feature: Traefik serves the panel through the Gateway API instead of the retired ingress-nginx by lukepolo · Pull Request #697 · 5stackgg/5stack-panel

Merge main: keep system-upgrade beside the gateway, and drop the ingress-nginx signal patch with ingress-nginx

lukepolo

committed

49fe5a2

fix: update.sh keeps the Traefik install and ingress-nginx retirement through the merge with main

lukepolo

committed

4f55ddd

fix: Traefik enforces nginx-class body limits by buffering requests as ingress-nginx did, and the gateway tests pass shellcheck and detect nginx by its install

lukepolo

committed

28c8a96

test: the gateway tests wait for the other app's nginx route, and count only the preflight's own path at forward-auth

lukepolo

committed

dddf6ff

fix: an update keeps the ports ingress-nginx served on, a re-run recovers a failed Traefik release, a stalled handover gives nginx its ports back, and the Media Server page's stats route survives

lukepolo

committed

8cd5293

fix: an update takes over the Gateway API CRDs that k3s's removed Traefik left behind, and a failed chart shows helm's error after its pod is gone

lukepolo

committed

52bcd0d

fix: the leftover-CRD check only runs before gateway-crds is first installed, so a second update isn't stopped by the traefik.io CRDs Traefik's chart re-creates without Helm's marks

lukepolo

committed

1d8acd0

fix: a reverse-proxy install answers its hosts on 443 too, as ingress-nginx did, so a proxy forwarding there keeps working and logins see HTTPS

lukepolo

committed

37bacee

fix: the shared Gateway answers on 443 too, so apps on it keep working behind a reverse proxy that forwards there, and both self-signed upstream certificates renew before they expire

lukepolo

committed

836e1ae

test: the renewal test ages the shared certificate the way Helm writes it, server-side as helm, so the upgrade's own apply doesn't conflict over the annotation

lukepolo

committed

8987a23

test: cert-manager issues and renews an https install's certificates through Traefik, from an in-cluster Pebble, on the panel's own Issuer and Certificates

lukepolo

committed

2646dd7

test: the nginx-era certificate is a 90-day one inside renewBefore, so it is due when cert-manager runs again, and the pin keeps the solver off port 80, since the router priority turns out not to b…

lukepolo

committed

8dae6e9

test: the cert-manager pin drops the solver's router priority for all the panel's hosts, since moving the solver off port 80 still issues once the ACME server follows the redirect to 443

lukepolo

committed

6017578

feature: panel routes name their hosts, and web and the api compress their text responses

lukepolo

committed

0768f57

test: the cert-manager pin takes the solver off both 80 and 443, the one break that stops issuance through Traefik

lukepolo

committed

e12b2cd

Navigation Menu

Repository navigation

feature: Traefik serves the panel through the Gateway API instead of the retired ingress-nginx - #697

feature: Traefik serves the panel through the Gateway API instead of the retired ingress-nginx#697
lukepolo merged 18 commits into
mainfrom
feature/traefik-gateway-api

Commits on Oct 28, 2026

feature: Traefik serves the panel through the Gateway API instead of the retired ingress-nginx

test: k3s-in-Docker tests for the Gateway API routing layer, from a fresh install and from ingress-nginx, and a workflow publishing the gateway charts to ghcr.io

test: the upgrade test creates the 5stack namespace before the old Ingresses, and http mode waits out the removed redirect

Commits on Oct 29, 2026

Merge main: keep system-upgrade beside the gateway, and drop the ingress-nginx signal patch with ingress-nginx

fix: update.sh keeps the Traefik install and ingress-nginx retirement through the merge with main

fix: Traefik enforces nginx-class body limits by buffering requests as ingress-nginx did, and the gateway tests pass shellcheck and detect nginx by its install

test: the gateway tests wait for the other app's nginx route, and count only the preflight's own path at forward-auth

fix: an update keeps the ports ingress-nginx served on, a re-run recovers a failed Traefik release, a stalled handover gives nginx its ports back, and the Media Server page's stats route survives

fix: an update takes over the Gateway API CRDs that k3s's removed Traefik left behind, and a failed chart shows helm's error after its pod is gone

fix: the leftover-CRD check only runs before gateway-crds is first installed, so a second update isn't stopped by the traefik.io CRDs Traefik's chart re-creates without Helm's marks

fix: a reverse-proxy install answers its hosts on 443 too, as ingress-nginx did, so a proxy forwarding there keeps working and logins see HTTPS

fix: the shared Gateway answers on 443 too, so apps on it keep working behind a reverse proxy that forwards there, and both self-signed upstream certificates renew before they expire

test: the renewal test ages the shared certificate the way Helm writes it, server-side as helm, so the upgrade's own apply doesn't conflict over the annotation

test: cert-manager issues and renews an https install's certificates through Traefik, from an in-cluster Pebble, on the panel's own Issuer and Certificates

test: the nginx-era certificate is a 90-day one inside renewBefore, so it is due when cert-manager runs again, and the pin keeps the solver off port 80, since the router priority turns out not to b…

test: the cert-manager pin drops the solver's router priority for all the panel's hosts, since moving the solver off port 80 still issues once the ACME server follows the redirect to 443

feature: panel routes name their hosts, and web and the api compress their text responses

test: the cert-manager pin takes the solver off both 80 and 443, the one break that stops issuance through Traefik