github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-22 09:32:36 -05:00
Code Issues 959 Packages Projects Releases 74 Wiki Activity

[GH-ISSUE #3047] Resource created via blueprint is assigned wrong domainId #17282

New Issue
Closed
opened 2026-05-18 17:46:27 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-05-18 17:46:27 -05:00
Owner
Copy Link

Originally created by @michaelvanstraten on GitHub (May 11, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3047

Originally assigned to: @oschwartz10612 on GitHub.

Describe the Bug

I have two domains setup, one on a global config level and one that was added through the UI.

The UI domain is a subdomain of the global config domain:

  • *.example.com (global)
  • *.dev.example.com (owned by an org)

If I now apply a blueprint containing a resource with a full domain on the second one *.test.dev.example.com:
the following line will select the first matching valid domainId:

e253195fdd/server/lib/blueprints/proxyResources.ts (L1230)

However, the certificate for *.test.dev.example.com will be assigned to the domainId corresponding to *.dev.example.com by the syncAcmeCerts.

This is not a huge issue from a functionality perspective since Traefik will still use the right cert for the resource, but it will show in the use as failed because it will request a certificate for a domainId that does not own that cert.

Image

Environment

  • OS Type & Version: (e.g., Ubuntu 22.04)
  • Pangolin Version: 1.18.3
  • Gerbil Version:
  • Traefik Version: 3.7.0-ea.2
  • Newt Version:

To Reproduce

Create two wildcard domains with one being a subdomain of the other.

Create a public resource via a blueprint for a wildcard subdomain of the first subdomain.

Go to the dashboard and click on Resources → Public. It should the certificate as failed after the challenge resolves. (You can also go to the browser console on the networking tab, and you will see that it fetches org/:orgId/certificate/:domainId/:domain where the domainId is the non-subdomain.

Expected Behavior

The resource should correctly assign the domainId to the best matching valid domain, not the first.

Originally created by @michaelvanstraten on GitHub (May 11, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3047 Originally assigned to: @oschwartz10612 on GitHub. ### Describe the Bug I have two domains setup, one on a global config level and one that was added through the UI. The UI domain is a subdomain of the global config domain: - `*.example.com` (global) - `*.dev.example.com` (owned by an org) If I now apply a blueprint containing a resource with a full domain on the second one `*.test.dev.example.com`: the following line will select the first matching valid `domainId`: https://github.com/fosrl/pangolin/blob/e253195fdd73bf37793befe03da0f74136bf7657/server/lib/blueprints/proxyResources.ts#L1230 However, the certificate for `*.test.dev.example.com` will be assigned to the `domainId` corresponding to `*.dev.example.com` by the `syncAcmeCerts`. This is not a huge issue from a functionality perspective since Traefik will still use the right cert for the resource, but it will show in the use as failed because it will request a certificate for a `domainId` that does not own that cert. <img width="308" height="100" alt="Image" src="https://github.com/user-attachments/assets/bd97f535-4b24-440c-a399-1e477cd90b99" /> ### Environment - OS Type & Version: (e.g., Ubuntu 22.04) - Pangolin Version: 1.18.3 - Gerbil Version: - Traefik Version: 3.7.0-ea.2 - Newt Version: ### To Reproduce Create two wildcard domains with one being a subdomain of the other. Create a public resource via a blueprint for a wildcard subdomain of the first subdomain. Go to the dashboard and click on Resources → Public. It should the certificate as failed after the challenge resolves. (You can also go to the browser console on the networking tab, and you will see that it fetches `org/:orgId/certificate/:domainId/:domain` where the `domainId` is the non-subdomain. ### Expected Behavior The resource should correctly assign the `domainId` to the _best_ matching valid domain, not the first.
GiteaMirror added the bug label 2026-05-18 17:46:27 -05:00
GiteaMirror commented 2026-05-18 17:46:28 -05:00
Author
Owner
Copy Link

@AstralDestiny commented on GitHub (May 11, 2026):

What's the blueprint you are using?

<!-- gh-comment-id:4418135053 --> @AstralDestiny commented on GitHub (May 11, 2026): What's the blueprint you are using?
GiteaMirror commented 2026-05-18 17:46:29 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (May 11, 2026):

Hi @michaelvanstraten. I will take a look at this ASAP!

<!-- gh-comment-id:4422945209 --> @oschwartz10612 commented on GitHub (May 11, 2026): Hi @michaelvanstraten. I will take a look at this ASAP!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#17282
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?