[GH-ISSUE #3314] Health-check target silently dropped (stuck unhealthy) when hcHostname is null — no validation error #39158

New Issue

GiteaMirror · 2026-06-22T03:02:00-05:00

GiteaMirror commented

2026-06-22 03:02:00 -05:00

Originally created by @davedavedavenm on GitHub (Jun 21, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3314

Version: Pangolin 1.19.2 (fosrl/pangolin:ee-latest), newt 1.13.0

Summary: A target created with hcEnabled: true but without hcHostname is accepted by the API with no error, but the server then filters it out of healthCheckTargets (so newt never health-checks it) and the target stays unhealthy indefinitely. There is no signal to the operator that the target is mis-configured.

Source (server.mjs, healthCheckTargets build):

const healthCheckTargets = allHealthChecks.map((target) => {
  const isTCP = target.hcMode?.toLowerCase() === "tcp";
  if (!target.hcHostname || !target.hcPort || !target.hcInterval) {
    return null;   // silently dropped
  }
  ...

Repro: create a target via the API with hcEnabled: true, valid hcPath/hcPort/hcInterval, but no hcHostname. The target reports unhealthy forever; newt's newt/wg/connect message shows healthCheckTargets: []. Setting hcHostname (e.g. to the target IP) immediately fixes it and the target goes healthy.

Expected: when hcEnabled: true, either reject the create/update with a clear 400 if hcHostname is missing, or default hcHostname to the target IP. Currently it fails silently and is very hard to diagnose.

Originally created by @davedavedavenm on GitHub (Jun 21, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3314 **Version:** Pangolin 1.19.2 (`fosrl/pangolin:ee-latest`), newt 1.13.0 **Summary:** A target created with `hcEnabled: true` but without `hcHostname` is accepted by the API with no error, but the server then filters it out of `healthCheckTargets` (so newt never health-checks it) and the target stays `unhealthy` indefinitely. There is no signal to the operator that the target is mis-configured. **Source (`server.mjs`, healthCheckTargets build):** ```js const healthCheckTargets = allHealthChecks.map((target) => { const isTCP = target.hcMode?.toLowerCase() === "tcp"; if (!target.hcHostname || !target.hcPort || !target.hcInterval) { return null; // silently dropped } ... ``` **Repro:** create a target via the API with `hcEnabled: true`, valid `hcPath`/`hcPort`/`hcInterval`, but no `hcHostname`. The target reports `unhealthy` forever; newt's `newt/wg/connect` message shows `healthCheckTargets: []`. Setting `hcHostname` (e.g. to the target IP) immediately fixes it and the target goes healthy. **Expected:** when `hcEnabled: true`, either reject the create/update with a clear `400` if `hcHostname` is missing, or default `hcHostname` to the target IP. Currently it fails silently and is very hard to diagnose.

Sign in to join this conversation.

Branches Tags

main

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#39158