Pangolin forwarding to reverse proxy on different domain

[kapuett]

Hi, I am struggling with this problem:

• server1 is hosting different services, including Authentik (2025.10.3). All those services are reachable local only via TLS served by traefik with a wildcard domain cert *.example.com.
• vps is publicly available in a different location and running Pangolin to access server1 through newt. Pangolin is configured to serve domain pangolin.gw.example.com and has a wildcard cert for *.gw.example.com.
• Pangolin has a public resource authentik with URL https://authentik.gw.example.com. Target is the newt site with https://authentik.example.com on port 443. Setting Host and SNI Headers in Pangolin

makes the authentik dashboard reachable, but with message:

The request failed and the interceptors did not return an alternative response

Browser devtools network tab reveals what seems to me like a wrong redirect:

I would expect authentik.gw.example.com also for the /api requests instead of authentik.example.com. I have the same issue with nextcloud, login page appears but then requests get forwarded to nextcloud.example.com instead of staying on nextcloud.gw.example.com.

Did I forget to configure something? I thought it was a good idea to not use the same wildcard cert and a different subdomain for clear separation of access via pangolin and local. Am I mistaken?

[partytimeexcellent]

Did you ever sort this out? I’m facing a similar issue and looking for some clues about what’s not working. Thanks

https://github.com/orgs/fosrl/discussions/2408

[kapuett]

No, I didn't. I opted to remove the subdomain, sacrificing that clear separation.