This guide provides step-by-step instructions for configuring Pangolin
Community Edition to protect the paperclip.basicstack.de domain with
authentication and access control. It uses application-level policies
instead of enterprise-only global policies.
Related to DEV-400.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Configure pangolin-kube-controller to authenticate with Pangolin API
using the provided API key.
Changes:
- Add CONFIG_AUTH_HEADER environment variable to controller deployment
- Reference pangolin-controller-api-key secret (not yet created)
- Secret will contain Bearer token for API authentication
BLOCKED: Requires manual secret sealing step before deployment.
To complete this deployment, run on a machine with cluster access:
kubectl create secret generic pangolin-controller-api-key \
--namespace=pangolin \
--from-literal=auth-header="Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw" \
--dry-run=client -o yaml | \
kubeseal --controller-name=sealed-secrets --controller-namespace=sealed-secrets \
--format=yaml > apps/pangolin/pangolin-controller-api-key-sealed.yaml
Then commit the sealed secret and push both files.
Related: Issue for pangolin-kube-controller deployment
API Key provided by CEO in DEV-400 comments
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Update liveness and readiness probe ports from 8080 to 9090 to match the
controller's METRICS_ADDR configuration. The controller is configured to
serve metrics on port 9090, but the probes were checking port 8080,
causing pods to remain in NotReady state despite the controller
functioning correctly.
Also update containerPort to 9090 for consistency.
Related: DEV-437
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Extend ClusterRole to include all Traefik CRDs that the controller manages:
- serverstransports, serverstransporttcps (for transport configuration)
- ingressroutetcps, ingressrouteudps (for TCP/UDP routing)
- middlewaretcps (for TCP middleware)
- tlsoptions, tlsstores (for TLS configuration)
This fixes the RBAC permission error preventing the controller from
reconciling Traefik configuration: "serverstransports.traefik.io is
forbidden: User \"system:serviceaccount:pangolin:pangolin-controller\"
cannot list resource \"serverstransports\""
Related: DEV-437
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Update controller configuration to fix 401 authentication errors:
- Add CONFIG_AUTH_HEADER with Bearer token for Pangolin API access
- Correct CONFIG_ENDPOINT port from 3000 to 3002 (matches Pangolin service)
- Remove duplicate controller manifests from controller/ subdirectory
The existing controller deployment was failing with 401 errors because
it lacked authentication credentials. This change adds the API key
provided in DEV-437 and corrects the internal service endpoint.
Related: DEV-437
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Move Kubernetes controller manifests from kube-controller/ subdirectory
to the apps/pangolin/ root directory so Argo CD will sync them.
Files renamed with pangolin-controller- prefix:
- configmap.yaml -> pangolin-controller-config.yaml
- deployment.yaml -> pangolin-controller-deployment.yaml
- rbac.yaml -> pangolin-controller-rbac.yaml
- service.yaml -> pangolin-controller-service.yaml
Argo CD was not recursing into the subdirectory, so controller resources
were not being synced. Moving to root directory resolves this.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Use specific image version 0.1.0-alpha.1 instead of :latest
- Fix API endpoint port from 3001 to 3000 (correct Pangolin service port)
- Add CONFIG_ALLOW_INSECURE_HTTP for internal cluster HTTP communication
- Fix security context with numeric UIDs (65532) to avoid runAsNonRoot error
- Add required RBAC permissions for CRD and IngressClass discovery
Controller now successfully starts and acquires leader lease.
Next step: Configure API authentication (CONFIG_AUTH_HEADER) for
controller to access Pangolin API endpoint.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Create complete manifest set for Pangolin controller deployment:
- RBAC with ServiceAccount, ClusterRole, and ClusterRoleBinding
- ConfigMap with controller configuration (endpoint, namespace, leader election)
- Deployment with resource limits, health probes, and security context
- Service for metrics endpoint on port 8080
Controller will manage Traefik CRDs (IngressRoute, Middleware, TraefikService)
and sync configuration from Pangolin API.
Relates to DEV-397
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The Pangolin setup was failing with 404 on /api/v1/auth/set-server-admin
because the ingress was routing all traffic to port 3002 (Web UI), but
API endpoints are served by a separate API server on port 3000.
Changes:
- Added port 3000 (api) to deployment container ports
- Updated service to expose both port 3000 (api) and 3002 (http)
- Added /api path to ingress routing to port 3000
- Kept / path routing to port 3002 for Web UI
This allows the browser to make API calls to /api/* which will now
be routed to the API server, fixing the 404 error.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fixes server action 404 error preventing initial setup.
Version 1.21.1 was released on 2026-07-30 and includes fixes
for Next.js server action routing issues.
Related: DEV-396
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Changed Traefik entrypoints from 'websecure' (HTTPS-only) to
'web,websecure' (HTTP + HTTPS) to allow Let's Encrypt HTTP-01
challenge verification on port 80.
The TLS section in the ingress will still redirect HTTP to HTTPS
for normal traffic after the certificate is issued.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The DNS-01 challenge has been stuck for 5+ days due to Hetzner DNS
webhook issues. Switched to the more reliable HTTP-01 challenge method
by using the new letsencrypt-http01 ClusterIssuer.
This resolves the missing certificate issue for pangolin.basicstack.de.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pangolin runs three servers:
- Dashboard API on port 3000
- Internal API on port 3001
- Web UI on port 3002
The current configuration was routing traffic to port 3001 (Internal API), which
returns 404 for the root path, causing health probe failures and restart loops.
Changes:
- Update containerPort from 3001 to 3002
- Update livenessProbe to check port 3002
- Update readinessProbe to check port 3002
- Update Service to expose port 3002
- Update Ingress to route to port 3002
This allows health probes to pass (port 3002 returns 200 for /) and routes
web traffic to the correct Web UI server.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Mount config file to /app/config/config.toml instead of /app/config.toml as the application expects it in the config directory.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pangolin requires a config.toml file to start. Added ConfigMap with basic configuration including URL, database path, and OIDC settings. Updated deployment to mount the config file.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Cluster nodes are at 93-99% memory capacity. Reduced requests from 512Mi to 256Mi and CPU from 200m to 100m to allow pod scheduling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Created apps/pangolin/ directory with namespace.yaml defining the pangolin namespace.
Configured DNS A record for pangolin.basicstack.de → 178.105.17.239 (cluster ingress IP).
Updated DNS_REQUIREMENTS.md to document the new Pangolin service.
This completes Phase 1 of the Pangolin deployment (DEV-390):
- Repository structure created with namespace definition
- DNS record configured and verified in Hetzner zone
- Documentation updated
Co-Authored-By: Paperclip <noreply@paperclip.ing>
