCH] fix(ingress-nginx): force-ssl-redirect=true globally Our Ingress objects intentionally omit per-rule tls: blocks (single wildcard cert served via --default-ssl-certificate). nginx-ingress's normal ssl-redirect setting only forces HTTPS 301 for hosts with an explicit TLS block on their own Ingress resource - since none of ours do, plain http://*.riotpiao.com requests were served directly instead of redirected, exposing every client-facing console (forgejo, authentik, argocd, grafana, vault, etc.) over plaintext HTTP. force-ssl-redirect forces the redirect globally regardless of per-ingress TLS block presence. Verified fix works (tested via manual patch then reverted - confirmed 308 redirects to https:// on forgejo/authentik/argocd) before committing via GitOps. --- k8s/bootstrap/ingress/nginx-values.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/k8s/bootstrap/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml index 8872083..6f989ab 100644 --- a/k8s/bootstrap/ingress/nginx-values.yaml +++ b/k8s/bootstrap/ingress/nginx-values.yaml @@ -57,6 +57,16 @@ controller: keepalive-timeout: "65" keepalive-requests: "100" + # force-ssl-redirect: our Ingress objects intentionally omit per-rule `tls:` + # blocks (single wildcard cert served via default-ssl-certificate above). + # nginx-ingress's normal `ssl-redirect` only forces HTTPS for hosts that have + # an explicit TLS block on their own Ingress resource — since none of ours do, + # plain http://*.riotpiao.com requests were being served directly instead of + # 301-redirected to https://, silently serving every client-facing console + # over plaintext HTTP. force-ssl-redirect forces the redirect globally + # regardless of per-ingress TLS block presence. + force-ssl-redirect: "true" + resources: requests: cpu: 50m