DNS autoritative in LAN for domain (split horizon)
Private DNS entry for pangolin point to Pangolin IP public VPS
Private DNS entry for Keycloak point to keycloack LAN IP
Public DNS entry for pangolin point to Pangolin IP public VPS
Public DNS entry for Keycloak point to Pangolin IP public VPS
Pangolin resouces
Pangolin public resource for keycloak with target keycloak in LAN (reachable via newt)
Pangolin public resource for webserver with target webserver in LAN (reachable via newt)
Problem:
If I try to login to Keycloak from internet WORKS
If I try to login to webserver from internet via Keycloak, WORKS
If I try to login to pagolin with keycloak (properly configured) from LAN WORKS
If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page, but when insert credentials, return error: Unable to reach the identity provider while exchanging the authorization code. Please try again. NOT WORKS
Environment
OS Type & Version: Ubuntu 22.04
Pangolin Version: 1.18.4
Gerbil Version: 1.4.0
Traefik Version: 3.7.1
Newt Version: 1.12.5
To Reproduce
If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page, but when insert credentials, return error: Unable to reach the identity provider while exchanging the authorization code. Please try again.NOT WORKS
Expected Behavior
If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page without issues
Originally created by @alessandroarosio1977 on GitHub (May 19, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3112
### Describe the Bug
- Pangolin Hosted on VPS
- Newt on LAN (that see all servers keycloack too)
- Keycloak self hosted in LAN
**DNS autoritative in LAN for domain (split horizon)**
- Private DNS entry for pangolin point to Pangolin IP public VPS
- Private DNS entry for Keycloak point to keycloack LAN IP
- Public DNS entry for pangolin point to Pangolin IP **public** VPS
- Public DNS entry for Keycloak point to Pangolin IP public VPS
**Pangolin resouces**
- Pangolin public resource for keycloak with target keycloak in LAN (reachable via newt)
- Pangolin public resource for webserver with target webserver in LAN (reachable via newt)
**Problem:**
- If I try to login to Keycloak from internet WORKS
- If I try to login to webserver from internet via Keycloak, WORKS
- If I try to login to pagolin with keycloak (properly configured) from LAN WORKS
- If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page, but when insert credentials, return error: Unable to reach the identity provider while exchanging the authorization code. Please try again. **_NOT WORKS_**
### Environment
- OS Type & Version: Ubuntu 22.04
- Pangolin Version: 1.18.4
- Gerbil Version: 1.4.0
- Traefik Version: 3.7.1
- Newt Version: 1.12.5
### To Reproduce
- If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page, but when insert credentials, return **error: Unable to reach the identity provider while exchanging the authorization code. Please try again.** _NOT WORKS_
### Expected Behavior
If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page without issues
Any way you can capture packets of what pangolin is sending in when it does a call to that proxy?
I do wonder if its like some issue talking to itself and doesnt think via the proxy?
<!-- gh-comment-id:4493603495 -->
@deskstorm commented on GitHub (May 20, 2026):
Any way you can capture packets of what pangolin is sending in when it does a call to that proxy?
I do wonder if its like some issue talking to itself and doesnt think via the proxy?
@AstralDestiny commented on GitHub (May 20, 2026):
Throw pangolin into debug,
services:pangolin:environment:- LOG_LEVEL=DEBUG
Though never used keycloak myself, sure it's a great program but alas it's java, I use authelia myself and no issues that and it's openID certified just like keycloak.
Also ment to post earlier forgot to press enter >.>
<!-- gh-comment-id:4494700333 -->
@AstralDestiny commented on GitHub (May 20, 2026):
Throw pangolin into debug,
```yml
services:
pangolin:
environment:
- LOG_LEVEL=DEBUG
```
Though never used keycloak myself, sure it's a great program but alas it's java, I use authelia myself and no issues that and it's openID certified just like keycloak.
