Permission denied error #1084

New Issue

MrUnknownDE · 2026-04-05T18:15:10+02:00

MrUnknownDE commented

2026-04-05 18:15:10 +02:00

Originally created by @theAlevan on 8/11/2025

A while back I made an issue, that I forgot about and was automatically closed. Still, the problem still persists.

I tried recreating my pangolin deployment from scratch. I made a new VM on my VPS, and deployed Pangolin using the minimal Pangolin config I found in the documentation.

I created my admin user, organisation, site (local site), and made the traefik dashboard as my first resource. And I still get this error, accesing the resource with the "Owner" account:

Debug Logs:

2025-08-11T17:21:37.629Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://traefik.example.com/","scheme":"","host":"traefik.example.com","path":"/","method":"GET","tls":true,"requestIp":"xxx.xxx.xxx.xxx:50098","headers":{"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7","Accept-Encoding":"gzip, deflate, br, zstd","Accept-Language":"en-US,en;q=0.9","Dnt":"1","Priority":"u=0, i","Sec-Ch-Ua":""Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"","Sec-Ch-Ua-Mobile":"?0","Sec-Ch-Ua-Platform":""Linux"","Sec-Fetch-Dest":"document","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"same-site","Sec-Fetch-User":"?1","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","X-Forwarded-Host":"traefik.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"53e1368fb1ea","X-Real-Ip":"xxx.xxx.xxx.xxx"}}
2025-08-11T17:21:37.630Z [debug]: Request IP: {"requestIp":"xxx.xxx.xxx.xxx:50098"}
2025-08-11T17:21:37.630Z [debug]: Client IP: {"clientIp":"xxx.xxx.xxx.xxx"}
2025-08-11T17:21:37.634Z [debug]: No more auth to check, resource not allowed
2025-08-11T17:21:37.634Z [info]: Resource access not allowed. Resource ID: 1. IP: xxx.xxx.xxx.xxx.
2025-08-11T17:21:37.634Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.example.com/auth/resource/1?redirect=https%3A%2F%2Ftraefik.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200}

Every part of the Pangolin stack is on the latest released version.
As even the database was recreated, is there an error in my config? I tried both with postgres and with sqlite databases.
The strange thing is, that Pangolin v1.5.1 With Gerbil 1.0.0 works like a charm.
If it matters, my VPS is hosted on Oracle Cloud.

This is my pangolin config file:

app:
  dashboard_url: https://pangolin.example.com
  log_level: debug
  save_logs: false
  log_failed_attempts: true

domains:
  domain1:
    base_domain: "pangolin.example.com"
    cert_resolver: "letsencrypt"

server:
  secret: "secret"

gerbil:
  base_endpoint: "pangolin.example.com"

flags:
  require_email_verification: false
  disable_signup_without_invite: true
  disable_user_create_org: true

postgres:
  connection_string:
    postgresql://pangolin:secret@pangolin-postgres:5432/pangolin

My Traefik static config:

accessLog:
  filePath: /etc/traefik/logs/access.log
  format: json
  fields:
    defaultMode: keep
    headers:
      defaultMode: keep
api:
    dashboard: true
    insecure: true
certificatesResolvers:
    letsencrypt:
        acme:
            caServer: https://acme-v02.api.letsencrypt.org/directory
            dnsChallenge:
                delayBeforeCheck: 10
                provider: cloudflare
            email: mail@example.com
            storage: /letsencrypt/acme.json
entryPoints:
    web:
        address: :80
        http:
            redirections:
                entryPoint:
                    permanent: true
                    scheme: https
                    to: websecure
    websecure:
        address: :443
        http:
            tls:
                certResolver: letsencrypt
        transport:
            respondingTimeouts:
                readTimeout: 30m
    tcp-853:
        address: ":853/tcp"
ping: {}
experimental:
    fastProxy: true
    plugins:
        badger:
            moduleName: github.com/fosrl/badger
            version: v1.2.0
global:
    checkNewVersion: false
    sendAnonymousUsage: true
log:
    format: common
    level: info
providers:
    file:
        directory: /etc/traefik/
        watch: true
    http:
        endpoint: http://pangolin:3001/api/v1/traefik-config
        pollInterval: 5s
    providersThrottleDuration: 2
serversTransport:
    insecureSkipVerify: true

And my Traefik Dynamic config:

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https

  routers:
    main-app-router-redirect:
      rule: "Host(`pangolin.example.com`)" 
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https
    next-router:
      rule: "Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`)" 
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    api-router:
      rule: "Host(`pangolin.example.com`) && PathPrefix(`/api/v1`)" 
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
    ws-router:
      rule: "Host(`pangolin.example.com`)" # REPLACE THIS WITH YOUR DOMAIN
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002" # Next.js server
    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000" # API/WebSocket server

