[GH-ISSUE #2812] To much site creations with provisioning keys #7043

New Issue

GiteaMirror · 2026-04-25T16:02:32-05:00

GiteaMirror commented

2026-04-25 16:02:32 -05:00

Originally created by @daddeldash on GitHub (Apr 8, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2812

Describe the Bug

When I use the new provisioning keys (which are an amazing idea!), and start my newt container, the site is created as expected. But when I restart the container (or it gets an error and is restarting constantly), Pangoling creates a new site for every single boot.

  newt:
    image: fosrl/newt
    restart: unless-stopped
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.instance.tld
      - NEWT_NAME=${NEWT_NAME}
      - NEWT_PROVISIONING_KEY=${PROVISIONING_KEY}
    networks:
      - frontend
    volumes:
      - ./volumes/newt/newt.json:/var/newt.json
      - /var/run/docker.sock:/var/run/docker.sock

Environment

OS Type & Version: (e.g., Ubuntu 22.04)
- debian 13 and Ubuntu 22.04
Pangolin Version:
- 1.17.0
Gerbil Version:
- 1.3.1
Traefik Version:
- latest
Newt Version:
- 1.11.0

To Reproduce

Like described above

Expected Behavior

I expected pangolin to reuse the preconfigured site

Originally created by @daddeldash on GitHub (Apr 8, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2812 ### Describe the Bug When I use the new provisioning keys (which are an amazing idea!), and start my newt container, the site is created as expected. But when I restart the container (or it gets an error and is restarting constantly), Pangoling creates a new site for every single boot. ``` newt: image: fosrl/newt restart: unless-stopped environment: - PANGOLIN_ENDPOINT=https://pangolin.instance.tld - NEWT_NAME=${NEWT_NAME} - NEWT_PROVISIONING_KEY=${PROVISIONING_KEY} networks: - frontend volumes: - ./volumes/newt/newt.json:/var/newt.json - /var/run/docker.sock:/var/run/docker.sock ``` ### Environment - OS Type & Version: (e.g., Ubuntu 22.04) - - debian 13 and Ubuntu 22.04 - Pangolin Version: - - 1.17.0 - Gerbil Version: - - 1.3.1 - Traefik Version: - - latest - Newt Version: - - 1.11.0 ### To Reproduce Like described above ### Expected Behavior I expected pangolin to reuse the preconfigured site

GiteaMirror closed this issue

2026-04-25 16:02:33 -05:00

GiteaMirror commented

2026-04-25 16:02:34 -05:00

@LaurenceJJones commented on GitHub (Apr 8, 2026):

But when I restart the container (or it gets an error and is restarting constantly), Pangoling creates a new site for every single boot.

Provisioning keys are meant to be used in ephemeral environments, but also you should specify environment CONFIG_FILE=/var/newt.json to make sure the configuration gets written to where you have persisted the volume mount so next time it should just use it unless we didnt account for it.

edit: checked the code it does skip provisioning if the file is persisted, so it not a bug just a configuration issue inside your compose EG: add that environment and ensure the volume mount is a file and persisted correctly.

Just note you may get a error if that file didnt exist before and its now a directory (docker defaults to creating a directory if file doesnt exist), so rm volumes/newt/newt.json && touch volumes/newt/newt.json

@LaurenceJJones commented on GitHub (Apr 8, 2026): > But when I restart the container (or it gets an error and is restarting constantly), Pangoling creates a new site for every single boot. Provisioning keys are meant to be used in ephemeral environments, but also you should specify environment `CONFIG_FILE=/var/newt.json` to make sure the configuration gets written to where you have persisted the volume mount so next time it should just use it unless we didnt account for it. _edit_: checked the code it does skip provisioning if the file is persisted, so it not a bug just a configuration issue inside your compose EG: add that environment and ensure the volume mount is a file and persisted correctly. Just note you may get a error if that file didnt exist before and its now a directory (docker defaults to creating a directory if file doesnt exist), so `rm volumes/newt/newt.json && touch volumes/newt/newt.json`

GiteaMirror commented

2026-04-25 16:02:34 -05:00

@daddeldash commented on GitHub (Apr 8, 2026):

Provisioning keys are meant to be used in ephemeral environments

That's right, but when even if I start multiple instances of the same container, multiple sites are created in pangolin (and will never be deleted), all with the exact same name

@daddeldash commented on GitHub (Apr 8, 2026): > Provisioning keys are meant to be used in ephemeral environments That's right, but when even if I start multiple instances of the same container, multiple sites are created in pangolin (and will never be deleted), all with the exact same name

GiteaMirror commented

2026-04-25 16:02:35 -05:00

@LaurenceJJones commented on GitHub (Apr 8, 2026):

Okay but again, make sure you have the environment flag to define where the configuration file sits and that ./volumes/newt/newt.json is a file and not a directory so that newt can write to the location.

