From 14dfea96e42a9eab78fa398aee7d400956141c2c Mon Sep 17 00:00:00 2001
From: nils <nils@chaotikum.org>
Date: Fri, 17 Jul 2026 13:11:57 +0200
Subject: [PATCH] Default ingress to Traefik; nginx annotations as documented
 opt-in

---
 README.md                |  8 +++++---
 deploy/chart/values.yaml | 12 +++++++-----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 33b2444..4742380 100644
--- a/README.md
+++ b/README.md
@@ -120,9 +120,11 @@ For production prefer a values file, or create the Secret yourself and set
 
 Notes:
 
-- The default ingress annotations disable nginx's request body limit and
-  request buffering so multi-GB RAW uploads stream through. Adapt for other
-  ingress controllers.
+- The chart defaults to Traefik, which needs no special config (no body-size
+  limit, streaming by default). For ingress-nginx, set `ingress.className:
+  nginx` and the commented `proxy-body-size`/`proxy-request-buffering`
+  annotations in values.yaml — nginx's 1MiB default otherwise rejects RAW
+  uploads.
 - Migrations run automatically on startup of either binary (they take a
   Postgres advisory lock, so concurrent starts are safe).
 - Scale `worker.replicas` (or `worker.concurrency`) if imports queue up;
diff --git a/deploy/chart/values.yaml b/deploy/chart/values.yaml
index 6c26fff..5796928 100644
--- a/deploy/chart/values.yaml
+++ b/deploy/chart/values.yaml
@@ -55,12 +55,14 @@ service:
 
 ingress:
   enabled: true
-  className: nginx
+  className: traefik
   host: photos.example.com
-  annotations:
-    # Raw uploads are large; disable nginx's body size limit.
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+  # Traefik needs nothing extra: no default body-size limit, streams uploads.
+  # For ingress-nginx set className: nginx and uncomment (multi-GB raw
+  # uploads hit nginx's 1MiB default limit otherwise):
+  #   nginx.ingress.kubernetes.io/proxy-body-size: "0"
+  #   nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+  annotations: {}
   tls:
     enabled: true
     secretName: photos-tls