feature: Traefik serves the panel through the Gateway API instead of the retired ingress-nginx

.github/workflows/gateway-chart.yml

@@ -0,0 +1,40 @@
+name: Gateway chart
+
+# Publishes charts/gateway-crds and charts/gateway as OCI charts at
+# ghcr.io/5stackgg/charts/<name>, tagged with the version in their Chart.yaml.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "charts/gateway/**"
+      - "charts/gateway-crds/**"
+      - .github/workflows/gateway-chart.yml
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
+      # A published version is never pushed again: whoever installed it keeps
+      # getting the chart they installed. Bump Chart.yaml's version to publish.
+      - run: |
+          for dir in charts/gateway-crds charts/gateway; do
+            name="$(yq -r .name "$dir/Chart.yaml")"
+            version="$(yq -r .version "$dir/Chart.yaml")"
+            if helm show chart "oci://ghcr.io/5stackgg/charts/$name" --version "$version" >/dev/null 2>&1; then
+              echo "$name $version is already published"
+              continue
+            fi
+            helm package "$dir" --destination dist
+            helm push "dist/$name-$version.tgz" oci://ghcr.io/5stackgg/charts
+          done

.github/workflows/gateway.yml

@@ -0,0 +1,71 @@
+name: Gateway
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - update.sh
+      - install.sh
+      - dev.sh
+      - utils/apply_overlay.sh
+      - utils/install_traefik.sh
+      - utils/retire_ingress_nginx.sh
+      - utils/write_overlays.sh
+      - "charts/**"
+      - "base/gateway/**"
+      - "base/*/httproute*.yaml"
+      - "overlays/http/**"
+      - "overlays/mediamtx/**"
+      - "overlays/mediamtx-https/**"
+      - "overlays/cert-manager/**"
+      - "overlays/cert-manager-crds/**"
+      - utils/cert_manager.sh
+      - "overlays/config/*.env.example"
+      - "tests/gateway/**"
+      - .github/workflows/gateway.yml
+  pull_request:
+    paths:
+      - update.sh
+      - install.sh
+      - dev.sh
+      - utils/apply_overlay.sh
+      - utils/install_traefik.sh
+      - utils/retire_ingress_nginx.sh
+      - utils/write_overlays.sh
+      - "charts/**"
+      - "base/gateway/**"
+      - "base/*/httproute*.yaml"
+      - "overlays/http/**"
+      - "overlays/mediamtx/**"
+      - "overlays/mediamtx-https/**"
+      - "overlays/cert-manager/**"
+      - "overlays/cert-manager-crds/**"
+      - utils/cert_manager.sh
+      - "overlays/config/*.env.example"
+      - "tests/gateway/**"
+      - .github/workflows/gateway.yml
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: shellcheck -x utils/install_traefik.sh utils/retire_ingress_nginx.sh utils/write_overlays.sh tests/gateway/*.sh
+
+  fresh-install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash tests/gateway/fresh_install_test.sh
+
+  upgrade-from-ingress-nginx:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash tests/gateway/upgrade_test.sh
+
+  cert-manager:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash tests/gateway/cert_manager_test.sh

.github/workflows/panel-scripts.yml

@@ -45,4 +45,6 @@ jobs:
       - run: bash tests/scripts/system_upgrade_test.sh
       - run: bash tests/scripts/plugin_test.sh
       - run: bash tests/scripts/node_ip_test.sh
+      - run: bash tests/scripts/traefik_install_test.sh
+      - run: bash tests/scripts/write_overlays_test.sh
       - run: bash tests/scripts/dev_game_server_test.sh

base/api/httproute-relay.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: relay
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: 5stack
+      sectionName: relay
+  hostnames:
+    - ${RELAY_DOMAIN}
+  rules:
+    - filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: /match-relay/
+      backendRefs:
+        - name: api
+          port: 5585

base/api/httproute-ws.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ws
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: 5stack
+      sectionName: ws
+  hostnames:
+    - ${WS_DOMAIN}
+  rules:
+    - filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: /ws/
+      backendRefs:
+        - name: api
+          port: 5585

base/api/httproute.yaml

@@ -0,0 +1,188 @@
+# An allowlist: a path not listed here is a 404 at the gateway and never
+# reaches the api. Exact and PathPrefix are deliberate, path by path.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: api
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: 5stack
+      sectionName: api
+  hostnames:
+    - ${API_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /me
+        - path:
+            type: PathPrefix
+            value: /matches
+        - path:
+            type: PathPrefix
+            value: /twitch
+        - path:
+            type: PathPrefix
+            value: /game-server-node/script
+        - path:
+            type: PathPrefix
+            value: /game-server-node/ping
+        - path:
+            type: PathPrefix
+            value: /avatars
+        - path:
+            type: PathPrefix
+            value: /trophies
+        - path:
+            type: Exact
+            value: /system/healthz
+        - path:
+            type: Exact
+            value: /system/logs/download
+        - path:
+            type: Exact
+            value: /mediamtx/stats
+        - path:
+            type: PathPrefix
+            value: /branding
+        - path:
+            type: PathPrefix
+            value: /news
+        - path:
+            type: PathPrefix
+            value: /utility
+        - path:
+            type: PathPrefix
+            value: /custom-pages
+        - path:
+            type: PathPrefix
+            value: /plugins
+        # Broadcast HUD bundles. The game-streamer pod fetches these
+        # in-cluster and never touches the gateway, but the panel's import and
+        # delete come from a browser, and an OBS browser source may load one
+        # directly -- both of which arrive here.
+        - path:
+            type: PathPrefix
+            value: /huds
+        - path:
+            type: PathPrefix
+            value: /events/media
+        - path:
+            type: PathPrefix
+            value: /snapshots
+        - path:
+            type: PathPrefix
+            value: /steam-match-history/upload
+        - path:
+            type: PathPrefix
+            value: /clip-views
+        - path:
+            type: PathPrefix
+            value: /voice
+        - path:
+            type: PathPrefix
+            value: /notifications
+        - path:
+            type: PathPrefix
+            value: /chat
+        # The Player Management plugin's sanction sync, which doubles as the
+        # heartbeat the panel reads to show it as active.
+        - path:
+            type: PathPrefix
+            value: /sanctions/server
+        - path:
+            type: PathPrefix
+            value: /file-manager
+      filters:
+        - type: ExtensionRef
+          extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: compress
+      backendRefs:
+        - name: api
+          port: 5585
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /v1
+        - path:
+            type: PathPrefix
+            value: /v1alpha1
+        - path:
+            type: PathPrefix
+            value: /v2
+      backendRefs:
+        - name: hasura
+          port: 8080
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: api-web
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: 5stack
+      sectionName: web
+  hostnames:
+    - ${WEB_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /auth
+        - path:
+            type: PathPrefix
+            value: /extension
+        - path:
+            type: Exact
+            value: /telemetry
+        - path:
+            type: Exact
+            value: /discord-invite
+        - path:
+            type: Exact
+            value: /discord-bot
+        - path:
+            type: PathPrefix
+            value: /calendar
+        - path:
+            type: Exact
+            value: /quick-connect
+      backendRefs:
+        - name: api
+          port: 5585
+---
+# Browsers PUT 64 MiB multipart parts to /5stack through presigned URLs, so the
+# Host header and the path must reach RustFS exactly as signed: no rewrite.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: demos
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: 5stack
+      sectionName: demos
+  hostnames:
+    - ${DEMOS_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /demos
+        - path:
+            type: PathPrefix
+            value: /clips
+      backendRefs:
+        - name: api
+          port: 5585
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /5stack
+      backendRefs:
+        - name: rustfs
+          port: 9000