Inconsistent Subdomain Validation: Some Domains Accept Hyphens, Others Reject Them #1005

New Issue

MrUnknownDE · 2026-04-05T18:07:19+02:00

MrUnknownDE commented

2026-04-05 18:07:19 +02:00

Originally created by @diazhernawan on 8/27/2025

I run into some inconsistent Subdomain Validation: Some Domains Accept Hyphens, Others Reject Them

Pangolin Version: 1.9.0
Gerbil Version: 1.2.0
Traefik Version: 3.5
Deployment: Self-hosted with Docker Compose

Problem Description

Pangolin's subdomain validation behaves inconsistently across different configured domains. Some domains accept hyphenated subdomains while others reject them, despite identical configuration.

Expected Behavior

All domains configured with identical settings should have consistent subdomain validation rules.

Actual Behavior

Domains that accept hyphens: katawarna.org, daging.co.id
Domains that reject hyphens: arkterra.id, bbfmeatshop.co.id, politekniktempo.com

Steps to Reproduce

Configure multiple domains in Pangolin config with identical settings
Attempt to create hyphenated subdomains (e.g., test-new-hyphen) for each domain
Observe inconsistent validation behavior

Test Results

Working Examples (Accepted)

nextcloud.katawarna.org ✓
onlyoffice.katawarna.org ✓
test-new-tes-ts-test-tes-test.katawarna.org ✓
test-new-tes-ts-test-tes-test.daging.co.id ✓

Failing Examples (Rejected)

dev01-web-bbf.arkterra.id ✗ (reverts to base domain)
dev02-web.arkterra.id ✗ (reverts to base domain)
test-hyphen.bbfmeatshop.co.id ✗ (reverts to base domain)

Validation Inconsistency

Previously working subdomain dev01-web-bbf.arkterra.id was accepted, then later rejected when attempting to recreate it, suggesting validation rules changed during runtime.

Configuration

domains:
    domain1:
        base_domain: "katawarna.org"
        cert_resolver: "letsencrypt"
        prefer_wildcard_cert: true
    domain2:
        base_domain: "arkterra.id"  
        cert_resolver: "letsencrypt"
        prefer_wildcard_cert: true
    domain3:
        base_domain: "bbfmeatshop.co.id"
        cert_resolver: "letsencrypt"
    domain4:
        base_domain: "politekniktempo.com"
        cert_resolver: "letsencrypt"
    domain5:
        base_domain: "daging.co.id"
        cert_resolver: "letsencrypt"

All domains use identical DNS configuration (Cloudflare DNS-only mode, wildcard A records) and identical SSL settings.

Impact

Inconsistent user experience across domains
Some domains unusable for complex subdomain naming schemes
No clear documentation explaining different validation rules per domain

Additional Notes

Non-hyphenated subdomains work consistently across all domains
The validation appears domain-specific rather than organization-specific
No error messages or logs indicate why certain domain/subdomain combinations are rejected

*Originally created by @diazhernawan on 8/27/2025* I run into some inconsistent Subdomain Validation: Some Domains Accept Hyphens, Others Reject Them - **Pangolin Version**: 1.9.0 - **Gerbil Version**: 1.2.0 - **Traefik Version**: 3.5 - **Deployment**: Self-hosted with Docker Compose ## Problem Description Pangolin's subdomain validation behaves inconsistently across different configured domains. Some domains accept hyphenated subdomains while others reject them, despite identical configuration. ## Expected Behavior All domains configured with identical settings should have consistent subdomain validation rules. ## Actual Behavior - **Domains that accept hyphens**: `katawarna.org`, `daging.co.id` - **Domains that reject hyphens**: `arkterra.id`, `bbfmeatshop.co.id`, `politekniktempo.com` ## Steps to Reproduce 1. Configure multiple domains in Pangolin config with identical settings 2. Attempt to create hyphenated subdomains (e.g., `test-new-hyphen`) for each domain 3. Observe inconsistent validation behavior ## Test Results ### Working Examples (Accepted) - `nextcloud.katawarna.org` ✓ - `onlyoffice.katawarna.org` ✓ - `test-new-tes-ts-test-tes-test.katawarna.org` ✓ - `test-new-tes-ts-test-tes-test.daging.co.id` ✓ ### Failing Examples (Rejected) - `dev01-web-bbf.arkterra.id` ✗ (reverts to base domain) - `dev02-web.arkterra.id` ✗ (reverts to base domain) - `test-hyphen.bbfmeatshop.co.id` ✗ (reverts to base domain) ### Validation Inconsistency Previously working subdomain `dev01-web-bbf.arkterra.id` was accepted, then later rejected when attempting to recreate it, suggesting validation rules changed during runtime. ## Configuration ```yaml domains: domain1: base_domain: "katawarna.org" cert_resolver: "letsencrypt" prefer_wildcard_cert: true domain2: base_domain: "arkterra.id" cert_resolver: "letsencrypt" prefer_wildcard_cert: true domain3: base_domain: "bbfmeatshop.co.id" cert_resolver: "letsencrypt" domain4: base_domain: "politekniktempo.com" cert_resolver: "letsencrypt" domain5: base_domain: "daging.co.id" cert_resolver: "letsencrypt" ``` All domains use identical DNS configuration (Cloudflare DNS-only mode, wildcard A records) and identical SSL settings. ## Impact - Inconsistent user experience across domains - Some domains unusable for complex subdomain naming schemes - No clear documentation explaining different validation rules per domain ## Additional Notes - Non-hyphenated subdomains work consistently across all domains - The validation appears domain-specific rather than organization-specific - No error messages or logs indicate why certain domain/subdomain combinations are rejected

MrUnknownDE closed this issue

2026-04-05 18:07:19 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 18:07:23 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1005