pangolin

In my case Pangolin as a secured gateway to my homelab services. https://github.com/fosrl/pangolin

You have seen Pangolin (https://github.com/fosrl/pangolin) on here before for our open-source zero-trust network access suite of tools. We are launching a new AI gateway that takes a different approach to auth. Rather than authenticating requests to AI providers with API keys, it authenticates the network connection itself via a desktop app. Each user gets a WireGuard tunnel back to the gateway, established after they log in through their existing identity provider (Okta, Azure, Google, etc) via a desktop app. That tunnel is the auth, so there is no key to generate, embed, rotate, or leak, because the gateway already knows who's on the other end of the connection. Compare that to most AI gateways, which are really just a proxy in front of static bearer tokens you'd get from OpenAI or Anthropic directly. This tunnel-based approach also mea

Pangolin (https://github.com/fosrl/pangolin) is an open-source tool for identity-based remote access to internal resources - an alternative to Cloudflare ZTNA, Zscaler, and Twingate. It’s different than existing approaches: mesh VPNs (Tailscale, ZeroTier, etc.) create flat overlay networks where ACL and IP space management becomes complex at scale and every device can talk to every other device, while corporate ZTNA solutions (Zscaler, Cato, Netskope etc.) are closed-source and add latency by forcing traffic through a central server. Pangolin takes a resource-centric approach. You deploy lightweight connectors that bridge to specific resources (private web apps, SSH, databases, CIDR ranges). Admins delegate resource-access to specific users and roles. It uses WireGuard with NAT hole-punching for peer-to-peer connections and traffic goes d

I use Tailscale for exactly those reasons, plus the easy SSL certificates and clients for Android and iOS. From this thread, I've learned about Pangolin: https://github.com/fosrl/pangolin Which seems very compelling to me too. If it has apps that allow various devices connect to the VPN it might be worth it to me to trial using it instead of Tailscale...

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. This is what I do. You can do Tailscale like access using things like Pangolin[0]. You can also use a bastion host, or block all ports and set up Tor or i2p, and then anyone that even wants to talk to your server will need to know cryptographic keys to route traffic to it at all, on top of your SSH/WG/etc keys. > I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. This is what I don't do. Anything that needs real internet access like mail, raw web access, etc gets its own VPS where an attack will stay isolated, which is important as more self-hosted services are implemented using things like React and Ne

A system by wich you can expose things on your private network (e.g. your home lan) so you can selectively and securely make them accesible from other places (e.g. over the Internet). You can do all this without tailscale by just configuring secure encrypted tunnels (wireshark, traefic, ...) yourself, but services like tailscale provide you with easy gui configuration for that. I personally use Pangolin, which is similar https://github.com/fosrl/pangolin

Pangolin is awesome. It's like self-hosted Cloudflare Tunnels https://github.com/fosrl/pangolin

Or Pangolin [1] on a cheap VPS, in case you want to self host the tunnel as well :-) [1] https://github.com/fosrl/pangolin

What I really like about Caddy is their better syntax. I actually use nginx (via nginx proxy manager) and Traefik but recently I did one project with Caddy and found it very nice. I might get the time to change my selfhosted setup to use Caddy in the future but probably will go with something like pangolin [1] because it provides alternative to cloudflare tunnels too. [1] https://github.com/fosrl/pangolin

I found the Tailscale client experience is quite nice and headscale had built in OIDC support (so easy auth for my users) If I started this setup later I might have also used pangolin, which also provides a nice management interface on top of WireGuard https://github.com/fosrl/pangolin

Pangolin is an open source self-hosted tunneled reverse proxy management server with identity and access control, designed to securely expose private resources through encrypted WireGuard tunnels running in user space. We made Pangolin so you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, all with a clean and simple dashboard web UI. GitHub: https://github.com/fosrl/pangolin Deployment takes about 5 minutes on a VPS: https://docs.fossorial.io/Getting%20Started/quick-install Demo by Lawrence Systems (YouTube): https://youtu.be/g5qOpxhhS7M?si=M1XTWLGLUZW0WzTv&t=723 Some use cases: - Grant users access to your apps from anywhere using just a web-browser - Proxy behind CGNAT - One application load balancer across multiple clouds a

since I had to ggole it https://github.com/fosrl/pangolin Tunneled Reverse Proxy Server with Access Control - your own self-hosted zero trust tunnel. AGPL3