github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-21 17:34:41 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[BUG] 502 error on apps on local/same host #595

New Issue
Closed
opened 2025-11-13 12:05:23 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-13 12:05:23 -06:00
Owner
Copy Link
Copy Source

Originally created by @dev-Blaze on GitHub (Aug 21, 2025).

It seems like any apps/services hosted on the same host as pangolin reverse proxy (Racknerd VPS) have trouble authenticating via OIDC (pocket-id) which the auth provider is also behind Pangolin and also on the same host.

whats weird is that services on a remote/newt site work fine, authentication works no issues. only issues with services that are local.

Services not using pocket-id for auth (login form/basic auth) work fine as well.

NOTE: i am not using pocket-id for pangolin authentication itself, this is auth for the separate applications with oidc functionality. pangolin is strictly just the reverse proxy in this scenario.

all services are docker containers, and I have also verified that the individual containers can ping the pangolin container, they are all on the same docker network.

pangolin version 1.8.0
gerbil 1.1.0
traefik 3.5.0

Example - outline app using pocketid for oidc auth.

Logs from Pocket ID:

time=2025-08-11T06:42:16.974-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:16.972Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorization-required request.query="" request.params=map[] request.route=/api/oidc/authorization-required request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=82 response.time=2025-08-11T13:42:16.973Z response.latency=1.239892ms response.status=200 response.length=31
time=2025-08-11T06:42:17.057-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:17.050Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorize request.query="" request.params=map[] request.route=/api/oidc/authorize request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=196 response.time=2025-08-11T13:42:17.057Z response.latency=6.66303ms response.status=200 response.length=148
time=2025-08-11T06:42:48.174-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:48.172Z request.method=GET request.host=auth.redacted request.path=/api/application-configuration/logo request.query="" request.params=map[] request.route=/api/application-configuration/logo request.ip=redacted request.referer=https://dashboard.redacted/ request.length=0 response.time=2025-08-11T13:42:48.174Z response.latency=1.188735ms response.status=200 response.length=32800

Log from Outline Application:

ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) 
ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16)

Any help would be appreciated. Thanks

Originally created by @dev-Blaze on GitHub (Aug 21, 2025). It seems like any apps/services hosted on the same host as pangolin reverse proxy (Racknerd VPS) have trouble authenticating via OIDC (pocket-id) which the auth provider is also behind Pangolin and also on the same host. whats weird is that services on a remote/newt site work fine, authentication works no issues. only issues with services that are local. Services not using pocket-id for auth (login form/basic auth) work fine as well. NOTE: i am not using pocket-id for pangolin authentication itself, this is auth for the separate applications with oidc functionality. pangolin is strictly just the reverse proxy in this scenario. all services are docker containers, and I have also verified that the individual containers can ping the pangolin container, they are all on the same docker network. pangolin version 1.8.0 gerbil 1.1.0 traefik 3.5.0 Example - outline app using pocketid for oidc auth. Logs from Pocket ID: ``` time=2025-08-11T06:42:16.974-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:16.972Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorization-required request.query="" request.params=map[] request.route=/api/oidc/authorization-required request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=82 response.time=2025-08-11T13:42:16.973Z response.latency=1.239892ms response.status=200 response.length=31 time=2025-08-11T06:42:17.057-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:17.050Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorize request.query="" request.params=map[] request.route=/api/oidc/authorize request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=196 response.time=2025-08-11T13:42:17.057Z response.latency=6.66303ms response.status=200 response.length=148 time=2025-08-11T06:42:48.174-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:48.172Z request.method=GET request.host=auth.redacted request.path=/api/application-configuration/logo request.query="" request.params=map[] request.route=/api/application-configuration/logo request.ip=redacted request.referer=https://dashboard.redacted/ request.length=0 response.time=2025-08-11T13:42:48.174Z response.latency=1.188735ms response.status=200 response.length=32800 ``` Log from Outline Application: ``` ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443 at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443 at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) ``` Any help would be appreciated. Thanks
GiteaMirror added the stale label 2025-11-13 12:05:23 -06:00
GiteaMirror commented 2025-11-13 12:05:24 -06:00
Author
Owner
Copy Link
Copy Source

@oschwartz10612 commented on GitHub (Aug 31, 2025):

Hi sorry for the delay!

Do you get bad gateway after going through pocket id or before? Do you
get the bad gateway when you are sent to pocket id? I agree this does
not make any sense.

A gut reaction is that it would be because pangolin cant reach those
local containers but if you say it works without oidc this does not make
sense.

Can you try updating to the latest version and see if that helps at all.
Remember to backup config/ first.

@oschwartz10612 commented on GitHub (Aug 31, 2025): Hi sorry for the delay! Do you get bad gateway after going through pocket id or before? Do you get the bad gateway when you are sent to pocket id? I agree this does not make any sense. A gut reaction is that it would be because pangolin cant reach those local containers but if you say it works without oidc this does not make sense. Can you try updating to the latest version and see if that helps at all. Remember to backup config/ first.
GiteaMirror commented 2025-11-13 12:05:25 -06:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Sep 15, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

@github-actions[bot] commented on GitHub (Sep 15, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2025-11-13 12:05:25 -06:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Sep 30, 2025):

This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.

@github-actions[bot] commented on GitHub (Sep 30, 2025): This issue has been automatically closed due to inactivity. If you believe this is still relevant, please open a new issue with up-to-date information.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No labels stale
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#595