Way to bypass auth for some subdomains in wildcard resource?

[nozamdavid]

I'm migrating from Cloudflare Tunnels, where I basically have a wildcard subdomain pointed to my homeserver with auth enabled, and then I add some subdomains to a bypass policy to allow public access.
Is this not possible in Pangolin? When I try to add a wildcard resource with auth policy + a subdomain resource with bypass policy, it evidently says there's a conflict. Any way to achieve the same?

[jmrplens]

Not possible today, and the conflict you hit is a deliberate refusal rather than a validation quirk, so it is worth knowing exactly what it blocks before you design around it.

The check is checkWildcardDomainConflict, and it runs on both create and update. It refuses in both directions at the immediate parent level: creating *.example.com when any specific foo.example.com resource exists, and creating public.example.com when *.example.com exists. For the specific-domain case it builds the parent pattern from the first label and looks for an exact match:

const suffix = fullDomain.slice(dotIndex);              // ".example.com"
const wildcardPattern = `*.${fullDomain.slice(dotIndex + 1)}`;  // "*.example.com"

So there is no "more specific resource wins" precedence to reach for. The two resources cannot coexist at all, which is why the wildcard plus exception layout you had in Cloudflare has no direct translation.

The bypass mechanism exists, but not keyed on the hostname

Pangolin does have the equivalent of a bypass policy. Resource rules are evaluated before authentication, and an ACCEPT rule short-circuits straight to allowed:

if (action == "ACCEPT") {
    logger.debug("Resource allowed by rule");
    ...
    return allowed(res, undefined, dontStripSession);
}

The problem is what a rule can match on. The full set is CIDR, IP, PATH, COUNTRY, COUNTRY_IS_NOT, ASN and REGION (validators.ts). There is no hostname or subdomain match, so on a wildcard resource there is no way to say "except for public.example.com".

One trap worth naming, because it looks like a workaround and is not: PATH matches the URL path only, through isPathAllowed(rule.value, path). A PATH + ACCEPT rule on a wildcard resource therefore opens that path on every host the wildcard covers, not on the one you meant. If the public subdomains happen to share a path prefix with the private ones, that quietly makes the private ones public too.

What to do instead

Enumerate. Create a resource per subdomain that needs its own auth treatment, with authentication off on the public ones, and use the wildcard only for a set where a single auth policy is correct for everything under it. It is more objects to manage than the Cloudflare setup, but it is the only layout the model expresses, and the conflict check means you cannot half-do it.

I could not find an open issue tracking wildcard exceptions or a hostname rule match, so if you want this it is probably worth filing: the two pieces already exist separately, and what is missing is a rule match type keyed on the request host, which would let a single wildcard resource carry per-subdomain exceptions without touching the conflict rule at all.