Also ment to post earlier forgot to press enter >.>
@alessandroarosio1977 commented on GitHub (May 21, 2026):
This is output of pangolin docker log catched within error login:
user@pangolin:/opt/pangolin# docker compose logs pangolin -f
pangolin |
pangolin | > @fosrl/pangolin@0.0.0 start
pangolin | > ENVIRONMENT=prod node dist/migrations.mjs && ENVIRONMENT=prod NODE_ENV=development node --enable-source-maps dist/server.mjs
pangolin |
pangolin | Starting migrations from version 1.18.4
pangolin | Migrations to run:
pangolin | All migrations completed successfully
pangolin | 2026-05-21T15:30:08+00:00 [info]: Pangolin gathers anonymous usage data to help us better understand how the software is used and guide future improvements and feature development. You can find more details, including instructions for opting out of this anonymous data collection, at: https://docs.pango
lin.net/telemetry
pangolin | 2026-05-21T15:30:09+00:00 [info]: Dashboard API server is running on http://localhost:3000
pangolin | 2026-05-21T15:30:09+00:00 [info]: Internal API server is running on http://localhost:3001
pangolin | 2026-05-21T15:30:15+00:00 [info]: Dashboard Web UI server is running on http://localhost:3002
pangolin | 2026-05-21T15:30:15+00:00 [info]: Updated exit node with reachableAt to http://gerbil:3004
pangolin | 2026-05-21T15:30:22+00:00 [info]: Establishing websocket connection
pangolin | 2026-05-21T15:30:22+00:00 [info]: Client added to tracking - NEWT ID: aaaaaaaaaaaaaaaaaaaa, Connection ID: e413034e-0e14-4859-a08b-3dc24fca41c4, Total connections: 1
pangolin | 2026-05-21T15:30:22+00:00 [info]: WebSocket connection established - NEWT ID: aaaaaaaaaaaaaaaaaaaa
pangolin | 2026-05-21T15:30:22+00:00 [warn]: Newt ping with outdated config version: 30 (current: 0)
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Handling healthcheck status message
pangolin | (node:26) [DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for url.parse() vulnerabilities.
pangolin | (Use node --trace-deprecation ... to show where the warning was created)
pangolin | Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/generate-url
pangolin | Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/validate-callback
pangolin | 2026-05-21T15:31:05+00:00 [error]: Failed to reach OIDC provider while exchanging authorization code {"error":"Failed to send request"}
As you can see, seem that pangolin try to communicate with itself (http://localhost:3000...)
On keycloak, after login failed, I see user session up from IP of my PC
<!-- gh-comment-id:4509887657 -->
@alessandroarosio1977 commented on GitHub (May 21, 2026):
This is output of pangolin docker log catched within error login:
_user@pangolin:/opt/pangolin# docker compose logs pangolin -f
pangolin |
pangolin | > @fosrl/pangolin@0.0.0 start
pangolin | > ENVIRONMENT=prod node dist/migrations.mjs && ENVIRONMENT=prod NODE_ENV=development node --enable-source-maps dist/server.mjs
pangolin |
pangolin | Starting migrations from version 1.18.4
pangolin | Migrations to run:
pangolin | All migrations completed successfully
pangolin | 2026-05-21T15:30:08+00:00 [info]: Pangolin gathers anonymous usage data to help us better understand how the software is used and guide future improvements and feature development. You can find more details, including instructions for opting out of this anonymous data collection, at: https://docs.pango
lin.net/telemetry
pangolin | 2026-05-21T15:30:09+00:00 [info]: Dashboard API server is running on http://localhost:3000
pangolin | 2026-05-21T15:30:09+00:00 [info]: Internal API server is running on http://localhost:3001
pangolin | 2026-05-21T15:30:15+00:00 [info]: Dashboard Web UI server is running on http://localhost:3002
pangolin | 2026-05-21T15:30:15+00:00 [info]: Updated exit node with reachableAt to http://gerbil:3004
pangolin | 2026-05-21T15:30:22+00:00 [info]: Establishing websocket connection
pangolin | 2026-05-21T15:30:22+00:00 [info]: Client added to tracking - NEWT ID: aaaaaaaaaaaaaaaaaaaa, Connection ID: e413034e-0e14-4859-a08b-3dc24fca41c4, Total connections: 1
pangolin | 2026-05-21T15:30:22+00:00 [info]: WebSocket connection established - NEWT ID: aaaaaaaaaaaaaaaaaaaa
pangolin | 2026-05-21T15:30:22+00:00 [warn]: Newt ping with outdated config version: 30 (current: 0)
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Handling healthcheck status message
pangolin | (node:26) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
pangolin | (Use `node --trace-deprecation ...` to show where the warning was created)
pangolin | Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/generate-url
pangolin | Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/validate-callback
pangolin | 2026-05-21T15:31:05+00:00 [error]: Failed to reach OIDC provider while exchanging authorization code {"error":"Failed to send request"}_
As you can see, seem that pangolin try to communicate with itself (**http://localhost:3000...**)
On keycloak, after login failed, I see user session up from IP of my PC
@AstralDestiny commented on GitHub (May 21, 2026):
Can you put a,
services:gerbil:networks:default:aliases:- keycloak.domain.com# replace me
Then down and up and see if it's happy at that point?
