Repository: truecharts/public
Pull request #34708: fix(docs): Fix NGINX YAML examples and Update recommended ingress to NGINX.
Author: login: fossum
Created: 2025-04-23T20:46:29Z | Merged: 2025-04-24T07:05:18Z

**Description**
Updates the recommended reverse proxy tool to NGINX. In addition, fixes the example YAML in the NGINX examples.

I will add a task, but I could not get the examples to work with the ingressClassByName: true option.

**⚙️ Type of change**

- [ ] ⚙️ Feature/App addition
- [ ] 🪛 Bugfix
- [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] 🔃 Refactor of current code
- [x] 📜 Documentation Changes

**🧪 How Has This Been Tested?**
Used markdown preview in VS Code.

**📃 Notes:**
Wasn't sure if the customise misspelling was a locale thing. I can easily reverse it.

**✔️ Checklist:**

- [x] ⚖️ My code follows the style guidelines of this project
- [x] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas
- [x] 📄 I have made changes to the documentation
- [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works
- [ ] ⬆️ I increased versions for any altered app according to semantic versioning
- [x] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):`

**➕ App addition**

If this PR is an app addition please make sure you have done the following.

- [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png`


Diff:
diff --git a/website/src/content/docs/guides/ingress/index.md b/website/src/content/docs/guides/ingress/index.md
index 27b2d3aa443d6..f43db769cbea6 100644
--- a/website/src/content/docs/guides/ingress/index.md
+++ b/website/src/content/docs/guides/ingress/index.md
@@ -9,7 +9,7 @@ Simply put, they specify reverse proxy configuration for a special reverse proxy
 
 ## Requirements
 
-Before setting up ingress, we advise you to have an ingress controller already set-up. Our recommended ingress controller is [Traefik](https://github.com/traefik/traefik).
+Before setting up ingress, we advise you to have an ingress controller already set-up. Our recommended ingress controller is [Nginx](https://kubernetes.github.io/ingress-nginx/).
 
 ## How to Setup
 
diff --git a/website/src/content/docs/guides/ingress/nginx.md b/website/src/content/docs/guides/ingress/nginx.md
index 725662d7a22c4..af83d9266d003 100644
--- a/website/src/content/docs/guides/ingress/nginx.md
+++ b/website/src/content/docs/guides/ingress/nginx.md
@@ -4,7 +4,7 @@ title: NGINX
 
 ## Setup
 
-For NGINX we will setup 2 ingress controllers: Internal and External.
+For NGINX we will deploy two ingress controllers: Internal and External.
 Where External is either forwarded by your router or, for example, a cloudflare tunnel.
 Internal, however, is not routed anywhere and is used as a safe default to just have charts reached from your internal network only.
 
