Leebra selfhosted
login register

Any experience with Pangolin?

a year ago by robber to c/selfhosted

save

share

report

Hi fellow homelabbers! I hope your day / night is going great.

Just stubled across this self-hosted cloudflare tunnel alternernative called Pangolin.

  • Does anyone use it for exposing their homelab? It looks awesome, but I've never heard of it before.

  • Should I be reluctant since it's developed by a US-based company? I mean security-wise. (I'll remove this question if it's too political.)

  • Does anyone know of alternatives pieces or stacks or software that achieve the same without relying on cloudflare?

Your insights are highly appreciated!

nimmo 10 points a year ago

I've seen lots of talk about headscale, an open source tailscale which allows you to create your own tailnet and I'm sure I've seen people talking about using tailscale as a reverse proxy tool, but it's not something I've explored in detail.

Pangolin is somewhat higher on my list of things to explore than headscale though.

If you're looking for a reverse proxy caddy and Traefik are also widely used.

With all of these solutions though you're going to need to have some online provider somewhere handling DNS for you so that you can have your domains be pointed to your IP address.

save

path: 0 17357614, hotness: undefined, score: 10, children: 8
YodaDaCoda 10 points a year ago

I think Pangolin works a bit differently... Correct me if I'm wrong...

Where headscale is a coordination server for a wireguard mesh, pangolin is a reverse proxy server that connects to the backend services via wireguard tunnels

save

path: 0 17357614 17360449, hotness: undefined, score: 10, children: 1
nimmo 2 points a year ago

That's likely true.

The first I heard of Pangolin was in a conversation that followed on from one about head/tailscale and I accept that I may have jumped to a conclusion. I am certain I've seen people talking about using it as a reverse proxy tool. Just found a blog post on the tailscale site talking about how to do it and they're using tailscale and caddy, rather than everything being handled by tailscale alone, so I'll accept that I'm wrong on this one. https://tailscale.com/...

save

path: 0 17357614 17360449 17363343, hotness: undefined, score: 2, children: 0
Blaster_M 3 points a year ago

I have yet to get headscale to work with my system. No turnkey setup, instructions that lack clarity, and in the end... idk how it's supposed to do the thing.

save

path: 0 17357614 17358678, hotness: undefined, score: 3, children: 4
lepinkainen 4 points a year ago

Then you can just go with Tailscale, it’s 100% turnkey and just works. Even better when combined with NextDNS

save

path: 0 17357614 17358678 17359241, hotness: undefined, score: 4, children: 0
YodaDaCoda 2 points a year ago

I did manage to get it to work, but I recall it took me a while. I have several devices connected to it now though. I'm keenly looking forward to the autogroup:self ACL support so I can set up sensible ACLs and share my net with some mates - I only have my own devices on it right now.

Anything I can share that might help your understanding?

save

path: 0 17357614 17358678 17360335, hotness: undefined, score: 2, children: 2
Blaster_M 1 point a year ago

Every system I can run headscale on I need to do it via an nginx reverse proxy

save

path: 0 17357614 17358678 17360335 17367731, hotness: undefined, score: 1, children: 1
YodaDaCoda 1 point a year ago

Yes you need a way to expose it over https. A reverse proxy is easiest. I use Caddy.

save

path: 0 17357614 17358678 17360335 17367731 17376570, hotness: undefined, score: 1, children: 0
nick_99 1 point a year ago

I love headscale. I use it for subnet routing. I have a server in the cloud with NGINX for reverse proxy and the a subnet router at home that just routes internal stuff so I just use the local IP for the backend service and it just works.

save

path: 0 17357614 17366743, hotness: undefined, score: 1, children: 0
aksdb 7 points a year ago

Pangolin is the most user friendly self hosted alternative to Cloudflare tunnels. There are dozens alternatives, but none with that feature set and such a UI.

save

path: 0 17358750, hotness: undefined, score: 7, children: 2
robber 1 point a year ago

Thanks for the list! Do you use Pangolin yourself?

save

path: 0 17358750 17362244, hotness: undefined, score: 1, children: 1
aksdb 1 point a year ago

No, since at the moment it wants to manage certificates, but I don't intend to run pangolin as my main reverse proxy.

save

path: 0 17358750 17362244 17362388, hotness: undefined, score: 1, children: 0
Bort 5 points a year ago

I just switched from cloudflare to pangolin on a racknerd vps. I’m really liking it so far. Very easy to configure. I’ve got three different domains, and a ton of subdomains pointing to different services running on two servers on my lan. I’m loving the authentication, crowdsec, and geoblock features. The community guide for the metrics broke my system (and I didn’t backup any of the yaml files) but I was able to wipe everything and get it up again in about 30 minutes. I have my jellyfin bypassing the pangolin authentication for a few specific IPs so that my relatives can stream to their firesticks. I highly recommend it.

save

path: 0 17359718, hotness: undefined, score: 5, children: 0
mmhmm 3 points a year ago

Pangolin is my next homelab project. I can't wait to give it a go. If anyone has any advise or guides it'd be appreciated

I don't know of alternatives

Pangolin, while u.s. based does not appear to serve the state of its interests

I am not aware of a direct peer, but tailscale, a bastion hosting a direct VPN or remote reverse proxy to your homelab are all similar. Pangolin seemingly combines the best and more of these scenarios

save

path: 0 17375631, hotness: undefined, score: 3, children: 1
mosiacmango 3 points a year ago

save

path: 0 17375631 17377695, hotness: undefined, score: 3, children: 0
dfense 3 points a year ago

Using it for several weeks now. Very happy with it, especially now that it is integrated with OAuth, so SSO for getting through Pangolin itself and then on all the services it routes to.

save

path: 0 17363859, hotness: undefined, score: 3, children: 2
robber 1 point a year ago

That sounds awesome! No issues at all so far?

save

path: 0 17363859 17367999, hotness: undefined, score: 1, children: 1
dfense 2 points a year ago

None so far. And I am using pretty much all the features.

It is also great for my current migration from docker compose to kubernetes.

A newt client on both and I can just switch on the pangolin side.

save

path: 0 17363859 17367999 17399426, hotness: undefined, score: 2, children: 0
nick 2 points a year ago

Using pangolin to serve a bunch of services from my homelab. It’s great.

save

path: 0 17362138, hotness: undefined, score: 2, children: 0
TheOneCurly 2 points a year ago

I moved my entire public facing set of services over to Pangolin a little over a month ago. It's been pretty sweet. I really like the auth system and they just integrated custom oidc providers so I've got pocketID set up with it as well.

save

path: 0 17457223, hotness: undefined, score: 2, children: 2
robber 2 points a year ago

Thanks for the hint to pocketID, haven't heard of it before. That makes me think it's time to upgrade my auth stack as well.

save

path: 0 17457223 17464658, hotness: undefined, score: 2, children: 1
TheOneCurly 2 points a year ago

I tried and bounced off of several of the other popular auth providers over the years. PocketID was the first one I found reasonable to set up and configure.

save

path: 0 17457223 17464658 17479025, hotness: undefined, score: 2, children: 0
selfhosted
selfhosted

@lemmy.world

login for more options
61580
6654
5580

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

go to feed...