<!-- gh-comment-id:4510026973 -->
@AstralDestiny commented on GitHub (May 21, 2026):
Can you put a,
```yml
services:
gerbil:
networks:
default:
aliases:
- keycloak.domain.com # replace me
```
Then down and up and see if it's happy at that point?
traefik:
image: docker.io/traefik:v3.7.1
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
networks:
default:
driver: bridge
name: pangolin_
When you say: services:
gerbil:
networks:
default:
aliases:
- keycloak.domain.com # replace me
you mean under my networks session in docker compose or inside gerbil section of file?
<!-- gh-comment-id:4512185913 -->
@alessandroarosio1977 commented on GitHub (May 21, 2026):
My docker-compose.yml is created by installer:
_name: pangolin
services:
pangolin:
image: docker.io/fosrl/pangolin:1.18.4
container_name: pangolin
restart: unless-stopped
deploy:
resources:
limits:
memory: 1g
reservations:
memory: 256m
volumes:
- ./config:/app/config
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
interval: "10s"
timeout: "10s"
retries: 15
gerbil:
image: docker.io/fosrl/gerbil:1.4.0
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://gerbil:3004
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://pangolin:3001/api/v1/
volumes:
- ./config/:/var/config
cap_add:
- NET_ADMIN
- SYS_MODULE
ports:
- 51820:51820/udp
- 21820:21820/udp
- 443:443
- 443:443/udp # For http3 QUIC if desired
- 80:80
traefik:
image: docker.io/traefik:v3.7.1
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
networks:
default:
driver: bridge
name: pangolin_
When you say:
**_services:
gerbil:
networks:
default:
aliases:
- keycloak.domain.com # replace me_**
you mean under my networks session in docker compose or inside **gerbil** section of file?
@AstralDestiny commented on GitHub (May 22, 2026):
It says gerbil there. it's line by line nested into the proper location.
<!-- gh-comment-id:4513968196 -->
@AstralDestiny commented on GitHub (May 22, 2026):
It says gerbil there. it's line by line nested into the proper location.
@AstralDestiny commented on GitHub (May 22, 2026):
It's via default as compose automatically grouped them via the "default" network,
so services: gerbil: networks: default: aliases: - key.domain.com
<!-- gh-comment-id:4514013677 -->
@AstralDestiny commented on GitHub (May 22, 2026):
It's via default as compose automatically grouped them via the "default" network,
so services: gerbil: networks: default: aliases: - key.domain.com
@AstralDestiny correct me if im wrong, but this should almost be a copy and paste for them? (As i might try a SSO soon too for Pangolin) @alessandroarosio1977
<!-- gh-comment-id:4514123398 -->
@deskstorm commented on GitHub (May 22, 2026):
@AstralDestiny correct me if im wrong, but this should almost be a copy and paste for them? (As i might try a SSO soon too for Pangolin) @alessandroarosio1977
```
gerbil:
image: docker.io/fosrl/gerbil:1.4.0
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://gerbil:3004
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://pangolin:3001/api/v1/
volumes:
- ./config/:/var/config
cap_add:
- NET_ADMIN
- SYS_MODULE
ports:
- 51820:51820/udp
- 21820:21820/udp
- 443:443
- 443:443/udp # For http3 QUIC if desired
- 80:80
networks:
default:
aliases:
- keycloak.domain.com # replace me
```
traefik:
image: docker.io/traefik:v3.7.1
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
@AstralDestiny commented on GitHub (May 22, 2026):
That was with a down and up and not just an up of the stack after changing right?
