Resources under a top-level wildcard (e.g. *.domain.com) succeed. Only deeper wildcard domains are affected.
Root Cause
createCertificate checked for an existing cert by filtering on both domainId and domain. However, certificates.domain has a global unique constraint (not per-domainId).
When getDomainId() resolves a full-domain to a parent domain (e.g. domain.com → domainId = "domain1") instead of the more specific web.domain.com domain, the domainId used in the check doesn't match the existing cert's stored domainId. The check silently misses the cert and falls through to INSERT — which then crashes on the global unique constraint.
Fix
Removed domainId from the existing-cert WHERE clause. Since certificates.domain is globally unique, checking by domain value alone is correct and sufficient.
Added .onConflictDoNothing() to the INSERT as a safety net for any remaining edge cases.
Files Changed
server/private/routers/certificates/createCertificate.ts
Fixes Closes#2937
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/3199
**Author:** [@Adityakk9031](https://github.com/Adityakk9031)
**Created:** 6/1/2026
**Status:** 🔄 Open
**Base:** `dev` ← **Head:** `#2937`
---
### 📝 Commits (1)
- [`92f9c11`](https://github.com/fosrl/pangolin/commit/92f9c113c0b3867de0d2f2bde46eb19f9c580a4f) fix: blueprint apply fails with UNIQUE constraint on certificates.domain (#2937)
### 📊 Changes
**1 file changed** (+13 additions, -18 deletions)
<details>
<summary>View changed files</summary>
📝 `server/private/routers/certificates/createCertificate.ts` (+13 -18)
</details>
### 📄 Description
Problem
Applying a blueprint with a resource under a wildcard subdomain (e.g. *.web.domain.com) fails with:
SqliteError: UNIQUE constraint failed: certificates.domain
Resources under a top-level wildcard (e.g. *.domain.com) succeed. Only deeper wildcard domains are affected.
Root Cause
createCertificate checked for an existing cert by filtering on both domainId and domain. However, certificates.domain has a global unique constraint (not per-domainId).
When getDomainId() resolves a full-domain to a parent domain (e.g. domain.com → domainId = "domain1") instead of the more specific web.domain.com domain, the domainId used in the check doesn't match the existing cert's stored domainId. The check silently misses the cert and falls through to INSERT — which then crashes on the global unique constraint.
Fix
Removed domainId from the existing-cert WHERE clause. Since certificates.domain is globally unique, checking by domain value alone is correct and sufficient.
Added .onConflictDoNothing() to the INSERT as a safety net for any remaining edge cases.
Files Changed
server/private/routers/certificates/createCertificate.ts
Fixes
Closes #2937
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3199
Author: @Adityakk9031
Created: 6/1/2026
Status: 🔄 Open
Base:
dev← Head:#2937📝 Commits (1)
92f9c11fix: blueprint apply fails with UNIQUE constraint on certificates.domain (#2937)📊 Changes
1 file changed (+13 additions, -18 deletions)
View changed files
📝
server/private/routers/certificates/createCertificate.ts(+13 -18)📄 Description
Problem
Applying a blueprint with a resource under a wildcard subdomain (e.g. *.web.domain.com) fails with:
SqliteError: UNIQUE constraint failed: certificates.domain
Resources under a top-level wildcard (e.g. *.domain.com) succeed. Only deeper wildcard domains are affected.
Root Cause
createCertificate checked for an existing cert by filtering on both domainId and domain. However, certificates.domain has a global unique constraint (not per-domainId).
When getDomainId() resolves a full-domain to a parent domain (e.g. domain.com → domainId = "domain1") instead of the more specific web.domain.com domain, the domainId used in the check doesn't match the existing cert's stored domainId. The check silently misses the cert and falls through to INSERT — which then crashes on the global unique constraint.
Fix
Removed domainId from the existing-cert WHERE clause. Since certificates.domain is globally unique, checking by domain value alone is correct and sufficient.
Added .onConflictDoNothing() to the INSERT as a safety net for any remaining edge cases.
Files Changed
server/private/routers/certificates/createCertificate.ts
Fixes
Closes #2937
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.