From 30250612e0d0d852200883d368d651652f4ed993 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Fri, 24 Jul 2026 13:55:29 +0200 Subject: [PATCH] fix(portainer): disable nginx gzip re-compression on ingress Ingress responses were re-gzipped by nginx (default gzip_types includes text/html), dropping Content-Length and forcing a chunked/streamed response. That pushes both Supervisor and Core's ingress proxy out of their buffered relay path into the streaming path, where an aiohttp-side error surfaces to the browser as a 502 Bad Gateway even though the addon's own nginx logs a 200. Disabling gzip on the ingress server block keeps responses identity-encoded with an intact Content-Length so the relay uses the simpler, more robust buffered path. Fixes #2766 --- portainer/CHANGELOG.md | 3 +++ portainer/config.yaml | 2 +- portainer/rootfs/etc/cont-init.d/30-nginx.sh | 4 ++-- portainer/rootfs/etc/nginx/templates/ingress.gtpl | 1 + 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/portainer/CHANGELOG.md b/portainer/CHANGELOG.md index da10bdeb9b..a6ca6d03fa 100644 --- a/portainer/CHANGELOG.md +++ b/portainer/CHANGELOG.md @@ -1,4 +1,7 @@ +## 2.43.0.1 (2026-07-24) +- Ingress: disable nginx gzip re-compression of proxied responses so Home Assistant relays them via the buffered path (addresses 502 Bad Gateway via ingress, #2766) + ## 2.43.0 (2026-06-27) - Update to latest version from portainer/portainer (changelog : https://github.com/portainer/portainer/releases) diff --git a/portainer/config.yaml b/portainer/config.yaml index a7492fb0f9..1aee3f71be 100644 --- a/portainer/config.yaml +++ b/portainer/config.yaml @@ -42,4 +42,4 @@ schema: slug: portainer udev: true url: https://github.com/alexbelgium/hassio-addons -version: "2.43.0" +version: "2.43.0.1" diff --git a/portainer/rootfs/etc/cont-init.d/30-nginx.sh b/portainer/rootfs/etc/cont-init.d/30-nginx.sh index 5c565edd44..78e7a78a7b 100755 --- a/portainer/rootfs/etc/cont-init.d/30-nginx.sh +++ b/portainer/rootfs/etc/cont-init.d/30-nginx.sh @@ -16,8 +16,8 @@ if bashio::config.true 'ssl'; then sed -i "s|9000|9443|g" /etc/nginx/includes/upstream.conf sed -i "s|9000|9443|g" /etc/services.d/nginx/run sed -i "s|9099 default_server|9099 ssl|g" /etc/nginx/templates/ingress.gtpl - sed -i '7 i ssl_certificate /ssl/{{ .certfile }};' /etc/nginx/templates/ingress.gtpl - sed -i '7 i ssl_certificate_key /ssl/{{ .keyfile }};' /etc/nginx/templates/ingress.gtpl + sed -i '8 i ssl_certificate /ssl/{{ .certfile }};' /etc/nginx/templates/ingress.gtpl + sed -i '8 i ssl_certificate_key /ssl/{{ .keyfile }};' /etc/nginx/templates/ingress.gtpl bashio::log.info "Ssl enabled, please use https for connection" else sed -i '/connection_upgrade/a\proxy_set_header Origin "";' /etc/nginx/templates/ingress.gtpl diff --git a/portainer/rootfs/etc/nginx/templates/ingress.gtpl b/portainer/rootfs/etc/nginx/templates/ingress.gtpl index 5d08a8be40..65001fe495 100644 --- a/portainer/rootfs/etc/nginx/templates/ingress.gtpl +++ b/portainer/rootfs/etc/nginx/templates/ingress.gtpl @@ -4,6 +4,7 @@ server { include /etc/nginx/includes/server_params.conf; include /etc/nginx/includes/proxy_params.conf; client_max_body_size 0; + gzip off; proxy_hide_header X-Frame-Options; proxy_hide_header Content-Security-Policy;