<!-- gh-comment-id:4521009998 -->
@AstralDestiny commented on GitHub (May 22, 2026):
That was with a down and up and not just an up of the stack after changing right?
@alessandroarosio1977 commented on GitHub (May 22, 2026):
For sure. Docker compose downDocker compose up -dIl giorno 22 mag 2026, alle ore 19:11, AstralDestiny @.***> ha scritto:AstralDestiny left a comment (fosrl/pangolin#3112)
That was with a down and up and not just an up of the stack after changing right?
—Reply to this email directly, view it on GitHub, or unsubscribe.Triage notifications on the go with GitHub Mobile for iOS or Android.
You are receiving this because you were mentioned.Message ID: @.***>
<!-- gh-comment-id:4523273258 -->
@alessandroarosio1977 commented on GitHub (May 22, 2026):
For sure. Docker compose downDocker compose up -dIl giorno 22 mag 2026, alle ore 19:11, AstralDestiny ***@***.***> ha scritto:AstralDestiny left a comment (fosrl/pangolin#3112)
That was with a down and up and not just an up of the stack after changing right?
—Reply to this email directly, view it on GitHub, or unsubscribe.Triage notifications on the go with GitHub Mobile for iOS or Android.
You are receiving this because you were mentioned.Message ID: ***@***.***>
@alessandroarosio1977 commented on GitHub (May 28, 2026):
Any idea on item?
Or any other step to investigate on problem?
<!-- gh-comment-id:4561823204 -->
@alessandroarosio1977 commented on GitHub (May 28, 2026):
Any idea on item?
Or any other step to investigate on problem?
@alessandroarosio1977 commented on GitHub (Jun 7, 2026):
@AstralDestiny correct me if im wrong, but this should almost be a copy and paste for them? (As i might try a SSO soon too for Pangolin) @alessandroarosio1977
From what I've read in other threads, it seems that adding
networks:
default:
aliases:
- keycloak.domain.com
only works if Keycloak is on the same Docker network as Pangolin. But that's not the case for me.
Pangolin is on a VPS, while Keycloak is on-premises. Keycloak isn’t exposed directly but only via Pangolin through Newt.
In this case, how do I tell Pangolin to find keycloak.domain.com on the internal IP through Newt (if possible)?
<!-- gh-comment-id:4643144173 -->
@alessandroarosio1977 commented on GitHub (Jun 7, 2026):
> [@AstralDestiny](https://github.com/AstralDestiny) correct me if im wrong, but this should almost be a copy and paste for them? (As i might try a SSO soon too for Pangolin) [@alessandroarosio1977](https://github.com/alessandroarosio1977)
>
> ```
> gerbil:
> image: docker.io/fosrl/gerbil:1.4.0
> container_name: gerbil
> restart: unless-stopped
> depends_on:
> pangolin:
> condition: service_healthy
> command:
> - --reachableAt=http://gerbil:3004
> - --generateAndSaveKeyTo=/var/config/key
> - --remoteConfig=http://pangolin:3001/api/v1/
> volumes:
> - ./config/:/var/config
> cap_add:
> - NET_ADMIN
> - SYS_MODULE
> ports:
> - 51820:51820/udp
> - 21820:21820/udp
> - 443:443
> - 443:443/udp # For http3 QUIC if desired
> - 80:80
> networks:
> default:
> aliases:
> - keycloak.domain.com # replace me
> ```
From what I've read in other threads, it seems that adding
networks:
default:
aliases:
- keycloak.domain.com
only works if Keycloak is on the same Docker network as Pangolin. But that's not the case for me.
