Ingress Gateway TLS Termination defaults: preventing accidental public access

Ingress Gateway TLS Termination

Traefik Mesh’s ingress gateway accepts HTTP traffic by default unless TLS is explicitly configured. This default behaviour can expose services to the public internet if operators forget to enable TLS termination. The documentation does not state that TLS must be configured for all public endpoints, leaving an ambiguity in the security posture for new deployments.

Operators need a clear mechanism to enforce HTTPS-only access at the ingress gateway level, either by default or via a configuration toggle. The current release notes indicate a change toward stricter defaults, but the exact flag or setting required to block plain HTTP traffic remains unclear.

What configuration must be added to an ingress gateway to guarantee that only HTTPS connections are accepted? Is there a built‑in option to enable TLS termination by default when no TLS block is present? How can an operator verify that HTTP traffic is blocked without additional firewall rules?