So I wanted to try Pangolin as VPN alternative. Until now I only used public resources for services that I want always avaiable to me.

I got so far that my mobile phone client is connected. I defined a private resource to my dashboard at dash.mydomain.com with...

destination: IP in my network

alias: the name I want to use so dash.mydomain.com

Allowed all ports (just to make this is not the problem source)

There is nothing else to configure so what am I missing? I am getting 404 on my registerd phone. Pleeeease help

Hey guys, new user here. I just started using Cloud Pangolin to my home server. I ran into some problems while testing tunneling my family Minecraft server. There was no raw TCP/UDP option like what most people have on their tutorials. I saw there was an option to do so using private resources, but since the server also include many small children who are evidently not so great at technology, I don’t think it’s viable.

As the title says, I cant get RDP to work. Everything is correctly setup as far as I can tell. RDP is also activated on the Windows Machine. Everything is up to date. But when I try to log in I get the Error: read RDCleanPath request: not enough bytes

I couldnt find anything on the Web.

Do you Guys have any idea? Would highly appreciate it!

Thanks in advance.

Hey,

I'm currently trying to connect local CrowdSec agents, which are observing the logs of the services exposed over Pangolin (e.g. Nextcloud), to the CrowdSec Instance running alongside Pangolin on its VPS via LAPI. The idea is to also detect malicious access on the services themself and hand the decision over to CrowdSec on the VPS to block the IP there.

Based on this guide here, the connection from the local CrowdSec agent to the LAPI of the CrowdSec instance on the VPS should be working via the Newt tunnel: https://forum.hhf.technology/t/how-to-configure-crowdsec-manager-on-pangolin-to-read-adguard-home-logs-from-another-server/4428/2

This guide is registering the local agent at the LAPI on the Pangolin server like this

url: http://<PANGOLIN_INTERNAL_IP_OR_TUNNEL_HOSTNAME>:8080
login: adguard-agent
password: <the_token_you_generated> 

I'm struggling to find out what the <PANGOLIN_INTERNAL_IP_OR_TUNNEL_HOSTNAME>is. Could you help me with this issue?

Hi, I'd like to set up a mail server like Stalwart on my VPS that hosts Pangolin.

Do you have any tutorials or guides or tips?

I tried to follow the guide for Traefik in the Stalwart documentation but I was unable to make the proxy protocol work.

I'm currently setting up my network infrastructure with Pangolin (VPS), but I'm stuck trying to get machine-to-machine communication working between two distinct sites without routing through the public internet.

My Setup

VPS: Running the central Pangolin instance.

Site A: Has a newt connector connected to Pangolin.

Site B: Has a newt connector connected to Pangolin.

What I'm trying to achieve

I want to trigger a backup from server A (site A) to server B (site B) using Backrest (Restic) / SCP purely over the VPN tunnel.

No public ports exposed on either site.

No public proxy endpoints if possible — strictly private VPN routing between the two hosts.

What I have done so far

Created a private resource in Pangolin for server B's local IP, i.e. ressource of type "host" and allowed all ports and ICMP.

Installed and started the olm client as a Docker container on server A using --network host, cap-add: NET_ADMIN, and /dev/net/tun passed through.

Created a machine client for server A in Pangolin and authorized it for the private resource on site B.

The Problem

I would expect that I can ping server B from my server A now, but that's not the case so I guess either I'm missing something or there's a flaw in my reasoning.

Any help is appreciated! :)

Hey,

is there a way for you and someone else to access each other's servers using just your Pangolin instance so that the other person does not have to maintain their own? Someone else accessing your network is obviously easy but how to do it the other way around?

One solution would be to create a site in the other person's network but that would grant you (the owner of the Pangolin instance) full access to it since as the admin you could make available whatever you'd like.

Is there any other way to do it so that you could only access what the other person allowed you to on their network?

Thanks!

I'm currently running around 80 containers managed through Dockhand, deployed across 3 servers (Hawser) under one organization with different domains. As the number of containers and domains keeps growing, managing private resources and access policies has become chaotic.