Pangolin is on a VPS, while Keycloak is on-premises. Keycloak isn’t exposed directly but only via Pangolin through Newt.
In this case, how do I tell Pangolin to find keycloak.domain.com on the internal IP through Newt (if possible)?
Well not sure I use authelia myself and has no issues but it's also accessible via newt an just works fine.
<!-- gh-comment-id:4643176316 -->
@AstralDestiny commented on GitHub (Jun 7, 2026):
Well not sure I use authelia myself and has no issues but it's also accessible via newt an just works fine.
Pangolin is on a VPS, while Keycloak is on-premises
Just wondering, have you tested the keycloak with pangolin authentications/access limitations turned off? (publicly accessible)
<!-- gh-comment-id:4644663221 -->
@deskstorm commented on GitHub (Jun 8, 2026):
> Pangolin is on a VPS, while Keycloak is on-premises
Just wondering, have you tested the keycloak with pangolin authentications/access limitations turned off? (publicly accessible)
@alessandroarosio1977 commented on GitHub (Jun 8, 2026):
Hi,
this is the configuration for public resource:
There is not authentication for resource. When I select login via Keycloak, I reach keycloack login page. Error appears when I end login and I should entry in pangolin.
If I try to use keycloak as SSO (through Pangolin) for other exposed services, it works fine. And if I try to open and login to keycloak portal, it works too.
An important note: if I leave keycloak exposed not through Pangolin, I can login in Pangolin via Keycloak.
But my goal is not leave exposed services if not behind Pangolin/newt
<!-- gh-comment-id:4646186075 -->
@alessandroarosio1977 commented on GitHub (Jun 8, 2026):
Hi,
this is the configuration for public resource:
<img width="1591" height="1230" alt="Image" src="https://github.com/user-attachments/assets/793221f1-5d87-4d15-94f4-f84be2c739c0" />
<img width="1585" height="1063" alt="Image" src="https://github.com/user-attachments/assets/00146fb7-78b9-47fa-8a02-d212ff86c9a5" />
<img width="1583" height="840" alt="Image" src="https://github.com/user-attachments/assets/79dfe427-7a6a-4285-81b5-9a44865eea16" />
There is not authentication for resource. When I select login via Keycloak, I reach keycloack login page. Error appears when I end login and I should entry in pangolin.
<img width="491" height="302" alt="Image" src="https://github.com/user-attachments/assets/fd5dfb0d-eedc-4add-9b51-8a9405128914" />
If I try to use keycloak as SSO (through Pangolin) for other exposed services, it works fine. And if I try to open and login to keycloak portal, it works too.
An important note: if I leave keycloak exposed not through Pangolin, I can login in Pangolin via Keycloak.
But my goal is not leave exposed services if not behind Pangolin/newt
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @alessandroarosio1977 on GitHub (May 19, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3112
Describe the Bug
DNS autoritative in LAN for domain (split horizon)
Pangolin resouces
Problem:
Environment
To Reproduce
Expected Behavior
If I try to login to pagolin with keycloak (properly configured) I reach keycloak login page without issues
@deskstorm commented on GitHub (May 20, 2026):
Any way you can capture packets of what pangolin is sending in when it does a call to that proxy?
I do wonder if its like some issue talking to itself and doesnt think via the proxy?
@AstralDestiny commented on GitHub (May 20, 2026):
Throw pangolin into debug,
Though never used keycloak myself, sure it's a great program but alas it's java, I use authelia myself and no issues that and it's openID certified just like keycloak.
