# Router priority flaps non-deterministically for hosts with multiple Targets/paths (map iteration in findMatchingRouter) (middleware-manager #113)

**URL:** <https://forum.hhf.technology/t/router-priority-flaps-non-deterministically-for-hosts-with-multiple-targets-paths-map-iteration-in-findmatchingrouter-middleware-manager-113/4537>\
**Category:** Middleware Manager\
**Tags:** issue\
**Created:** [August 3, 2026, 1:20am UTC](https://forum.hhf.technology/t/router-priority-flaps-non-deterministically-for-hosts-with-multiple-targets-paths-map-iteration-in-findmatchingrouter-middleware-manager-113/4537 "2026-08-03T01:20:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://forum.hhf.technology/user_avatar/forum.hhf.technology/system/32/16_2.png) [@system](https://forum.hhf.technology/u/system)\
**Post date:** [August 3, 2026, 1:20am UTC](https://forum.hhf.technology/t/router-priority-flaps-non-deterministically-for-hosts-with-multiple-targets-paths-map-iteration-in-findmatchingrouter-middleware-manager-113/4537/1 "2026-08-03T01:20:16Z")

</div>

> 🐙 **GitHub issue [middleware-manager #113](https://github.com/hhftechnology/middleware-manager/issues/113)**, opened by **`strausmann`** on GitHub

## Summary

When a Pangolin resource uses multi-target path-based routing (one host, multiple Targets each with a different `PathPrefix`, producing multiple Traefik routers that all share the same `Host(...)` in their rule), `middleware-manager`’s `/api/v1/traefik-config` endpoint returns a **different `priority` value for the same router on different requests** , even though the upstream Pangolin config is byte-identical between requests. This happens roughly once per 5-second cache cycle (matching `ConfigProxy`’s `cacheDuration`).

Because Traefik polls this endpoint continuously and rebuilds its router table on any content change, this causes:

1. Constant, unnecessary router-table rebuilds (content changes every ~5s even when nothing changed upstream).
2. A real routing bug: when the catch-all router’s priority is corrupted to match the more specific router’s priority, a **priority tie** between the two routers is possible, and Traefik’s tie-break can transiently route requests meant for the specific path to the catch-all router instead.

## Root cause (source-verified against `main` @ `7eb1378d826ca203502332c61d14879bb1436f14` / `v4.5.0`)

`services/config_proxy.go`, function `findMatchingRouter` (~line 989):

```go
func (cp *ConfigProxy) findMatchingRouter(routers map[string]interface{}, host string) (string, map[string]interface{}) {
    ...
    for routerName, routerConfig := range routers { // unordered Go map iteration
        ...
        if len(hostMatches) > 1 && …

---
💬 Discuss it here. Status, fixes and code review stay on [GitHub](https://github.com/hhftechnology/middleware-manager/issues/113).
<!-- hhf-forum-sync -->
```

---

<div class="post-metadata">

**Author:** ![system](https://forum.hhf.technology/user_avatar/forum.hhf.technology/system/32/16_2.png) [@system](https://forum.hhf.technology/u/system)\
**Post date:** [August 3, 2026, 8:20am UTC](https://forum.hhf.technology/t/router-priority-flaps-non-deterministically-for-hosts-with-multiple-targets-paths-map-iteration-in-findmatchingrouter-middleware-manager-113/4537/2 "2026-08-03T08:20:55Z")

</div>

**`strausmann`** [commented on GitHub](https://github.com/hhftechnology/middleware-manager/issues/113#issuecomment-5163973381):

> Hi @​hhftechnology — I’ve opened #114 with a fix for this.
> 
> Short version: `findMatchingRouter` matched routers on `Host(...)` only while iterating an unordered Go map, so for a host served by more than one non-redirect router (Pangolin’s multi-target path routing — one resource, several Targets sharing a `Host()` but differing `PathPrefix()`), the `RouterPriority` override could land on the wrong sibling router on any of the 5s config refreshes. That corrupted the sibling’s priority and created a priority tie → sporadic misrouting on shared hosts.
> 
> The PR sorts the matches deterministically and, when a host is genuinely ambiguous (multiple non-redirect routers), reports no match so the override is skipped rather than applied to a guessed router — leaving Pangolin’s own priorities untouched, which is strictly safer.
> 
> It’s validated live against a production Pangolin deployment (17 hosts with multiple Targets: 16 flapping 10–42 priority changes over 6 min → **0** with the fix; 101 single-target hosts unchanged), unit-tested (TDD, red→green), and both automated reviews (Copilot + CodeRabbit) came back clean.
> 
> Whenever you get a moment to take a look, that’d be much appreciated — happy to adjust anything. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://forum.hhf.technology/user_avatar/forum.hhf.technology/system/32/16_2.png) [@system](https://forum.hhf.technology/u/system)\
**Post date:** [August 13, 2026, 3:32am UTC](https://forum.hhf.technology/t/router-priority-flaps-non-deterministically-for-hosts-with-multiple-targets-paths-map-iteration-in-findmatchingrouter-middleware-manager-113/4537/3 "2026-08-13T03:32:42Z")

</div>

**`kylepyke`** [commented on GitHub](https://github.com/hhftechnology/middleware-manager/issues/113#issuecomment-5275620090):

> Hey @​hhftechnology, will this request be merged?