Wildcard also routes pangolin...

[tonycsoka]

Here's the setup.

2 DNS entries example.com and *.example.com

These both point to the pangolin vps.

Pangolin is set up with the domain pangolin.example.com

On pangolin I set up a wildcard resource *.example.com to route to a Nginx rp, however, pangolin.example.com is also being routed there causing all sorts of fun. Been through the docs on wildcard setup, but struggling to figure out how to get this working.

Any pointers?

example.com used in place of real domain here.

[Vyerni]

You've already got a proxy with Traefik in Pangolin?

Maybe create a dedicated resource for pangolin.example.com to point to itself? And leave the wildcard for catching everything else?

[jmrplens]

Your wildcard resource wins over the dashboard because Pangolin gives it an explicit priority and the dashboard routers have none.

What Pangolin generates for a wildcard resource is a regex router: buildHostRule in server/lib/traefik/rule.ts turns *.example.com into HostRegexp(`^[^.]+\.example\.com$`), and computeRoutePriority in the same file returns 100 for a target with no path and no explicit priority. Your dashboard is served by the routers in the installed config/traefik/dynamic_config.yml (main-app-router-redirect, next-router, api-router, plus ws-router on installer-generated configs), and none of them sets priority. In Traefik a router without an explicit priority gets one equal to the length of its rule, and Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`) is 54 characters for a domain that length. 100 beats 54, so every request for the dashboard host goes to the wildcard.

I reproduced it with Traefik v3.6 and two whoami backends:

dashboard router	wildcard router	pangolin.example.com	app.example.com
no priority	priority 100	wildcard	wildcard
priority 101	priority 100	dashboard	wildcard
priority 200	priority 100	dashboard	wildcard

Sweeping the wildcard priority against the dashboard router with no priority puts the crossover where the rule length says: at 53 the dashboard wins, at 55 the wildcard does.

So the fix is an explicit priority on the dashboard routers. In config/traefik/dynamic_config.yml, add priority: 500 to next-router, api-router and ws-router if you have it (and to main-app-router-redirect if you serve the dashboard over plain HTTP too), then restart Traefik. Pick a number that is strictly higher than anything you have set yourself and that does not collide with the priorities Pangolin already emits for its own routers (200 to 203 and 2000 to 2001); do not set it equal to the wildcard's, because Traefik only sorts by priority and the tie is not resolved by anything you can count on.

That last point is also why adding a dedicated resource for pangolin.example.com does not fix it by itself: a target with no path lands on the same 100 as the wildcard. If you go that route, raise the Priority column of that target (it is in the targets table, in Advanced mode) above the wildcard's.

[tonycsoka]

Fantastic, will give it a go a little later, and it makes total sense. Much obliged @jmrplens.