As long as those things are in order, if you check the logs it will print what newt is doing.

edit: so there a few issues let me check with maintainer if the aim is to have this working.

So it fails fast without proper json so

echo "{}" > ./volumes/newt/newt.json

then (just used podman but same for compose)

podman run -e PANGOLIN_ENDPOINT=https://pangolin.redact.uk \
-e NEWT_NAME=test \
-e NEWT_PROVISIONING_KEY=<redact> \
-e CONFIG_FILE=/var/newt.json \
-v ~/newt.json:/var/newt.json docker://fosrl/newt

then file is created and persisted

{
  "id": "761x16ty7wswwmn",
  "secret": "redact",
  "endpoint": "https://pangolin.redact.uk",
  "tlsClientCert": ""
}

then its reused

podman run -e PANGOLIN_ENDPOINT=https://pangolin.redact.uk -e NEWT_NAME=test -e NEWT_PROVISIONING_KEY=redact -e CONFIG_FILE=/var/newt.json -v ~/newt.json:/var/newt.json docker://fosrl/newt
INFO: 2026/04/08 12:55:21 Newt version 1.11.0
**INFO: 2026/04/08 12:55:21 Loading config from: /var/newt.json**
INFO: 2026/04/08 12:55:21 CLI arguments provided, config will be updated
INFO: 2026/04/08 12:55:22 Server version: 1.17.0
INFO: 2026/04/08 12:55:22 Saving config to: /var/newt.json
INFO: 2026/04/08 12:55:22 Websocket connected
INFO: 2026/04/08 12:55:22 Client connectivity setup. Ready to accept connections from clients!
INFO: 2026/04/08 12:55:22 Connecting to endpoint: 139.59.191.239
INFO: 2026/04/08 12:55:22 Tunnel connection to server established successfully!

@LaurenceJJones commented on GitHub (Apr 8, 2026): Okay but again, make sure you have the environment flag to define where the configuration file sits and that `./volumes/newt/newt.json` is a file and not a directory so that newt can write to the location. As long as those things are in order, if you check the logs it will print what newt is doing. edit: so there a few issues let me check with maintainer if the aim is to have this working. So it fails fast without proper json so ``` echo "{}" > ./volumes/newt/newt.json ``` then (just used podman but same for compose) ``` podman run -e PANGOLIN_ENDPOINT=https://pangolin.redact.uk \ -e NEWT_NAME=test \ -e NEWT_PROVISIONING_KEY=<redact> \ -e CONFIG_FILE=/var/newt.json \ -v ~/newt.json:/var/newt.json docker://fosrl/newt ``` then file is created and persisted ``` { "id": "761x16ty7wswwmn", "secret": "redact", "endpoint": "https://pangolin.redact.uk", "tlsClientCert": "" } ``` then its reused ``` podman run -e PANGOLIN_ENDPOINT=https://pangolin.redact.uk -e NEWT_NAME=test -e NEWT_PROVISIONING_KEY=redact -e CONFIG_FILE=/var/newt.json -v ~/newt.json:/var/newt.json docker://fosrl/newt INFO: 2026/04/08 12:55:21 Newt version 1.11.0 **INFO: 2026/04/08 12:55:21 Loading config from: /var/newt.json** INFO: 2026/04/08 12:55:21 CLI arguments provided, config will be updated INFO: 2026/04/08 12:55:22 Server version: 1.17.0 INFO: 2026/04/08 12:55:22 Saving config to: /var/newt.json INFO: 2026/04/08 12:55:22 Websocket connected INFO: 2026/04/08 12:55:22 Client connectivity setup. Ready to accept connections from clients! INFO: 2026/04/08 12:55:22 Connecting to endpoint: 139.59.191.239 INFO: 2026/04/08 12:55:22 Tunnel connection to server established successfully! ```

GiteaMirror commented

2026-04-25 16:02:36 -05:00

@daddeldash commented on GitHub (Apr 8, 2026):

Ok, I've set the CONFIG_FILE env, but my problem was that docker created a directory instead of a file for ./volumes/newt/newt.json. Thanks you!
But now, I'm running in the next problem. When I create an empty newt.json file by hand, the docker container restarts continuously. Maybe docker and podman are working different in this case?

newt-1  | INFO: 2026/04/08 12:59:01 Newt version 1.11.0
newt-1  | INFO: 2026/04/08 12:59:01 Loading config from: /var/newt.json
newt-1  | FATAL: 2026/04/08 12:59:01 Failed to create client: failed to load config: unexpected end of JSON input
newt-1 exited with code 1 (restarting)

