mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-07 05:09:18 -05:00
Pangolin website no longer accessible after switching to wildcard certificates #206
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#206
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @riwich on GitHub (Apr 1, 2025).
After I made the switch to "Wildcard Certificates" according to the instructions on the website (https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs), my Pangolin website is no longer accessible.
Only "Cannot GET /" appears in the browser.
The logs of Pangolin and Traefik show no errors and according to acme.json the “Wildcard Certificate” was created.
I have installed Pangolin several times and initially, without "Wildcart Certificates configuration", the Pangolin website is accessible.
I have carried out the changeover to "Wildcard Certificates" several times exactly according to the online instructions and I always get the same result.
My DNS provider is Infomaniak and the whole installation is running on an Infomaniak VPS with Debian 12. And no Crowdsec installed, as it seems to be the souce of many problems...
Is there a misunderstanding with my sets, am I doing something wrong, is the documentation perhaps no longer correct, or is this even a bug?
Many thanks for your help!
Thomas
@oschwartz10612 commented on GitHub (Apr 2, 2025):
Cannot GET /means that it is sending the web requests to the express server instead of the nextjs server I think. Traefik might be routing the wrong things to the wrong place.Could you post your traefik config files to view? You can remove anything important in them you dont want posted publicly.
@riwich commented on GitHub (Apr 2, 2025):
Hello Owen,
Many thanks for the quick reply! I would be happy to send you the configuration files you mentioned.
I have anonymized my personal Infomaniak token, email address and real domain in the files. These are actually all the files that I changed when I switched to “wildcard certificates”.
So here are the files:
docker-compose.yml:
./config/traefik/traefik_config.yml:
./config/traefik/dynamic_config.yml:
@TheSilverSadist commented on GitHub (Apr 2, 2025):
This is what I changed to my Dynamic to fix it
Hope that helps!
@riwich commented on GitHub (Apr 3, 2025):
Hello TheSilverSadist
Thanks for the tip!
However, I don't understand what exactly you changed to get Pangolin running again.
What strikes me is that you have not defined the “*.domain” at the “next-router:” section, which seems a bit strange to me.
Would it be possible for you to tell me the exact adjustments? Which lines did you change? I'm not overlooking the whole thing completely, in my configuration I haven't included “Crowdsec” either, which makes the two configuration files a little more difficult to distinguish.
Regards,
Thomas
@TheSilverSadist commented on GitHub (Apr 3, 2025):
I don't know why or how but removing it after I ran it once made the site work then I was able to re-add it like this
The only other thing I did was go through and remove any hidden spaces between all of the entries
@oschwartz10612 commented on GitHub (Apr 3, 2025):
Yeah I think your next-router was wrong. All of them should be similar:
@riwich commented on GitHub (Apr 3, 2025):
That solved it, thanks Owen and TheSilverSadist!
I changed "dynamic_config.yml" from:
to:
I also had to change the addition of "pangolin." to the "rule: Host...." section.
And now Pangolin is working again!
However, in my conversion to “wildcard-certs” I followed the instructions on the website (https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs) exactly and it explicitly states that the additional configuration “domains:” should be made.
Have I simply misunderstood this (my native language is not English) or should the instructions be corrected?
In any case, my Pangolin works as it should and I am thrilled with this great product!
@Tanhueco commented on GitHub (Apr 5, 2025):
@riwich, when you say it works, does that mean only a single certificate is generated for your several subdomains? In my case, without the following code, it does not work:
tls: certResolver: letsencrypt domains: - main: "mydomain.com" sans: - "*.mydomain.com"It works, however, by adding it in. Odd.
@riwich commented on GitHub (Apr 5, 2025):
@Tanhueco
Yes, as you say, the whole thing is behaving oddly and I can't figure it out at all.
When I look at my “acme.json”, I see a certificate from the initial installation for the subdomain “pangolin.mydomain.com”, and a wildcart certificate for “*.mydomain.com”.
To be honest, I have since deleted my Pangolin instance. I'm testing different approaches and I'm currently running a variant “NGINX Proxy Manager / Twingate”. This is also a promising option.
However, I like the simplicity, the independence from a third party and the structured setup of Pangolin (OK, apart from our very special problem ;-) ) and I can very well imagine that, after I have played through all my variants, Pangolin will be my final setup.
@github-actions[bot] commented on GitHub (Apr 20, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@github-actions[bot] commented on GitHub (May 4, 2025):
This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
@shucking commented on GitHub (May 28, 2025):
for anyone else who comes to this issue: following the docs as is could lead to the same problem that @riwich had if you are using a subdomain. make sure to edit your rule and host line to the subdomain, and not the base domain.
To clarify, the docs use this line without specifying which domain should be used:
Here's the whole block that works:
Accordingly, I think the docs should be a bit more clear to distinguish what to do