feat(healthcheck): add SNI support for target healthchecks #565

New Issue

MrUnknownDE · 2026-04-05T17:20:43+02:00

MrUnknownDE commented

2026-04-05 17:20:43 +02:00

Originally created by @water-sucks on 12/4/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

While an SNI proxy already exists for configured targets themselves, this is not the case for sending periodic requests to targets' healthcheck endpoints.

This PR adds a field to the target healthcheck settings to specify an explicit SNI header for target healthcheck requests.

Merging this PR requires https://github.com/fosrl/newt/pull/185 to be merged alongside it; as such, I'm not sure how the process goes for coordinating new behavior between Pangolin and Newt, but I believe that older versions of Newt would simply not support this field and silently ignore it since it won't get parsed out of the JSON response.

How to test?

Fill in the SNI field for a given target healthcheck and make sure that the downstream provider receives/proxies the client hello correctly as specified by the configured target healthcheck settings.

*Originally created by @water-sucks on 12/4/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description While an SNI proxy already exists for configured targets themselves, this is not the case for sending periodic requests to targets' healthcheck endpoints. This PR adds a field to the target healthcheck settings to specify an explicit SNI header for target healthcheck requests. <img width="642" height="870" alt="Screenshot 2025-12-03 at 23 27 49" src="https://github.com/user-attachments/assets/258777c9-3769-47c8-bb16-12a15482c13f" /> Merging this PR requires https://github.com/fosrl/newt/pull/185 to be merged alongside it; as such, I'm not sure how the process goes for coordinating new behavior between Pangolin and Newt, but I believe that older versions of Newt would simply not support this field and silently ignore it since it won't get parsed out of the JSON response. ## How to test? Fill in the SNI field for a given target healthcheck and make sure that the downstream provider receives/proxies the client hello correctly as specified by the configured target healthcheck settings.

MrUnknownDE closed this issue

2026-04-05 17:20:43 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#565