DEV-452. After the SQLite -> Postgres migration in DEV-451 the pangolin
initial setup was redone, so the controller's stale bearer token was
invalid. That was only half the problem: /api/v1/traefik-config is
served exclusively by Pangolin's internal API (port 3001), not the
external dashboard API (port 3000). Pointing a Bearer request at port
3000 always returned 401 because that path lives on the session-auth
router. This has been the underlying cause of the controller's
CrashLoopBackOff, not just the stale key.
Changes:
- pangolin-controller-api-key-sealed.yaml: reseal new bearer token
(kubeseal against sealed-secrets-controller in kube-system, includes
the Bearer prefix expected by the controller).
- pangolin-controller-config.yaml: CONFIG_ENDPOINT now targets
http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config.
- pangolin-deployment.yaml: Service now exposes port 3001 as the
"internal" port so in-cluster clients (kube-controller) can reach it.
Ingress still only routes / and /api to ports 3002/3000; port 3001
is not published to the internet.
- pangolin-controller-deployment.yaml: replicas back to 1, dropped the
temporary "scaled to 0" comment block.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pangolin's PostgreSQL build requires postgres.connection_string in
config.yml — DATABASE_URL alone is not honored as an override, so the
container was crashing with "Postgres configuration is missing in the
configuration file".
Render the final config.yml at pod startup via a busybox init container
that substitutes the DATABASE_URL secret into a __DATABASE_URL__
placeholder in the ConfigMap template, then mount the rendered file
into the pangolin container.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Deploy a dedicated PostgreSQL 17 instance in the pangolin namespace
and switch Pangolin (fosrl/pangolin) to the postgresql-1.21.1 image
variant. The database URL is provided via a sealed secret and pulled
into the Pangolin container as DATABASE_URL, which the PostgreSQL
Pangolin build reads at startup.
- New: postgres.yaml (Deployment + PVC on hcloud-volumes-encrypted + Service)
- New: pangolin-postgres-secrets-sealed.yaml (postgres creds + connection string)
- pangolin-deployment.yaml: image -> fosrl/pangolin:postgresql-1.21.1,
DATABASE_URL from secret, /app/config PVC mount, init container waits
for postgres, removed obsolete DATABASE_PATH env
- pangolin-config.yaml: dropped SQLite database.path stanza
Fixes DEV-451.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The Pangolin setup was failing with 404 on /api/v1/auth/set-server-admin
because the ingress was routing all traffic to port 3002 (Web UI), but
API endpoints are served by a separate API server on port 3000.
Changes:
- Added port 3000 (api) to deployment container ports
- Updated service to expose both port 3000 (api) and 3002 (http)
- Added /api path to ingress routing to port 3000
- Kept / path routing to port 3002 for Web UI
This allows the browser to make API calls to /api/* which will now
be routed to the API server, fixing the 404 error.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fixes server action 404 error preventing initial setup.
Version 1.21.1 was released on 2026-07-30 and includes fixes
for Next.js server action routing issues.
Related: DEV-396
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Changed Traefik entrypoints from 'websecure' (HTTPS-only) to
'web,websecure' (HTTP + HTTPS) to allow Let's Encrypt HTTP-01
challenge verification on port 80.
The TLS section in the ingress will still redirect HTTP to HTTPS
for normal traffic after the certificate is issued.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The DNS-01 challenge has been stuck for 5+ days due to Hetzner DNS
webhook issues. Switched to the more reliable HTTP-01 challenge method
by using the new letsencrypt-http01 ClusterIssuer.
This resolves the missing certificate issue for pangolin.basicstack.de.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pangolin runs three servers:
- Dashboard API on port 3000
- Internal API on port 3001
- Web UI on port 3002
The current configuration was routing traffic to port 3001 (Internal API), which
returns 404 for the root path, causing health probe failures and restart loops.
Changes:
- Update containerPort from 3001 to 3002
- Update livenessProbe to check port 3002
- Update readinessProbe to check port 3002
- Update Service to expose port 3002
- Update Ingress to route to port 3002
This allows health probes to pass (port 3002 returns 200 for /) and routes
web traffic to the correct Web UI server.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Mount config file to /app/config/config.toml instead of /app/config.toml as the application expects it in the config directory.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pangolin requires a config.toml file to start. Added ConfigMap with basic configuration including URL, database path, and OIDC settings. Updated deployment to mount the config file.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Cluster nodes are at 93-99% memory capacity. Reduced requests from 512Mi to 256Mi and CPU from 200m to 100m to allow pod scheduling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