@@ -16,105 +16,103 @@ Please note the IP variables that need to be set to your specific configuration
 #### Internal
 
 ```yaml
-    controller:
-      replicaCount: 2
-      service:
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: main
-          metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
-      ingressClassByName: true
-      watchIngressWithoutClass: true
-      ingressClassResource:
-        name: internal
-        default: true
-        controllerValue: k8s.io/internal
-      config:
-        allow-snippet-annotations: true
-        annotations-risk-level: Critical
-        client-body-buffer-size: 100M
-        client-body-timeout: 120
-        client-header-timeout: 120
-        enable-brotli: "true"
-        enable-ocsp: "true"
-        enable-real-ip: "true"
-        force-ssl-redirect: "true"
-        hide-headers: Server,X-Powered-By
-        hsts-max-age: "31449600"
-        keep-alive-requests: 10000
-        keep-alive: 120
-        proxy-body-size: 0
-        proxy-buffer-size: 16k
-        ssl-protocols: TLSv1.3 TLSv1.2
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: true
-      extraArgs:
-        default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
-        publish-status-address: ${NGINX_INTERNAL_IP}
-      terminationGracePeriodSeconds: 120
-      publishService:
-        enabled: false
-      resources:
-        requests:
-          cpu: 100m
-        limits:
-          memory: 500Mi
-    defaultBackend:
-      enabled: false
+controller:
+  replicaCount: 2
+  service:
+    externalTrafficPolicy: Local
+    annotations:
+      metallb.io/ip-allocated-from-pool: main
+      metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
+  ingressClassByName: true
+  watchIngressWithoutClass: true
+  ingressClassResource:
+    name: internal
+    default: true
+    controllerValue: k8s.io/internal
+  config:
+    allow-snippet-annotations: true
+    annotations-risk-level: Critical
+    client-body-buffer-size: 100M
+    client-body-timeout: 120
+    client-header-timeout: 120
+    enable-brotli: "true"
+    enable-ocsp: "true"
+    enable-real-ip: "true"
+    force-ssl-redirect: "true"
+    hide-headers: Server,X-Powered-By
+    hsts-max-age: "31449600"
+    keep-alive-requests: 10000
+    keep-alive: 120
+    proxy-body-size: 0
+    proxy-buffer-size: 16k
+    ssl-protocols: TLSv1.3 TLSv1.2
+    use-forwarded-headers: "true"
+  metrics:
+    enabled: true
+  extraArgs:
+    default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
+    publish-status-address: ${NGINX_INTERNAL_IP}
+  terminationGracePeriodSeconds: 120
+  publishService:
+    enabled: false
+  resources:
+    requests:
+      cpu: 100m
+    limits:
+      memory: 500Mi
+defaultBackend:
+  enabled: false
 ```
 
 #### External
 
 ```yaml
-
-  values:
-    controller:
-      replicaCount: 2
-      service:
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: main
-          metallb.io/loadBalancerIPs: ${NGINX_EXTERNAL_IP}
-      ingressClassByName: true
-      watchIngressWithoutClass: false
-      ingressClassResource:
-        name: external
-        default: false
-        controllerValue: k8s.io/external
-      config:
-        allow-snippet-annotations: true
-        annotations-risk-level: Critical
-        client-body-buffer-size: 100M
-        client-body-timeout: 120
-        client-header-timeout: 120
-        enable-brotli: "true"
-        enable-ocsp: "true"
-        enable-real-ip: "true"
-        force-ssl-redirect: "true"
-        hide-headers: Server,X-Powered-By
-        hsts-max-age: "31449600"
-        keep-alive-requests: 10000
-        keep-alive: 120
-        proxy-body-size: 0
-        proxy-buffer-size: 16k
-        ssl-protocols: TLSv1.3 TLSv1.2
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: true
-      extraArgs:
-        default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
-        publish-status-address: ${NGINX_EXTERNAL_IP}
-      terminationGracePeriodSeconds: 120
-      publishService:
-        enabled: false
-      resources:
-        requests:
-          cpu: 100m
-        limits:
-          memory: 500Mi
-    defaultBackend:
-      enabled: false
+controller:
+  replicaCount: 2
+  service:
+    externalTrafficPolicy: Local
+    annotations:
+      metallb.io/ip-allocated-from-pool: main
+      metallb.io/loadBalancerIPs: ${NGINX_EXTERNAL_IP}
+  ingressClassByName: true
+  watchIngressWithoutClass: false
+  ingressClassResource:
+    name: external
+    default: false
+    controllerValue: k8s.io/external
+  config:
+    allow-snippet-annotations: true
+    annotations-risk-level: Critical
+    client-body-buffer-size: 100M
+    client-body-timeout: 120
+    client-header-timeout: 120
+    enable-brotli: "true"
+    enable-ocsp: "true"
+    enable-real-ip: "true"
+    force-ssl-redirect: "true"
+    hide-headers: Server,X-Powered-By
+    hsts-max-age: "31449600"
+    keep-alive-requests: 10000
+    keep-alive: 120
+    proxy-body-size: 0
+    proxy-buffer-size: 16k
+    ssl-protocols: TLSv1.3 TLSv1.2
+    use-forwarded-headers: "true"
+  metrics:
+    enabled: true
+  extraArgs:
+    default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
+    publish-status-address: ${NGINX_EXTERNAL_IP}
+  terminationGracePeriodSeconds: 120
+  publishService:
+    enabled: false
+  resources:
+    requests:
+      cpu: 100m
+    limits:
+      memory: 500Mi
+defaultBackend:
+  enabled: false
 ```
 
