When multiple Newt instances use identical resource names in Docker labels (e.g., pangolin.proxy-resources.syncthing on host1 and host2), they overwrite the same database record, nulling fields and causing service outages.
Changes
Duplicate detection in blueprint application
Check if resource niceId exists with targets/config on different siteId before update
Throw on cross-site name collision with actionable error message
Allow same-site updates (multiple containers sharing one resource on same host)
Error handling
Surface site names in conflict and suggest unique naming (e.g., syncthing-host1)
Propagate errors to Newt instances via existing blueprint result channel
Implementation details
proxyResources.ts: Query existing targets by siteId, validate against update source
clientResources.ts: Validate existingResource.siteId !== site.siteId before update
Use inArray for efficient multi-site lookups
Example error
Duplicate resource name 'syncthing': already in use on site [host1].
Use unique name on site [host2]. Suggestion: 'syncthing-host2'
Previously this scenario corrupted the database silently. Now it fails fast with clear remediation.
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
scarf.sh
Triggering command: node ./report.js (dns block)
If you need me to access, download, or install something from one of these locations, you can either:
Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)
Original prompt
This section details on the original issue you should resolve
<issue_title>Duplicate docker labels breaking Pangolin</issue_title>
<issue_description>### Describe the Bug
I'm trying out Pangolin and want to get away from the hidden database-method of configuring things, I want everything with docker labels - enter blueprints.
Unfortunately when you do a configuration mistake and create duplicate names, all docker labels configured resources are deleted in the database, more specifically: subDomain is nulled and fullDomain is set to the base domain.
Environment
OS Type & Version: Debian & Ubuntu
Pangolin Version: 1.11.0
Gerbil Version: 1.2.1
Traefik Version: v3.5.3
Newt Version: 1.5.2
Restart newt on host1 & host2. There are no errors in either newt log and no errors in the Pangolin log
Everything is still working
Restart Pangolin on host0 - no errors in the log.
Observe that newt on host1&host2 are throwing errors:
ERROR: 2025/10/20 09:55:23 Failed to connect: failed to get token: failed to request new token: Post "https://cloud.gaida.biz/auth/resource/bdfd60bc-0193-409e-8a97-4bb0500b61ff?redirect=https%3A%2F%2Fsubdomain.example.com%2Fauth%2Fresource%2Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%3Fredirect%3Dhttps%253A%252F%252Fsubdomain.example.com%252Fauth%252Fresource%252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%253Fredirect%253Dhttps%25253A%25252F%25252Fsubdomain.example.com%25252Fauth%25252Fresource%25252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25253Fredirect%25253Dhttps%2525253A%2525252F%2525252Fsubdomain.example.com%2525252Fauth%2525252Fresource%2525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%2525253Fredirect%2525253Dhttps%252525253A%252525252F%252525252Fsubdomain.example.com%252525252Fauth%252525252Fresource%252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%252525253Fredirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fsubdomain.example.com%25252525252Fauth%25252525252Fresource%25252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25252525253Fredirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fsubdomain.example.com%2525252525252Fauth%2525252525252Fresource%2525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%2525252525253Fredirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fsubdomain.example.com%252525252525252Fauth%252525252525252Fresource%252525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%252525252525253Fredirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fsubdomain.example.com%25252525252525252Fauth%25252525252525252Fresource%25252525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25252525252525253Fredirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fsubdomain.example.com%2525252525252525252Fapi%2525252525252525252Fv1%2525252525252525252Fauth%2525252525252525252Fnewt%2525252525252525252Fget-token": stopped after 10 redirects. Retrying in 3s...
Observe that synthing is now infinitely redirecting - I'll spare you the log, it looks similar to the newt log
The infinite redirect may be my specific use case as the base domain domain.example.org is the domain where Pangolin lives. Checking the database, I see that that several entries are nulled and I have to manually fix them in the database
(I anonymized the base domain in the above screenshot - so syncthing in this example has set the base domain of domain.example.org instead of the example of syncthing-host1.domain.example.org). Since there are now multiple entries in traefik with the same base domain, I assume that is why I get infinite redirects.
Given the above example from the screenshot, I need to set the subdomain for n8n, as well as the fullDomain (i.e. n8n.domain.example.org) in the database and...
