By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
When you delete a resource, Traefik keeps its certificate in acme.json and keeps renewing it forever. The deleteResource handler only removes the DB row — it never touches the ACME storage.
What this does
After deleting a resource, checks if any other resource still uses the same domain
If not, removes that domain's certificate from acme.json so Traefik stops renewing it
Adds a configurable acme_json_path option (defaults to /app/config/letsencrypt/acme.json)
The cleanup is best-effort — if it fails for any reason, the delete still succeeds
How to test?
Create a resource with a custom domain that gets a Let's Encrypt cert
Delete that resource
Verify the domain's cert is removed from acme.json
Verify that domains shared by other resources are NOT removed
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2523
**Author:** [@shreyaspapi](https://github.com/shreyaspapi)
**Created:** 2/23/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/2382-cleanup-certs-on-resource-deletion`
---
### 📝 Commits (2)
- [`a404b0d`](https://github.com/fosrl/pangolin/commit/a404b0d0b044cc636e559795104df57ce07c0e8c) fix: clean up ACME certs when resources are deleted
- [`9f31532`](https://github.com/fosrl/pangolin/commit/9f315328c402d48a54098b344e42eb94989acaa5) fix: extract pure acme logic into acmeData.ts so tests import real code
### 📊 Changes
**5 files changed** (+453 additions, -39 deletions)
<details>
<summary>View changed files</summary>
📝 `server/lib/readConfigFile.ts` (+4 -0)
➕ `server/lib/traefik/acmeCleanup.test.ts` (+323 -0)
➕ `server/lib/traefik/acmeCleanup.ts` (+52 -0)
➕ `server/lib/traefik/acmeData.ts` (+53 -0)
📝 `server/routers/resource/deleteResource.ts` (+21 -39)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
Fixes #2382
## What's wrong
When you delete a resource, Traefik keeps its certificate in `acme.json` and keeps renewing it forever. The `deleteResource` handler only removes the DB row — it never touches the ACME storage.
## What this does
- After deleting a resource, checks if any other resource still uses the same domain
- If not, removes that domain's certificate from `acme.json` so Traefik stops renewing it
- Adds a configurable `acme_json_path` option (defaults to `/app/config/letsencrypt/acme.json`)
- The cleanup is best-effort — if it fails for any reason, the delete still succeeds
## How to test?
1. Create a resource with a custom domain that gets a Let's Encrypt cert
2. Delete that resource
3. Verify the domain's cert is removed from `acme.json`
4. Verify that domains shared by other resources are NOT removed
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2523
Author: @shreyaspapi
Created: 2/23/2026
Status: ❌ Closed
Base:
main← Head:fix/2382-cleanup-certs-on-resource-deletion📝 Commits (2)
a404b0dfix: clean up ACME certs when resources are deleted9f31532fix: extract pure acme logic into acmeData.ts so tests import real code📊 Changes
5 files changed (+453 additions, -39 deletions)
View changed files
📝
server/lib/readConfigFile.ts(+4 -0)➕
server/lib/traefik/acmeCleanup.test.ts(+323 -0)➕
server/lib/traefik/acmeCleanup.ts(+52 -0)➕
server/lib/traefik/acmeData.ts(+53 -0)📝
server/routers/resource/deleteResource.ts(+21 -39)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
Fixes #2382
What's wrong
When you delete a resource, Traefik keeps its certificate in
acme.jsonand keeps renewing it forever. ThedeleteResourcehandler only removes the DB row — it never touches the ACME storage.What this does
acme.jsonso Traefik stops renewing itacme_json_pathoption (defaults to/app/config/letsencrypt/acme.json)How to test?
acme.json🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.