 ### Using the IngressClasses
@@ -126,7 +124,7 @@ or
 
 ## Annotations Examples
 
-Here we will showcase some annotations you can use to customise your NGINX ingress behavior
+Here we will showcase some annotations you can use to customize your NGINX ingress behavior
 
 ### Redirect to Https
 
@@ -159,7 +157,8 @@ annotations:
 ```
 
 For domain-level forward auth, you must configure the embedded outpost first (please refer to
-[Authentik's docs](https://truecharts.org/charts/stable/authentik/how_to/)). The basic steps are to create a provider and application, then enable the embedded outpost for your newly created application.
+[Authentik's docs](https://truecharts.org/charts/stable/authentik/how_to/)). The basic steps are
+to create a provider and application, then enable the embedded outpost for your newly created application.
 
 Once that has been done, configure each service you wish to place behind Authentik as follows:
 


Reviews:
user: login: fossum
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T20:50:50Z
user: login: alfi0812
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-23T20:52:51Z
user: login: alfi0812
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-23T20:53:11Z
user: login: alfi0812
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-24T07:05:10Z

Review comments:
diff_hunk: @@ -16,105 +16,103 @@ Please note the IP variables that need to be set to your specific configuration
 #### Internal
 
 ```yaml
-    controller:
-      replicaCount: 2
-      service:
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: main
-          metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
-      ingressClassByName: true
-      watchIngressWithoutClass: true
-      ingressClassResource:
-        name: internal
-        default: true
-        controllerValue: k8s.io/internal
-      config:
-        allow-snippet-annotations: true
-        annotations-risk-level: Critical
-        client-body-buffer-size: 100M
-        client-body-timeout: 120
-        client-header-timeout: 120
-        enable-brotli: "true"
-        enable-ocsp: "true"
-        enable-real-ip: "true"
-        force-ssl-redirect: "true"
-        hide-headers: Server,X-Powered-By
-        hsts-max-age: "31449600"
-        keep-alive-requests: 10000
-        keep-alive: 120
-        proxy-body-size: 0
-        proxy-buffer-size: 16k
-        ssl-protocols: TLSv1.3 TLSv1.2
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: true
-      extraArgs:
-        default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
-        publish-status-address: ${NGINX_INTERNAL_IP}
-      terminationGracePeriodSeconds: 120
-      publishService:
-        enabled: false
-      resources:
-        requests:
-          cpu: 100m
-        limits:
-          memory: 500Mi
-    defaultBackend:
-      enabled: false
+controller:
+  replicaCount: 2
+  service:
+    externalTrafficPolicy: Local
+    annotations:
+      metallb.io/ip-allocated-from-pool: main
+      metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
+  ingressClassByName: true
path: website/src/content/docs/guides/ingress/nginx.md
user: login: fossum
body: I'm not sure this is working as expected. Running these two in a helm chart gives me a duplicate class name nginx. Based on https://github.com/kubernetes/ingress-nginx/issues/7895#issuecomment-962473252 I think it might need extraArgs or just to define the name 

