github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-15 01:51:45 -05:00
Code Issues 660 Packages Projects Releases 74 Wiki Activity

[GH-ISSUE #1816] State of 'Prefer Wildcard Certificate' is not persistend between restarts #10775

New Issue
Closed
opened 2026-05-06 15:02:07 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-05-06 15:02:07 -05:00
Owner
Copy Link

Originally created by @ghost on GitHub (Nov 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1816

Originally assigned to: @oschwartz10612 on GitHub.

Describe the Bug

Set up wildcards long time ago and now see there is in UI: Domains - Domain Settings the Certificate resolver and Prefer Wildcard Certificate.

By default its state is off I think.
When set up as on (and use Save settings) it remain in this state, but only until the server reboot (or docker compose down / up -d).

Like this:

after saving preference:
Image

after reboot:
Image

The Certificate resolver is loaded right (Custom and the name of resolver) as the one I'm using.

Environment

  • OS Type & Version: Ubuntu 24.04.3 LTS
  • Pangolin Version: 1.12.1
  • Gerbil Version: 1.2.2
  • Traefik Version: v3.5

To Reproduce

As in description.

The router part of the dynamic_config.yml where the wildcard domain setting is:

 routers:
    api-router:
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      rule: Host(`pangolin.sometestdo.main`) && PathPrefix(`/api/v1`)
      service: api-service
      tls:
        certResolver: some_provider
    main-app-router-redirect:
      entryPoints:
        - web
      middlewares:
        - redirect-to-https
      rule: Host(`pangolin.sometestdo.main`)
      service: next-service
    next-router:
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      rule: Host(`pangolin.sometestdo.main`) && !PathPrefix(`/api/v1`)
      service: next-service
      tls:
        certResolver: some_provider
        domains:
          - main: "sometestdo.main"
            sans:
              ###- "*.sometestdo.main"
              - "*.app.sometestdo.main"

Side note: there is the commented, second-level, subdomain.
Migrating on to *.app.sometestdo.main from *.sometestdo.main as cannot use first-level subdomain.
Because of PTR/rDNS validation.

But afaik this make no difference, it used to be like this even before, with no commented line, on first-level subdomain.

While doing it, noticed this behavior.

Expected Behavior

I believe it should stay as user choose.

Originally created by @ghost on GitHub (Nov 5, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1816 Originally assigned to: @oschwartz10612 on GitHub. ### Describe the Bug Set up [wildcards](https://docs.pangolin.net/self-host/advanced/wild-card-domains) long time ago and now see there is in UI: Domains - Domain Settings the Certificate resolver and Prefer Wildcard Certificate. By default its state is _off_ I think. When set up as _on_ (and use Save settings) it remain in this state, but only until the server reboot (or docker compose down / up -d). Like this: after saving preference: <img width="565" height="96" alt="Image" src="https://github.com/user-attachments/assets/f8d9d735-3b69-4ba1-a240-6401da95dc9c" /> after reboot: <img width="565" height="96" alt="Image" src="https://github.com/user-attachments/assets/9da60865-52e5-4835-91f1-684fe286781d" /> The Certificate resolver is loaded right (Custom and the name of resolver) as the one I'm using. ### Environment - OS Type & Version: Ubuntu 24.04.3 LTS - Pangolin Version: 1.12.1 - Gerbil Version: 1.2.2 - Traefik Version: v3.5 ### To Reproduce As in description. The router part of the dynamic_config.yml where the wildcard domain setting is: ``` routers: api-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`pangolin.sometestdo.main`) && PathPrefix(`/api/v1`) service: api-service tls: certResolver: some_provider main-app-router-redirect: entryPoints: - web middlewares: - redirect-to-https rule: Host(`pangolin.sometestdo.main`) service: next-service next-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`pangolin.sometestdo.main`) && !PathPrefix(`/api/v1`) service: next-service tls: certResolver: some_provider domains: - main: "sometestdo.main" sans: ###- "*.sometestdo.main" - "*.app.sometestdo.main" ``` Side note: there is the commented, second-level, subdomain. Migrating on to _*.app.sometestdo.main_ **from** _*.sometestdo.main_ as cannot use first-level subdomain. Because of PTR/rDNS validation. But afaik this make no difference, it used to be like this even before, with no commented line, on first-level subdomain. While doing it, noticed this behavior. ### Expected Behavior I believe it should stay as user choose.
GiteaMirror added the bug label 2026-05-06 15:02:07 -05:00
GiteaMirror commented 2026-05-06 15:02:10 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Nov 5, 2025):

Also it's unclear to me:

*.sometestdo.main -- this one is displayed (altogether with second-level domain itself) in Record Name section

*.app.sometestdo.main -- but this addition is not

Is it also bug? Or just first-level wildcard does also mean any second and more level is included automatically.

