[PR #1971] [MERGED] feat(healthcheck): add SNI support for target healthchecks #2789

New Issue

GiteaMirror · 2026-04-16T09:36:24-05:00

GiteaMirror commented

2026-04-16 09:36:24 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/1971
Author: @water-sucks
Created: 12/4/2025
Status: ✅ Merged
Merged: 12/4/2025
Merged by: @oschwartz10612

Base: dev ← Head: add-tls-server-name-to-health-check-fields

📝 Commits (2)

f33be14 feat(schema): add TLS server name column to target healthcheck tables
ca9273c feat(healthcheck): add SNI input field to target healthcheck config

📊 Changes

11 files changed (+72 additions, -15 deletions)

View changed files

📝 messages/en-US.json (+2 -0)
📝 server/db/pg/schema/schema.ts (+2 -1)
📝 server/db/sqlite/schema/schema.ts (+2 -1)
📝 server/routers/newt/handleNewtRegisterMessage.ts (+4 -2)
📝 server/routers/newt/targets.ts (+2 -1)
📝 server/routers/target/createTarget.ts (+3 -1)
📝 server/routers/target/listTargets.ts (+1 -0)
📝 server/routers/target/updateTarget.ts (+3 -1)
📝 src/app/[orgId]/settings/resources/[niceId]/proxy/page.tsx (+8 -3)
📝 src/app/[orgId]/settings/resources/create/page.tsx (+9 -3)
📝 src/components/HealthCheckDialog.tsx (+36 -2)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

While an SNI proxy already exists for configured targets themselves, this is not the case for sending periodic requests to targets' healthcheck endpoints.

This PR adds a field to the target healthcheck settings to specify an explicit SNI header for target healthcheck requests.

Merging this PR requires https://github.com/fosrl/newt/pull/185 to be merged alongside it; as such, I'm not sure how the process goes for coordinating new behavior between Pangolin and Newt, but I believe that older versions of Newt would simply not support this field and silently ignore it since it won't get parsed out of the JSON response.

How to test?

Fill in the SNI field for a given target healthcheck and make sure that the downstream provider receives/proxies the client hello correctly as specified by the configured target healthcheck settings.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/1971 **Author:** [@water-sucks](https://github.com/water-sucks) **Created:** 12/4/2025 **Status:** ✅ Merged **Merged:** 12/4/2025 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `dev` ← **Head:** `add-tls-server-name-to-health-check-fields` --- ### 📝 Commits (2) - [`f33be14`](https://github.com/fosrl/pangolin/commit/f33be1434b689c9125746d1ad7de133a3b900afa) feat(schema): add TLS server name column to target healthcheck tables - [`ca9273c`](https://github.com/fosrl/pangolin/commit/ca9273c9eaded167d52f3c8f70bd968a6b015842) feat(healthcheck): add SNI input field to target healthcheck config ### 📊 Changes **11 files changed** (+72 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `messages/en-US.json` (+2 -0) 📝 `server/db/pg/schema/schema.ts` (+2 -1) 📝 `server/db/sqlite/schema/schema.ts` (+2 -1) 📝 `server/routers/newt/handleNewtRegisterMessage.ts` (+4 -2) 📝 `server/routers/newt/targets.ts` (+2 -1) 📝 `server/routers/target/createTarget.ts` (+3 -1) 📝 `server/routers/target/listTargets.ts` (+1 -0) 📝 `server/routers/target/updateTarget.ts` (+3 -1) 📝 `src/app/[orgId]/settings/resources/[niceId]/proxy/page.tsx` (+8 -3) 📝 `src/app/[orgId]/settings/resources/create/page.tsx` (+9 -3) 📝 `src/components/HealthCheckDialog.tsx` (+36 -2) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description While an SNI proxy already exists for configured targets themselves, this is not the case for sending periodic requests to targets' healthcheck endpoints. This PR adds a field to the target healthcheck settings to specify an explicit SNI header for target healthcheck requests. <img width="642" height="870" alt="Screenshot 2025-12-03 at 23 27 49" src="https://github.com/user-attachments/assets/258777c9-3769-47c8-bb16-12a15482c13f" /> Merging this PR requires https://github.com/fosrl/newt/pull/185 to be merged alongside it; as such, I'm not sure how the process goes for coordinating new behavior between Pangolin and Newt, but I believe that older versions of Newt would simply not support this field and silently ignore it since it won't get parsed out of the JSON response. ## How to test? Fill in the SNI field for a given target healthcheck and make sure that the downstream provider receives/proxies the client hello correctly as specified by the configured target healthcheck settings. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-16 09:36:24 -05:00

GiteaMirror closed this issue

2026-04-16 09:36:25 -05:00

GiteaMirror referenced this issue

2026-04-20 08:39:41 -05:00

[GH-ISSUE #2789] Custom headers not applied / working #4183

GiteaMirror referenced this issue

2026-04-25 16:01:42 -05:00

[GH-ISSUE #2789] Custom headers not applied / working #7037

GiteaMirror referenced this issue

2026-04-30 05:12:10 -05:00

[GH-ISSUE #2789] Custom headers not applied / working #9005