`ingressClass:
    name: external`
created_at: 2025-04-23T20:50:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -16,105 +16,103 @@ Please note the IP variables that need to be set to your specific configuration
 #### Internal
 
 ```yaml
-    controller:
-      replicaCount: 2
-      service:
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: main
-          metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
-      ingressClassByName: true
-      watchIngressWithoutClass: true
-      ingressClassResource:
-        name: internal
-        default: true
-        controllerValue: k8s.io/internal
-      config:
-        allow-snippet-annotations: true
-        annotations-risk-level: Critical
-        client-body-buffer-size: 100M
-        client-body-timeout: 120
-        client-header-timeout: 120
-        enable-brotli: "true"
-        enable-ocsp: "true"
-        enable-real-ip: "true"
-        force-ssl-redirect: "true"
-        hide-headers: Server,X-Powered-By
-        hsts-max-age: "31449600"
-        keep-alive-requests: 10000
-        keep-alive: 120
-        proxy-body-size: 0
-        proxy-buffer-size: 16k
-        ssl-protocols: TLSv1.3 TLSv1.2
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: true
-      extraArgs:
-        default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
-        publish-status-address: ${NGINX_INTERNAL_IP}
-      terminationGracePeriodSeconds: 120
-      publishService:
-        enabled: false
-      resources:
-        requests:
-          cpu: 100m
-        limits:
-          memory: 500Mi
-    defaultBackend:
-      enabled: false
+controller:
+  replicaCount: 2
+  service:
+    externalTrafficPolicy: Local
+    annotations:
+      metallb.io/ip-allocated-from-pool: main
+      metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
+  ingressClassByName: true
path: website/src/content/docs/guides/ingress/nginx.md
user: login: alfi0812
body: Works fine for me and many others 
created_at: 2025-04-23T20:52:51Z
author_association: MEMBER
diff_hunk: @@ -16,105 +16,103 @@ Please note the IP variables that need to be set to your specific configuration
 #### Internal
 
 ```yaml
-    controller:
-      replicaCount: 2
-      service:
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: main
-          metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
-      ingressClassByName: true
-      watchIngressWithoutClass: true
-      ingressClassResource:
-        name: internal
-        default: true
-        controllerValue: k8s.io/internal
-      config:
-        allow-snippet-annotations: true
-        annotations-risk-level: Critical
-        client-body-buffer-size: 100M
-        client-body-timeout: 120
-        client-header-timeout: 120
-        enable-brotli: "true"
-        enable-ocsp: "true"
-        enable-real-ip: "true"
-        force-ssl-redirect: "true"
-        hide-headers: Server,X-Powered-By
-        hsts-max-age: "31449600"
-        keep-alive-requests: 10000
-        keep-alive: 120
-        proxy-body-size: 0
-        proxy-buffer-size: 16k
-        ssl-protocols: TLSv1.3 TLSv1.2
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: true
-      extraArgs:
-        default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard"
-        publish-status-address: ${NGINX_INTERNAL_IP}
-      terminationGracePeriodSeconds: 120
-      publishService:
-        enabled: false
-      resources:
-        requests:
-          cpu: 100m
-        limits:
-          memory: 500Mi
-    defaultBackend:
-      enabled: false
+controller:
+  replicaCount: 2
+  service:
+    externalTrafficPolicy: Local
+    annotations:
+      metallb.io/ip-allocated-from-pool: main
+      metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP}
+  ingressClassByName: true
path: website/src/content/docs/guides/ingress/nginx.md
user: login: alfi0812
body: I have 2 ingress classes. 1 named internal one external
created_at: 2025-04-23T20:53:11Z
author_association: MEMBER

PR comments:
user: login: CLAassistant
created_at: 2025-04-23T20:46:39Z
body: [![CLA assistant check](https://cla-assistant.io/pull/badge/signed)](https://cla-assistant.io/truecharts/public?pullRequest=34708) <br/>All committers have signed the CLA.
author_association: NONE
user: login: alfi0812
created_at: 2025-04-23T20:55:49Z
body: @fossum need to sign the CLA without it we wont merge it
author_association: MEMBER
user: login: fossum
created_at: 2025-04-23T21:30:01Z
body: I did sign it... Let me try again. Says it might be a different commit email.
author_association: CONTRIBUTOR
user: login: truecharts-admin
created_at: 2025-05-02T00:12:26Z
body: This PR is locked to prevent necro-posting on closed PRs. Please create a issue or contact staff on discord if you want to further discuss this
author_association: CONTRIBUTOR