Also ment to post earlier forgot to press enter >.>
@alessandroarosio1977 commented on GitHub (May 21, 2026):
This is output of pangolin docker log catched within error login:
user@pangolin:/opt/pangolin# docker compose logs pangolin -f
pangolin |
pangolin | > @fosrl/pangolin@0.0.0 start
pangolin | > ENVIRONMENT=prod node dist/migrations.mjs && ENVIRONMENT=prod NODE_ENV=development node --enable-source-maps dist/server.mjs
pangolin |
pangolin | Starting migrations from version 1.18.4
pangolin | Migrations to run:
pangolin | All migrations completed successfully
pangolin | 2026-05-21T15:30:08+00:00 [info]: Pangolin gathers anonymous usage data to help us better understand how the software is used and guide future improvements and feature development. You can find more details, including instructions for opting out of this anonymous data collection, at: https://docs.pango
lin.net/telemetry
pangolin | 2026-05-21T15:30:09+00:00 [info]: Dashboard API server is running on http://localhost:3000
pangolin | 2026-05-21T15:30:09+00:00 [info]: Internal API server is running on http://localhost:3001
pangolin | 2026-05-21T15:30:15+00:00 [info]: Dashboard Web UI server is running on http://localhost:3002
pangolin | 2026-05-21T15:30:15+00:00 [info]: Updated exit node with reachableAt to http://gerbil:3004
pangolin | 2026-05-21T15:30:22+00:00 [info]: Establishing websocket connection
pangolin | 2026-05-21T15:30:22+00:00 [info]: Client added to tracking - NEWT ID: aaaaaaaaaaaaaaaaaaaa, Connection ID: e413034e-0e14-4859-a08b-3dc24fca41c4, Total connections: 1
pangolin | 2026-05-21T15:30:22+00:00 [info]: WebSocket connection established - NEWT ID: aaaaaaaaaaaaaaaaaaaa
pangolin | 2026-05-21T15:30:22+00:00 [warn]: Newt ping with outdated config version: 30 (current: 0)
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Updated peer ghM+B0P0lRm2lNo9bNu039GeWnayoJ8x8T6WJx6rdFg= on olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm bbbbbbbbbbbbbbbbbbbb
pangolin | 2026-05-21T15:30:22+00:00 [info]: Initiated peer add handshake for site 1 to olm ccccccccccccccccccc
pangolin | 2026-05-21T15:30:22+00:00 [info]: Handling healthcheck status message
pangolin | (node:26) [DEP0169] DeprecationWarning:
url.parse()behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued forurl.parse()vulnerabilities.pangolin | (Use
node --trace-deprecation ...to show where the warning was created)pangolin | Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/generate-url
pangolin | Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/validate-callback
pangolin | 2026-05-21T15:31:05+00:00 [error]: Failed to reach OIDC provider while exchanging authorization code {"error":"Failed to send request"}
As you can see, seem that pangolin try to communicate with itself (http://localhost:3000...)
On keycloak, after login failed, I see user session up from IP of my PC
@AstralDestiny commented on GitHub (May 21, 2026):
Can you put a,
Then down and up and see if it's happy at that point?
@alessandroarosio1977 commented on GitHub (May 21, 2026):
My docker-compose.yml is created by installer:
_name: pangolin
services:
pangolin:
image: docker.io/fosrl/pangolin:1.18.4
container_name: pangolin
restart: unless-stopped
deploy:
resources:
limits:
memory: 1g
reservations:
memory: 256m
volumes:
- ./config:/app/config
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
interval: "10s"
timeout: "10s"
retries: 15
gerbil:
image: docker.io/fosrl/gerbil:1.4.0
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://gerbil:3004
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://pangolin:3001/api/v1/
volumes:
- ./config/:/var/config
cap_add:
- NET_ADMIN
- SYS_MODULE
ports:
- 51820:51820/udp
- 21820:21820/udp
- 443:443
- 443:443/udp # For http3 QUIC if desired
- 80:80
traefik:
image: docker.io/traefik:v3.7.1
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
networks:
default:
driver: bridge
name: pangolin_
When you say:
services:
gerbil:
networks:
default:
aliases:
- keycloak.domain.com # replace me
you mean under my networks session in docker compose or inside gerbil section of file?
@AstralDestiny commented on GitHub (May 22, 2026):
It says gerbil there. it's line by line nested into the proper location.