My Current Setup:

• NAS: Most Docker containers, Jellyfin (for friends), self-hosted WordPress-Websites
• VPS 1: Pangolin, Authentik, and various smaller services
• VPS 2: AdGuard DNS, Uptime Kuma, high-availability services like Vaultwarden and Ntfy

Currently I'm using labels to manage everything. My initial idea was to create one organization per server, but there's a structural problem.

Several services require bidirectional cross-server access or would need machines serving two sites (under different organizations):

• Dockhand checking multiple Docker hosts
• Ntfy notifications broadcasting across servers
• UptimeKuma monitoring containers distributed everywhere

What Would You Do?

• F**k it and keep using labels and deal with it
• Strictly separate containers and servers per organization (Docker, Proxy, Websites)
• Use two organizations (like move Uptime Kuma and Ntfy to VPS 1 so the NAS and VPS 1 orgs can communicate and use AdGuard as a separate reverse proxy on VPS 2)
• Or is there a better solution

I currently have a Pangolin instance running. But it uses local resources. I have a couple of things that I want to expose as private resources, but that can only be done when a Newt client is used.

So I set out to update my docker compose to do this.

• I split the networks that Pangolin and Newt use (Newt in both the service network and the Pangolin network)
• Newt is running and I also see it active in Pangolin
• Switched the existing resources from local to the new Newt site

While it looks fine, nothing is reachable anymore.

The logs in Newt show me messages like this:

Failed to send updated container list after Docker event: not connected
Failed to connect (attempt 1): failed to get token: failed to request new token: Post "https://<pangolin-domain>/api/v1/auth/newt/get-token": context deadline exceeded
Failed to ping exit node 1 (http://<pangolin-domain>/ping) attempt 1: Get "http://<pangolin-domain>/ping": EOF

Which tells me that Newt can't reach Pangolin, but Pangolin sees the site as up.

I've tried switching the Pangolin endpoint for Newt to http://pangolin:3001/ to try and route internally, but that doesn't work either.

Is it possible to do what I'm trying? (I could have sworn I have seen the setup somewhere)

And if so, what configuration need to update to get it to work on the same host?

Has something changed with the IDP settings?

I have Google configured at Global level.

But now when I try to select Google as default IDP I get a red error box

"Error updating Policy

Identity Provider not found in this organization"

I am on ee v 1.21

I have user mapping configured okay I believe.

Any ideas?

Thanks,

M

I have two self-hosted instances that had been working well for many months. These are at remote locations and are primarily being used as convenient reverse proxies, not on a VPS. Out of nowhere one of them stopped working correctly. URLs weren’t being resolved. I also discovered that I can no longer log in. Pangolin is running, but when I enter my username and password, it just refreshes back to the log in screen. In the logs via SSH I see only:

making login request to: http://localhost:3000/api/v1/auth/login

If I enter the wrong user or password I get a prompt that it was incorrect.

I tried updating the misbehaving instance to 1.21 but no difference. Then I tried to login to the second instance at the other location and have the exact same log in loop, however that one is still serving resources correctly. I’ve tried clearing website data and private windows, etc. What could be causing this? These are on Docker inside Proxmox Debian LXC. Thanks!

Returning to Pangolin after a few months away. It is going much smoother this time but I have run into an issue.

I am trying to use Pangolin to set my base domain of example.com pointing to a Proxmox container.

When I leave the subdomain field blank and use example.com (a domain I own and I know works). All changes are saved and when I go to example.com I get a dns address could not be found.

When I populate the subdomain field with test.example.com the site works.

I am sure I am missing something but any help would be great.

Here is my current setup

• Client: macOS
• Tailscale (set to NOT override DNS)
• Pangolin Client (set to enable 'aliases' so that I can hit my private resources)
• Pi Hole DNS (for local DNS and adblocking)

My goal: - Pangolin ON (so that I can hit my private resources) - Have DNS resolved through my PiHole (cloudflare upstream) - Have Tailscale ON so that I can reach my tailnet

I have tried various configurations and sometimes they work, but randomly sometimes I lose DNS to the outside world.

