Repository navigation

Commit 476ecfc

committed

fix(dashboard): bind HTTPRoute to the https listener only

Address review feedback from kitsunoff on packages/system/dashboard/templates/httproute.yaml:11: without sectionName, the HTTPRoute attached to both http:80 and https:443. Under Gateway API hostname-precedence rules, a route with a specific hostname wins over the generic http-to-https-redirect HTTPRoute on the http listener, so HTTP traffic to http://dashboard.example.org/ was proxied directly to the backend with no TLS — a regression against ingress-nginx behaviour. Pin sectionName: https so port 80 stays fully owned by the redirect route. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>

1 parent 06be9fb commit 476ecfcCopy full SHA for 476ecfc

1 file changed

packages/system/dashboard/templates
- httproute.yaml

`‎packages/system/dashboard/templates/httproute.yaml‎`

-Original file line number
+Diff line change
     kind: Gateway
     name: cozystack
     namespace: {{ $exposeIngress }}
 +    sectionName: https
   hostnames:
   - {{ printf "dashboard.%s" $host | quote }}
   rules:

Comments

(0)