@AstralDestiny commented on GitHub (May 22, 2026):
It's via default as compose automatically grouped them via the "default" network,
so services: gerbil: networks: default: aliases: - key.domain.com
@deskstorm commented on GitHub (May 22, 2026):
@AstralDestiny correct me if im wrong, but this should almost be a copy and paste for them? (As i might try a SSO soon too for Pangolin) @alessandroarosio1977
@AstralDestiny commented on GitHub (May 22, 2026):
yep just make sure it aligns with what your keycloak is
@alessandroarosio1977 commented on GitHub (May 22, 2026):
I tried to apply you suggests:
_name: pangolin
services:
pangolin:
image: docker.io/fosrl/pangolin:1.18.4
container_name: pangolin
restart: unless-stopped
deploy:
resources:
limits:
memory: 1g
reservations:
memory: 256m
environment:
- LOGLEVEL=DEBUG
volumes:
- ./config:/app/config
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
interval: "10s"
timeout: "10s"
retries: 15
gerbil:
image: docker.io/fosrl/gerbil:1.4.0
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://gerbil:3004
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://pangolin:3001/api/v1/
volumes:
- ./config/:/var/config
cap_add:
- NET_ADMIN
- SYS_MODULE
ports:
- 51820:51820/udp
- 21820:21820/udp
- 443:443
- 443:443/udp # For http3 QUIC if desired
- 80:80
networks:
default:
aliases:
- <>
traefik:
image: docker.io/traefik:v3.7.1
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil # Ports appear on the gerbil service
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
volumes:
- ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
- ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
- ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
networks:
default:
driver: bridge
name: pangolin_
but the behavior is the same. Same error
pangolin | Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/generate-url
pangolin | Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/2/oidc/validate-callback
pangolin | 2026-05-22T08:01:05+00:00 [error]: Failed to reach OIDC provider while exchanging authorization code {"error":"Failed to send request"}
@AstralDestiny commented on GitHub (May 22, 2026):
That was with a down and up and not just an up of the stack after changing right?
@alessandroarosio1977 commented on GitHub (May 22, 2026):
For sure. Docker compose downDocker compose up -dIl giorno 22 mag 2026, alle ore 19:11, AstralDestiny @.***> ha scritto:AstralDestiny left a comment (fosrl/pangolin#3112)
That was with a down and up and not just an up of the stack after changing right?
—Reply to this email directly, view it on GitHub, or unsubscribe.Triage notifications on the go with GitHub Mobile for iOS or Android.
You are receiving this because you were mentioned.Message ID: @.***>
@alessandroarosio1977 commented on GitHub (May 28, 2026):
Any idea on item?
Or any other step to investigate on problem?
@alessandroarosio1977 commented on GitHub (Jun 7, 2026):
From what I've read in other threads, it seems that adding
networks:
default:
aliases:
- keycloak.domain.com
only works if Keycloak is on the same Docker network as Pangolin. But that's not the case for me.
Pangolin is on a VPS, while Keycloak is on-premises. Keycloak isn’t exposed directly but only via Pangolin through Newt.
In this case, how do I tell Pangolin to find keycloak.domain.com on the internal IP through Newt (if possible)?
@AstralDestiny commented on GitHub (Jun 7, 2026):
Well not sure I use authelia myself and has no issues but it's also accessible via newt an just works fine.
@deskstorm commented on GitHub (Jun 8, 2026):
Just wondering, have you tested the keycloak with pangolin authentications/access limitations turned off? (publicly accessible)
@alessandroarosio1977 commented on GitHub (Jun 8, 2026):
Hi,
this is the configuration for public resource:
There is not authentication for resource. When I select login via Keycloak, I reach keycloack login page. Error appears when I end login and I should entry in pangolin.
If I try to use keycloak as SSO (through Pangolin) for other exposed services, it works fine. And if I try to open and login to keycloak portal, it works too.
An important note: if I leave keycloak exposed not through Pangolin, I can login in Pangolin via Keycloak.
But my goal is not leave exposed services if not behind Pangolin/newt