Add unprivileged ingress user (uid 1000) to Dockerfile runtime stage
and set USER directive. Change EXPOSE from 80 to 8080/8443 for safe
defaults in non-K8s usage. K8s deployments override via entrypoint
args and use NET_BIND_SERVICE capability for ports 80/443.
Update K8s deployment securityContext in both hanzo/ and lux/ manifests
to enforce runAsUser=1000, runAsNonRoot=true, and block privilege
escalation.
- HSTS (2yr, preload), X-Frame-Options DENY, X-Content-Type-Options nosniff,
XSS filter, Referrer-Policy, Permissions-Policy, strip Server header
- Applied globally via entrypoint default middleware on websecure
- Fixes: missing HSTS on all 5 services, no CSP frame protection on IAM,
server version leak on platform.hanzo.ai
- Fork github.com/traefik/paerser to github.com/hanzoai/ingress-parser
with rebranded prefixes (TRAEFIK_ → INGRESS_, traefik. → ingress.)
- Update all 71 Go files importing paerser to use ingress-parser
- CLI flags: traefik.configfile → ingress.configfile
- Env prefix: TRAEFIK_* → INGRESS_*
- Deprecation loader: traefik. label prefix → ingress.
- Recompute digest auth test hashes for realm "ingress"
- Rename traefiker test realm → ingresser
- Fix remaining comment URLs to hanzoai/ingress
7 remaining "traefik" refs are Go import paths for external
packages (traefik/yaegi, traefik/grpc-web) — these are the
packages' module identity, cannot be renamed without forking
the entire Go interpreter and gRPC-Web proxy.
go generate updates configuration-options.md, file.toml, and file.yaml
with the new staticFiles middleware fields. Required for goreleaser
(git must be clean at release time).
Default TLS options now require TLS 1.3 minimum and explicitly set
X25519MLKEM768 as the preferred key exchange curve, with X25519,
P-256, and P-384 as fallbacks. This ensures post-quantum hybrid
key exchange is always negotiated when clients support it.
Rename IngressClass from 'hanzo' to 'ingress' across both hanzo-k8s
and lux-k8s manifests. Generic class name enables any org to fork
the stack without brand-specific K8s resource names.
Traefik namespace eliminated — single hanzo-ingress DaemonSet in
hanzo namespace is the sole ingress controller. Uses SHA tags
instead of :latest for reproducible deploys.
KMS database was reset — machine identities gone. Use org-level
GitHub secrets (DOCKERHUB_*, DIGITALOCEAN_ACCESS_TOKEN) directly
instead of fetching through KMS at build time. Simpler and more
reliable.
The pipe `retry curl ... | jq` breaks because jq exits after
first parse error, causing broken pipe on subsequent retries.
Fix by wrapping curl+jq as functions so retry covers the full
operation as a unit.
- Build and push to GHCR + Docker Hub in parallel
- Fetch secrets from Hanzo KMS (no repo secrets needed)
- Semver + latest + sha tagging via metadata-action
- Deploy to hanzo-k8s with rolling update
Replace all internal import paths from github.com/traefik/traefik/v3
to github.com/hanzoai/ingress/v3 across 462 files. Also migrates the
dynamic/ext sub-module and updates OpenTelemetry scope names, ldflags,
goreleaser config, Dockerfile, and golangci config.
External dependencies (traefik/paerser, traefik/grpc-web, traefik/yaegi,
traefik/oxy) are preserved as-is. Comment URLs to upstream issues are
retained for historical context.
Default branch was renamed from master to main. Update all 7 CI
workflow files so push triggers fire on the correct branch.
External URLs in documentation.yaml (traefik/structor, seo-doc,
mixtus) are left as-is since they reference upstream repos.
Add CI/Go/license/GHCR badges, container image reference table,
full quick start (Docker/K8s/binary/compose), expanded architecture
diagram, complete middleware reference (26 built-in middlewares),
production deployment details with routed domains, and links to
docs.hanzo.ai and related projects.
310 -> 417 lines. Zero upstream references.
GITHUB_TOKEN cannot push to GHCR packages on repos forked from
traefik/traefik due to org-level package restrictions. Use the
org-wide GH_PAT secret which has write:packages scope.
TestLoadIngresses/Auth_TLS_pass_certificate_to_upstream expected
ForwardingTimeouts with only DialTimeout, but buildServersTransport
always populates ReadTimeout and WriteTimeout from provider defaults
(60s each). Add them to match actual output.
The documentation workflow depends on traefik/structor, traefik/mixtus,
traefik/seo-doc, and a GH_TOKEN_REPO secret that are not available in
hanzoai/ingress. Disable with `if: false` until a Hanzo docs pipeline
is set up.
The rebrand replaced the Makefile with a minimal version missing all
targets that CI workflows depend on (generate, binary, validate-files,
binary-linux-amd64, test-integration, multi-arch-image-*, generate-crd).
Restores the full upstream Makefile with:
- All CI-required targets intact
- Docker image targets pointing to ghcr.io/hanzoai/ingress
- Help text updated for hanzo-ingress
Also:
- experimental.yaml: switch from Docker Hub to GHCR (github.actor + GITHUB_TOKEN)
- sync-docker-images.yaml: disable daily cron (was syncing upstream traefik images)
All 13 workflows were active but zero runs ever executed due to:
1. Repository guards (`github.repository == 'traefik/traefik'`) on 5 workflows
silently skipped all jobs in hanzoai/ingress
2. Core CI (build, test-unit, test-integration, validate) only triggered on
pull_request — never on push to master
3. Scheduled workflows (codeql, sync-docker-images) disabled by GitHub on forks
Changes:
- Replace `traefik/traefik` repo guards with `hanzoai/ingress` in
experimental, documentation, release, sync-docker-images
- Add `push: branches: [master]` triggers to build, test-unit,
test-integration, validate so CI runs on every push
- Add workflow_dispatch to codeql for manual triggering
- Fix release workflow to publish to hanzoai/ingress instead of traefik/traefik
zeekay