@daddeldash commented on GitHub (Apr 8, 2026): Ok, I've set the CONFIG_FILE env, but my problem was that docker created a directory instead of a file for `./volumes/newt/newt.json`. Thanks you! But now, I'm running in the next problem. When I create an empty `newt.json` file by hand, the docker container restarts continuously. Maybe docker and podman are working different in this case? ``` newt-1 | INFO: 2026/04/08 12:59:01 Newt version 1.11.0 newt-1 | INFO: 2026/04/08 12:59:01 Loading config from: /var/newt.json newt-1 | FATAL: 2026/04/08 12:59:01 Failed to create client: failed to load config: unexpected end of JSON input newt-1 exited with code 1 (restarting) ```

GiteaMirror commented

2026-04-25 16:02:36 -05:00

@LaurenceJJones commented on GitHub (Apr 8, 2026):

Yeah I ran into that also just scaffold with empty json

rm ./volumes/newt/newt.json && echo "{}" > ./volumes/newt/newt.json

im going to throw a PR in newt direction to check if 0 bytes and skip the json as its an empty file

realistically you should mount a directory instead like ./volumes/newt/:/var/ this would be easier if you plan to use this compose across multiple sites as then you dont have a pre scaffold script to ensure the file exists and docker wont bite you in the ass and create a directory 😆

Plus newt wont complain about json if the file doesnt exist on disk yet, it will skip the json part leading to better consistent results.

@LaurenceJJones commented on GitHub (Apr 8, 2026): Yeah I ran into that also just scaffold with empty json ``` rm ./volumes/newt/newt.json && echo "{}" > ./volumes/newt/newt.json ``` im going to throw a PR in newt direction to check if 0 bytes and skip the json as its an empty file realistically you should mount a directory instead like `./volumes/newt/:/var/` this would be easier if you plan to use this compose across multiple sites as then you dont have a pre scaffold script to ensure the file exists and docker wont bite you in the ass and create a directory 😆 Plus newt wont complain about json if the file doesnt exist on disk yet, it will skip the json part leading to better consistent results.

GiteaMirror commented

2026-04-25 16:02:36 -05:00

@daddeldash commented on GitHub (Apr 8, 2026):

Thank's a lot, man. With the '{}' trick it worked 🤗
Now I have to figure out how I can persist this workaround for my hosts, since the deployment software only delivers docker-compose.yml and .env 🙈

@daddeldash commented on GitHub (Apr 8, 2026): Thank's a lot, man. With the '{}' trick it worked 🤗 Now I have to figure out how I can persist this workaround for my hosts, since the deployment software only delivers docker-compose.yml and .env 🙈

GiteaMirror commented

2026-04-25 16:02:37 -05:00

@LaurenceJJones commented on GitHub (Apr 8, 2026):

Thank's a lot, man. With the '{}' trick it worked 🤗 Now I have to figure out how I can persist this workaround for my hosts, since the deployment software only delivers docker-compose.yml and .env 🙈

Yeah my recommendation is:

Make sure CONFIG_FILE is set relative to the persisted mount.
Dont mount the .json file mount just the base directory EG: ./volumes/newt/:/var/.

This should fix all issues as:

Newt skips json unmarshal if file doesnt exist (I just created a PR to skip if empty but doesnt matter in this case if you follow above).
You wont need to pre scaffold the file as your mounting a directory now instead of the file itself (docker will auto create directories but that is fine as what we want).
Since the file is persisted in the directory it should now survive reboots.

@LaurenceJJones commented on GitHub (Apr 8, 2026): > Thank's a lot, man. With the '{}' trick it worked 🤗 Now I have to figure out how I can persist this workaround for my hosts, since the deployment software only delivers docker-compose.yml and .env 🙈 Yeah my recommendation is: - Make sure `CONFIG_FILE` is set relative to the persisted mount. - Dont mount the `.json` file mount just the base directory EG: `./volumes/newt/:/var/`. This should fix all issues as: - Newt skips json unmarshal if file doesnt exist (I just created a PR to skip if empty but doesnt matter in this case if you follow above). - You wont need to pre scaffold the file as your mounting a directory now instead of the file itself (docker will auto create directories but that is fine as what we want). - Since the file is persisted in the directory it should now survive reboots.

GiteaMirror commented

2026-04-25 16:02:37 -05:00

@daddeldash commented on GitHub (Apr 8, 2026):

Oh wow, that was really too simple. I really wonder why I was stuck to a file-bind mount in my head instead of just mounting the folder.
Again, thank's a lot for your guidance

@daddeldash commented on GitHub (Apr 8, 2026): Oh wow, that was really too simple. I really wonder why I was stuck to a file-bind mount in my head instead of just mounting the folder. Again, thank's a lot for your guidance

Sign in to join this conversation.

Branches Tags

main

local-connection

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#7043