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/1811
**Author:** [@Copilot](https://github.com/apps/copilot-swe-agent)
**Created:** 11/4/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `copilot/fix-duplicate-docker-labels`
---
### 📝 Commits (4)
- [`51d87c8`](https://github.com/fosrl/pangolin/commit/51d87c89fb35122a4d4987ad429bada3c789b7ef) Initial plan
- [`542abb7`](https://github.com/fosrl/pangolin/commit/542abb7f3cce3eeec070183229decea1ac44f9d0) Add duplicate resource name detection across sites
- [`8884f52`](https://github.com/fosrl/pangolin/commit/8884f528ac48a9da1d78e2fdd39286a9644b1a04) Add detailed comments and debug logging for duplicate detection
- [`75595d1`](https://github.com/fosrl/pangolin/commit/75595d10009c2cae8c0162fc3f9cce26f4f04da2) Address code review feedback: simplify logic and improve performance
### 📊 Changes
**2 files changed** (+104 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `server/lib/blueprints/clientResources.ts` (+40 -0)
📝 `server/lib/blueprints/proxyResources.ts` (+64 -1)
</details>
### 📄 Description
When multiple Newt instances use identical resource names in Docker labels (e.g., `pangolin.proxy-resources.syncthing` on host1 and host2), they overwrite the same database record, nulling fields and causing service outages.
## Changes
**Duplicate detection in blueprint application**
- Check if resource `niceId` exists with targets/config on different `siteId` before update
- Throw on cross-site name collision with actionable error message
- Allow same-site updates (multiple containers sharing one resource on same host)
**Error handling**
- Surface site names in conflict and suggest unique naming (e.g., `syncthing-host1`)
- Propagate errors to Newt instances via existing blueprint result channel
**Implementation details**
- `proxyResources.ts`: Query existing targets by `siteId`, validate against update source
- `clientResources.ts`: Validate `existingResource.siteId !== site.siteId` before update
- Use `inArray` for efficient multi-site lookups
## Example error
```
Duplicate resource name 'syncthing': already in use on site [host1].
Use unique name on site [host2]. Suggestion: 'syncthing-host2'
```
Previously this scenario corrupted the database silently. Now it fails fast with clear remediation.
> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by firewall rules:
>
> - `scarf.sh`
> - Triggering command: `node ./report.js` (dns block)
>
> If you need me to access, download, or install something from one of these locations, you can either:
>
> - Configure [Actions setup steps](https://gh.io/copilot/actions-setup-steps) to set up my environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this repository's [Copilot coding agent settings](https://github.com/fosrl/pangolin/settings/copilot/coding_agent) (admins only)
>
> </details>
<!-- START COPILOT CODING AGENT SUFFIX -->
<details>
<summary>Original prompt</summary>
----
*This section details on the original issue you should resolve*
<issue_title>Duplicate docker labels breaking Pangolin</issue_title>
<issue_description>### Describe the Bug
I'm trying out Pangolin and want to get away from the hidden database-method of configuring things, I want everything with docker labels - enter blueprints.
Unfortunately when you do a configuration mistake and create duplicate names, **all** docker labels configured resources are deleted in the database, more specifically: `subDomain` is nulled and `fullDomain` is set to the base domain.
### Environment
OS Type & Version: Debian & Ubuntu
Pangolin Version: 1.11.0
Gerbil Version: 1.2.1
Traefik Version: v3.5.3
Newt Version: 1.5.2
### To Reproduce
1. Have host1 & host2
2. Configure host1 as follows:
```
labels:
pangolin.proxy-resources.syncthing.name: syncthing
pangolin.proxy-resources.syncthing.full-domain: syncthing-host1.domain.example.org
pangolin.proxy-resources.syncthing.protocol: http
pangolin.proxy-resources.syncthing.auth.sso-enabled: "true"
pangolin.proxy-resources.syncthing.targets[0].method: http
pangolin.proxy-resources.syncthing.targets[0].hostname: syncthing
pangolin.proxy-resources.syncthing.targets[0].port: 8384
```
3. Configure host2 as follows
```
labels:
pangolin.proxy-resources.syncthing.name: syncthing
pangolin.proxy-resources.syncthing.full-domain: syncthing-host2.domain.example.org
pangolin.proxy-resources.syncthing.protocol: http
pangolin.proxy-resources.syncthing.auth.sso-enabled: "true"
