Blueprint apply: UNIQUE constraint failed: certificates.domain

[xMikux]

Describe the Bug

Applying a blueprint via Newt fails when the new resource falls under an existing wildcard certificate.

blueprint yaml

public-resources:
  resource-nice-id-uno:
    name: this is my resource
    protocol: http
    full-domain: never-gonna-give-you-up.web.domain.com
    targets:
      - site: lively-yosemite-toad
        hostname: localhost
        method: http
        port: 8000

and pop out error:

Blueprint applied with errors: SqliteError: UNIQUE constraint failed: certificates.domain

Environment

• OS Type & Version: Ubuntu 24.04
• Pangolin Version: v1.18.1
• Gerbil Version: 1.3.1
• Traefik Version: v3.6
• Newt Version: v1.12.3

To Reproduce

1. Set up a wildcard domain (e.g. *.web.domain.com) — not using Traefik auto-generated per-domain cert.
2. In the dashboard, open Blueprints and add a blueprint with a resource whose full-domain falls under that wildcard, e.g.:

   public-resources:
     resource-nice-id-uno:
       name: this is my resource
       protocol: http
       full-domain: never-gonna-give-you-up.web.domain.com
       targets:
         - site: lively-yosemite-toad
           hostname: localhost
           method: http
           port: 8000

3. Apply -> fails with SqliteError: UNIQUE constraint failed: certificates.domain.

Expected Behavior

Should be applied normally.

[AstralDestiny]

sqlite3 config/db/db.sqlite

delete from certificates;

Fixes some 1.18 stuff, Try again afterwards.

[xMikux]

After deleting, the issue still persists.

[xMikux]

[oschwartz10612]

@xMikux would you be able to do the following? It will help me figure out what is up here.

$ sqlite3 config/db/db.sqlite "select domain,domainId,wildcard,status from certificates;"

[xMikux]

/app # sqlite3 config/db/db.sqlite "select domain,domainId,wildcard,status from certificates;"
*.domain.com|domain1|1|valid
*.web.domain.com|ov1e75i14fwsq5y|1|valid

[xMikux]

I also do some test, apply succeeds for resources under *.domain.com, but fails for resources under *.web.domain.com.