So far can't change this from the dashboard and addition is necessary in the dynamic_config.yml - just it's not 1:1 with dashboard.

<!-- gh-comment-id:3490876736 --> @ghost commented on GitHub (Nov 5, 2025): Also it's unclear to me: *.sometestdo.main -- this one is displayed (altogether with _second-level_ domain itself) in Record Name section *.app.sometestdo.main -- but this addition is not Is it also bug? Or just first-level wildcard does also mean any second and more level is included automatically. So far can't change this from the dashboard and addition is necessary in the dynamic_config.yml - just it's not 1:1 with dashboard.
GiteaMirror commented 2026-05-06 15:02:10 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Nov 6, 2025):

The prefer_wildcard_cert is never created in the config.yml

<!-- gh-comment-id:3498531203 --> @ghost commented on GitHub (Nov 6, 2025): The [prefer_wildcard_cert](https://docs.pangolin.net/self-host/advanced/config-file#param-prefer-wildcard-cert) is never created in the config.yml
GiteaMirror commented 2026-05-06 15:02:11 -05:00
Author
Owner
Copy Link

@ghost commented on GitHub (Nov 12, 2025):

Installed fresh new 1.12.2 and now there is no menu at all (still have not yet updated instance 1.12.1 - here the menu is still present).

I mean this menu:

Image

Wildcerts are not generated despite 1.12.2 have this info in corner of the domain page:

Image

Do not understand if this is bug or intended state.

The UI is misleading for me. Because one would expect the wild certs will be prepared for start (after set up is done in traefik_config.yml/dynamic_config.yml and API key in compose).

The Pangolin UI state (that I would expect is ruled by config/config.yml) that Wildcerts are ready, yet they are not with the DNS-01.

Or maybe the there is Docs vs UI gap.

The docs state:

Wildcard certificates allow you to secure unlimited subdomains with a single SSL certificate, eliminating the need to generate individual certificates for each subdomain.

So the description from here for wild certs is making me think that should expect to see *domain.com and *sub.domain.com certificates only instantly with the UI Pangolin default info.

Only after prefer_wildcard_cert and cert_resolver are manually added and acme.json is deleted - these certs are actually created.

<!-- gh-comment-id:3523121000 --> @ghost commented on GitHub (Nov 12, 2025): Installed fresh new 1.12.2 and now there is no menu at all (still have not yet updated instance 1.12.1 - here the menu is still present). I mean this menu: <img width="622" height="299" alt="Image" src="https://github.com/user-attachments/assets/636f0e6d-106b-4448-805c-b620cd2372c4" /> Wildcerts are not generated despite 1.12.2 have this info in corner of the domain page: <img width="183" height="105" alt="Image" src="https://github.com/user-attachments/assets/a858884a-ff2f-47c7-9657-c9e1fdcac4f5" /> Do not understand if this is bug or intended state. The UI is misleading for me. Because one would expect the wild certs will be prepared for start (after set up is done in traefik_config.yml/dynamic_config.yml and API key in compose). The Pangolin UI state (that I would expect is ruled by config/config.yml) that Wildcerts are ready, yet they are not with the DNS-01. Or maybe the there is Docs vs UI gap. The docs state: Wildcard certificates allow you to secure unlimited subdomains with a single SSL certificate, eliminating the need to generate individual certificates for each subdomain. So the description from here for wild certs is making me think that should expect to see *domain.com and *sub.domain.com certificates only instantly with the UI Pangolin default info. Only after `prefer_wildcard_cert` and `cert_resolver` are manually added and acme.json is deleted - these certs are actually created.
GiteaMirror commented 2026-05-06 15:02:12 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Nov 22, 2025):

Tracking in #1829

Installed fresh new 1.12.2 and now there is no menu at all

In 1.12.2 we removed the menu to not allow overriding the config for "config managed domains". We dont want to introduce drift from the configuration file to what is in the database so we do not allow it. This menu will show up for domains that are created from the UI.

<!-- gh-comment-id:3567084272 --> @oschwartz10612 commented on GitHub (Nov 22, 2025): Tracking in #1829 > Installed fresh new 1.12.2 and now there is no menu at all In 1.12.2 we removed the menu to not allow overriding the config for "config managed domains". We dont want to introduce drift from the configuration file to what is in the database so we do not allow it. This menu will show up for domains that are created from the UI.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#10775
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?