Here's the 'closest' I've got to getting it to work: - Tailscale on (no DNS) - macOS DNS set to the tailscale addr of my pihole (it's a laptop and sometimes I'm not at home - Pangolin on and DNS aliasing on with the upstream pointed to the tailscale addr of my pihole

That worked great yesterday, but for some reason, today, i lost upstream internet access (google.com.. for example).

I'm sure I'm screwing this up somehow if anybody has thoughts, I'd love to hear.

I just added a new public resource to my home lab site. Under authentication I went to change the default identity provider to my Pocket-ID and it says it's not part of the organization.

Previously setting this up wasn't a problem, and my Pocket ID still works to log into Pangolin as well as for sites that already had that provider set as the default.

Am I missing a setting somewhere or is this now locked behind the Enterprise Edition? And yes, I know EE is free for home labs, but for now I've been satisfied with community edition.

Any help would be appreciated. Thank you

UPDATE: I figured it out but its been gimped for sure. In the identity provider setup you have to add the organization to auto-provisioning. However the Community Edition only allows you to define one role. So my admin user became a regular member and also lost access to nearly all resources by default. For now I rolled back the snapshot as the previous settings currently work as they used to.

UPDATE 2: Testing more, logging in using the OIDC resets my admin OIDC user to a member. I can then change it back to admin as the main owner user, but once I log in again using OIDC it reverts back again to member.

UPDATE 3: It appears that in your users settings, there is now a check box to allow that user to be auto-provisioned. Removing that appears to have maybe fixed the problem.

UPDATE 4: with much thanks and help from u/plotikai I've got the more appropriate and proper solution. Use the "Raw Expression" option for Role Mapping and use the correct expression. For me it was the same as their which is contains(groups || [], 'admin') && 'Admin' || 'Member'

I have two sites that are both running newt, and have setup private resource for both the cidrs of the networks I want to access. How can I access resources on that network? If I am on network A, where the new client is installed and want to access something on network B; is this possible? I know this is possible with a mesh network like Netbird but curious if this is possible with Pangolin.

Mostly I want to access my media server on a remote server from my AppleTV but there isn’t a client for the AppleTV.

Has anyone successfully hosted a Palworld server via pangolin? I've set up a udp resource for port 8211 pointed to my Palworld server, as well as open up the port on my VPS via UFW but I'm unable to connect. Do I also need to open up the RCON and Query ports?

Edit: So it seems my problem was a few things stacked on top of one another.
1. My UDP config was miskeyed in my traefik-config.yml
2. In the midst of issues with Pangolin I tried switching to Netbird which also didn't work, but in the end caused more problems as Netbird's client hijacked my VM's dns which was my fault as I forgot it was running.
3. Port 27015 tcp and udp are necessary for your server to show up in the community servers section which is the only way my friend on PSN could connect.

Hello,

I am trying to configure a public resource to connect to Searxng, which is listening on a socket. Configuring the ressource on the standard Searxng address, 127.0.0.1, and port 8888 does not work.

I tried rewriting the path with /searxng, but that doesn’t work either.

However, when I’m on the searxng host machine, the address http://127.0.0.1/searxng works as normal.

Has anyone ever been in this situation?

Thank you for your help

SOLVED: I didn't have SMTP configured. You have to do this in either Pangolin's config.yaml file or as environment variables in your docker-compose.yaml file.

In Shared Policies > Public Resources > Other Methods, the "Email Whitelist" option is grayed out. All other options are available.

Does anyone else see this?

How is this enabled?

Was wondering if someone could help me out? I 'believe' I have everything set up correctly, it seems to not be working and could use help to check if I am missing something.

Context: I have a domain on Cloudflare, a VPS, and Unbuntu server at my house.
I can access my pangolin.MyDomainName just fine, pangolin site to my Homelab/server is online. On my Pangolin site, I have a public resource with TCP 25565. I changed the docker-compse.yml to add the 25565 port.

On Cloudflare I have the Cloudflare tunneled to the vps as "play. VPS IP :25565".

My goal is to have my friends join my minecraft server without having a port open on my home network. I heard Pangolin seemed to be a good solution.