*Originally created by @theAlevan on 8/11/2025* A while back I made an [issue](https://github.com/fosrl/pangolin/issues/1003), that I forgot about and was automatically closed. Still, the problem still persists. I tried recreating my pangolin deployment from scratch. I made a new VM on my VPS, and deployed Pangolin using the minimal Pangolin config I found in the [documentation](https://docs.digpangolin.com/self-host/advanced/config-file). I created my admin user, organisation, site (local site), and made the traefik dashboard as my first resource. And I still get this error, accesing the resource with the "Owner" account: <img width="646" height="351" alt="Image" src="https://github.com/user-attachments/assets/7e5634b2-0cac-41eb-a269-0eea762f938d" /> Debug Logs: > 2025-08-11T17:21:37.629Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://traefik.example.com/","scheme":"","host":"traefik.example.com","path":"/","method":"GET","tls":true,"requestIp":"xxx.xxx.xxx.xxx:50098","headers":{"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","Accept-Encoding":"gzip, deflate, br, zstd","Accept-Language":"en-US,en;q=0.9","Dnt":"1","Priority":"u=0, i","Sec-Ch-Ua":"\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"Google Chrome\";v=\"138\"","Sec-Ch-Ua-Mobile":"?0","Sec-Ch-Ua-Platform":"\"Linux\"","Sec-Fetch-Dest":"document","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"same-site","Sec-Fetch-User":"?1","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36","X-Forwarded-Host":"traefik.example.com","X-Forwarded-Port":"443","X-Forwarded-Proto":"https","X-Forwarded-Server":"53e1368fb1ea","X-Real-Ip":"xxx.xxx.xxx.xxx"}} > 2025-08-11T17:21:37.630Z [debug]: Request IP: {"requestIp":"xxx.xxx.xxx.xxx:50098"} > 2025-08-11T17:21:37.630Z [debug]: Client IP: {"clientIp":"xxx.xxx.xxx.xxx"} > 2025-08-11T17:21:37.634Z [debug]: No more auth to check, resource not allowed > 2025-08-11T17:21:37.634Z [info]: Resource access not allowed. Resource ID: 1. IP: xxx.xxx.xxx.xxx. > 2025-08-11T17:21:37.634Z [debug]: {"data":{"valid":false,"redirectUrl":"https://pangolin.example.com/auth/resource/1?redirect=https%3A%2F%2Ftraefik.example.com%2F"},"success":true,"error":false,"message":"Access denied","status":200} Every part of the Pangolin stack is on the latest released version. As even the database was recreated, is there an error in my config? I tried both with postgres and with sqlite databases. The strange thing is, that Pangolin v1.5.1 With Gerbil 1.0.0 works like a charm. If it matters, my VPS is hosted on Oracle Cloud. This is my pangolin config file: ``` app: dashboard_url: https://pangolin.example.com log_level: debug save_logs: false log_failed_attempts: true domains: domain1: base_domain: "pangolin.example.com" cert_resolver: "letsencrypt" server: secret: "secret" gerbil: base_endpoint: "pangolin.example.com" flags: require_email_verification: false disable_signup_without_invite: true disable_user_create_org: true postgres: connection_string: postgresql://pangolin:secret@pangolin-postgres:5432/pangolin ``` My Traefik static config: ``` accessLog: filePath: /etc/traefik/logs/access.log format: json fields: defaultMode: keep headers: defaultMode: keep api: dashboard: true insecure: true certificatesResolvers: letsencrypt: acme: caServer: https://acme-v02.api.letsencrypt.org/directory dnsChallenge: delayBeforeCheck: 10 provider: cloudflare email: mail@example.com storage: /letsencrypt/acme.json entryPoints: web: address: :80 http: redirections: entryPoint: permanent: true scheme: https to: websecure websecure: address: :443 http: tls: certResolver: letsencrypt transport: respondingTimeouts: readTimeout: 30m tcp-853: address: ":853/tcp" ping: {} experimental: fastProxy: true plugins: badger: moduleName: github.com/fosrl/badger version: v1.2.0 global: checkNewVersion: false sendAnonymousUsage: true log: format: common level: info providers: file: directory: /etc/traefik/ watch: true http: endpoint: http://pangolin:3001/api/v1/traefik-config pollInterval: 5s providersThrottleDuration: 2 serversTransport: insecureSkipVerify: true ``` And my Traefik Dynamic config: ``` http: middlewares: redirect-to-https: redirectScheme: scheme: https routers: main-app-router-redirect: rule: "Host(`pangolin.example.com`)" service: next-service entryPoints: - web middlewares: - redirect-to-https next-router: rule: "Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`)" service: next-service entryPoints: - websecure tls: certResolver: letsencrypt domains: - main: "example.com" sans: - "*.example.com" api-router: rule: "Host(`pangolin.example.com`) && PathPrefix(`/api/v1`)" service: api-service entryPoints: - websecure tls: certResolver: letsencrypt ws-router: rule: "Host(`pangolin.example.com`)" # REPLACE THIS WITH YOUR DOMAIN service: api-service entryPoints: - websecure tls: certResolver: letsencrypt services: next-service: loadBalancer: servers: - url: "http://pangolin:3002" # Next.js server api-service: loadBalancer: servers: - url: "http://pangolin:3000" # API/WebSocket server ```

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1084