pangolin.proxy-resources.syncthing.targets[0].method: http
pangolin.proxy-resources.syncthing.targets[0].hostname: syncthing
pangolin.proxy-resources.syncthing.targets[0].port: 8384
```
3. Restart newt on host1 & host2. There are no errors in either newt log and no errors in the Pangolin log
4. Everything is still working
5. Restart Pangolin on host0 - no errors in the log.
6. Observe that newt on host1&host2 are throwing errors:
```
ERROR: 2025/10/20 09:55:23 Failed to connect: failed to get token: failed to request new token: Post "https://cloud.gaida.biz/auth/resource/bdfd60bc-0193-409e-8a97-4bb0500b61ff?redirect=https%3A%2F%2Fsubdomain.example.com%2Fauth%2Fresource%2Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%3Fredirect%3Dhttps%253A%252F%252Fsubdomain.example.com%252Fauth%252Fresource%252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%253Fredirect%253Dhttps%25253A%25252F%25252Fsubdomain.example.com%25252Fauth%25252Fresource%25252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25253Fredirect%25253Dhttps%2525253A%2525252F%2525252Fsubdomain.example.com%2525252Fauth%2525252Fresource%2525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%2525253Fredirect%2525253Dhttps%252525253A%252525252F%252525252Fsubdomain.example.com%252525252Fauth%252525252Fresource%252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%252525253Fredirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fsubdomain.example.com%25252525252Fauth%25252525252Fresource%25252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25252525253Fredirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fsubdomain.example.com%2525252525252Fauth%2525252525252Fresource%2525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%2525252525253Fredirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fsubdomain.example.com%252525252525252Fauth%252525252525252Fresource%252525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%252525252525253Fredirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fsubdomain.example.com%25252525252525252Fauth%25252525252525252Fresource%25252525252525252Fbdfd60bc-0193-409e-8a97-4bb0500b61ff%25252525252525253Fredirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fsubdomain.example.com%2525252525252525252Fapi%2525252525252525252Fv1%2525252525252525252Fauth%2525252525252525252Fnewt%2525252525252525252Fget-token": stopped after 10 redirects. Retrying in 3s...
```
8. Observe that synthing is now infinitely redirecting - I'll spare you the log, it looks similar to the newt log
The infinite redirect may be my specific use case as the base domain `domain.example.org` is the domain where Pangolin lives. Checking the database, I see that that several entries are nulled and I have to manually fix them in the database
<img width="999" height="214" alt="Image" src="https://github.com/user-attachments/assets/9bdd09d0-6943-4439-88f6-6b982f6908a9" />
(I anonymized the base domain in the above screenshot - so syncthing in this example has set the base domain of `domain.example.org` instead of the example of `syncthing-host1.domain.example.org`). Since there are now multiple entries in traefik with the same base domain, I assume that is why I get infinite redirects.
Given the above example from the screenshot, I need to set the subdomain for n8n, as well as the `fullDomain` (i.e. `n8n.domain.example.org`) in the database and...
</details>
- Fixes fosrl/pangolin#1709
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/1811
Author: @Copilot
Created: 11/4/2025
Status: ❌ Closed
Base:
dev← Head:copilot/fix-duplicate-docker-labels📝 Commits (4)
51d87c8Initial plan542abb7Add duplicate resource name detection across sites8884f52Add detailed comments and debug logging for duplicate detection75595d1Address code review feedback: simplify logic and improve performance📊 Changes
2 files changed (+104 additions, -1 deletions)
View changed files
📝
server/lib/blueprints/clientResources.ts(+40 -0)📝
server/lib/blueprints/proxyResources.ts(+64 -1)📄 Description
When multiple Newt instances use identical resource names in Docker labels (e.g.,
pangolin.proxy-resources.syncthingon host1 and host2), they overwrite the same database record, nulling fields and causing service outages.Changes
Duplicate detection in blueprint application
niceIdexists with targets/config on differentsiteIdbefore updateError handling
syncthing-host1)Implementation details
proxyResources.ts: Query existing targets bysiteId, validate against update sourceclientResources.ts: ValidateexistingResource.siteId !== site.siteIdbefore updateinArrayfor efficient multi-site lookupsExample error
Previously this scenario corrupted the database silently. Now it fails fast with clear remediation.
Original prompt
This section details on the original issue you should resolve
<issue_title>Duplicate docker labels breaking Pangolin</issue_title>
<issue_description>### Describe the Bug
I'm trying out Pangolin and want to get away from the hidden database-method of configuring things, I want everything with docker labels - enter blueprints.
Unfortunately when you do a configuration mistake and create duplicate names, all docker labels configured resources are deleted in the database, more specifically:
subDomainis nulled andfullDomainis set to the base domain.Environment
OS Type & Version: Debian & Ubuntu
Pangolin Version: 1.11.0
Gerbil Version: 1.2.1
Traefik Version: v3.5.3
Newt Version: 1.5.2
To Reproduce
The infinite redirect may be my specific use case as the base domain
domain.example.orgis the domain where Pangolin lives. Checking the database, I see that that several entries are nulled and I have to manually fix them in the database(I anonymized the base domain in the above screenshot - so syncthing in this example has set the base domain of
domain.example.orginstead of the example ofsyncthing-host1.domain.example.org). Since there are now multiple entries in traefik with the same base domain, I assume that is why I get infinite redirects.Given the above example from the screenshot, I need to set the subdomain for n8n, as well as the
fullDomain(i.e.n8n.domain.example.org) in the database and...💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.