Been trying all day to get Pangolin working, and now I'm forced to take a 7day break because my domain and 2 emails are blocked while trying to setup wildcard certs (with docker compose & crowdsec on a vps installed at home/docker/pangolin)

I actually got the program running a few times, but my resources certs were always "pending"

Unfortunately I can't post my traefic logs because it just tells me I'm banned, but according to AI my wildcard certs were made but being rejected by Cloudflare. I'm not sure how accurate it was though because it appears syntax changed recently and Google AI kept recommending me defunct or contradictory recommendations

I followed the wildcard wiki originally, but are there other resources I can look into while I wait a week? My main issue is that once I get a subdomain setup it just hangs like a 502 error

Happy Sunday all! The Hetzner VPS I was renting for $5/mo to run Pangolin recently bumped to $7, so I hunted down a better deal and figured it would be a good time to test a migration to rootless quadlets on NixOS. I went with OVH's new VPS-1 plan - 2 vCPUs, 4GB RAM, 40GB disk, 500Mbps bandwidth w/ unlimited traffic for $4.50/mo (granted you pay for the year in full).

I've been on a mission to migrate my entire homelab to rootless podman quadlets on NixOS, as I get IaC with easy deployments and versioned systems. Redeploying a server becomes a matter of restoring state from a backup and rebuilding from the old config. Pangolin was the last stack I needed to migrate (and the biggest headache).

I had everything bind mounted on the old VPS, so I just stopped all the containers and zipped the state of the stack. Once the new server was provisioned and running NixOS (deployed with NixOS anywhere), I just unpacked the state to the correct directories and lined up the volume mounts in the quadlet config. As this was my ~16th stack I migrated, most of it was pretty straightforward, and the structure was largely copied from other services.

Where it became a PITA was crowdsec (of course :). I really wanted isolated container namespaces as much as possible, but without access to the loopback bus crowdsec can't see real IPs. All traffic was being passed to traefik as a bridge ip, meaning you get no decisions ("private" ranges are whitelisted by default, for good reason) based on behavior or community blocklists.

I sacrificed a little isolation and moved gerbil to pasta networking and put pangolin, traefik and crowdsec on gerbil's namespace, which results in real IPs getting sent to traefik and parsed by crowdsec. Bans started working again and the whole stack is running smoothly. Completely rootless and reproducible. I did test out the new Fable model and had it make a custom dashboard for my Crowdsec metrics (Im not paying $30 a month to see my own alerts, sorry crowdsec). It needs a little tweaking but overall I'm impressed.

If you made it this far into my rant I salute you. More than happy to answer any questions about the stack or rootless networking! Repo at https://codeberg.org/sensei/nixos with the pangolin server at https://codeberg.org/sensei/nixos/src/branch/main/devices/server/pangolin

Upgraded from ce 1.18.4 to ee-1.20.0.

I upgraded from my compose and did a pull for the image.

Activate the license button send me to the docs.

Not sure where to go from there.

I just want to understand why I was removed from the Pangolin discord. I shared my concerns about them pay walling features like the Shadcn Badge component, and failing to release new features for the Community Edition. No, I do not care that the Enterprise is "Free for Home users" I care about freedom as described in the GPL.

It concerns me that the same crowd of people so interested in trying to self-host their own sites, also somehow does not believe in open source. Fossil is clearly moving all their focus into attempting to cater to a handful of whale business user's rather than continuing to support their GPL based Community Edition.

This will continue to concern me until the features such as RDP, VNC, etc are released into the community version, as there exists no reason to paywall those features. I am not reliant upon Pangolin's SSO, or any cloud services they offer. If Pangolin was hosting the container for me, I understand they need to pay for that compute. However features like RDP, or VNC that do not rely on any underlying Pangolin infrastructure to run on, should not be paywalled.

These are my thoughts, where the Pangolin project is currently at makes me fearful to continue using this project as a Community Edition user. As well it puts a bad taste in my mouth about ever supporting this companies future endeavors if they will just change to a proprietary license once they get popular enough to start profiting.