[BUG] 502 error on apps on local/same host #1044

New Issue

MrUnknownDE · 2026-04-05T18:09:05+02:00

MrUnknownDE commented

2026-04-05 18:09:05 +02:00

Originally created by @dev-Blaze on 8/21/2025

It seems like any apps/services hosted on the same host as pangolin reverse proxy (Racknerd VPS) have trouble authenticating via OIDC (pocket-id) which the auth provider is also behind Pangolin and also on the same host.

whats weird is that services on a remote/newt site work fine, authentication works no issues. only issues with services that are local.

Services not using pocket-id for auth (login form/basic auth) work fine as well.

NOTE: i am not using pocket-id for pangolin authentication itself, this is auth for the separate applications with oidc functionality. pangolin is strictly just the reverse proxy in this scenario.

all services are docker containers, and I have also verified that the individual containers can ping the pangolin container, they are all on the same docker network.

pangolin version 1.8.0
gerbil 1.1.0
traefik 3.5.0

Example - outline app using pocketid for oidc auth.

Logs from Pocket ID:

time=2025-08-11T06:42:16.974-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:16.972Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorization-required request.query="" request.params=map[] request.route=/api/oidc/authorization-required request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=82 response.time=2025-08-11T13:42:16.973Z response.latency=1.239892ms response.status=200 response.length=31
time=2025-08-11T06:42:17.057-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:17.050Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorize request.query="" request.params=map[] request.route=/api/oidc/authorize request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=196 response.time=2025-08-11T13:42:17.057Z response.latency=6.66303ms response.status=200 response.length=148
time=2025-08-11T06:42:48.174-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:48.172Z request.method=GET request.host=auth.redacted request.path=/api/application-configuration/logo request.query="" request.params=map[] request.route=/api/application-configuration/logo request.ip=redacted request.referer=https://dashboard.redacted/ request.length=0 response.time=2025-08-11T13:42:48.174Z response.latency=1.188735ms response.status=200 response.length=32800

Log from Outline Application:

ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) 
ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16)

Any help would be appreciated. Thanks

*Originally created by @dev-Blaze on 8/21/2025* It seems like any apps/services hosted on the same host as pangolin reverse proxy (Racknerd VPS) have trouble authenticating via OIDC (pocket-id) which the auth provider is also behind Pangolin and also on the same host. whats weird is that services on a remote/newt site work fine, authentication works no issues. only issues with services that are local. Services not using pocket-id for auth (login form/basic auth) work fine as well. NOTE: i am not using pocket-id for pangolin authentication itself, this is auth for the separate applications with oidc functionality. pangolin is strictly just the reverse proxy in this scenario. all services are docker containers, and I have also verified that the individual containers can ping the pangolin container, they are all on the same docker network. pangolin version 1.8.0 gerbil 1.1.0 traefik 3.5.0 Example - outline app using pocketid for oidc auth. Logs from Pocket ID: ``` time=2025-08-11T06:42:16.974-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:16.972Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorization-required request.query="" request.params=map[] request.route=/api/oidc/authorization-required request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=82 response.time=2025-08-11T13:42:16.973Z response.latency=1.239892ms response.status=200 response.length=31 time=2025-08-11T06:42:17.057-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:17.050Z request.method=POST request.host=auth.redacted request.path=/api/oidc/authorize request.query="" request.params=map[] request.route=/api/oidc/authorize request.ip=redacted request.referer="https://auth.redacted/authorize?response_type=code&redirect_uri=https%3A%2F%2Foutline.redacted%2Fauth%2Foidc.callback&scope=openid%20profile%20email&state=cdebef095165601c&client_id=4215a259-0dfc-48a0-a17b-600c1acb6fcb" request.length=196 response.time=2025-08-11T13:42:17.057Z response.latency=6.66303ms response.status=200 response.length=148 time=2025-08-11T06:42:48.174-07:00 level=INFO msg="Incoming request" app=pocket-id version=1.7.0 request.time=2025-08-11T13:42:48.172Z request.method=GET request.host=auth.redacted request.path=/api/application-configuration/logo request.query="" request.params=map[] request.route=/api/application-configuration/logo request.ip=redacted request.referer=https://dashboard.redacted/ request.length=0 response.time=2025-08-11T13:42:48.174Z response.latency=1.188735ms response.status=200 response.length=32800 ``` Log from Outline Application: ``` ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443 at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) ERR Error during authentication | error=connect ETIMEDOUT 000.000.000.000:443 stack=Error: connect ETIMEDOUT 000.000.000.000:443 at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) ``` Any help would be appreciated. Thanks

MrUnknownDE closed this issue

2026-04-05 18:09:05 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 18:09:09 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1044