Pangolin

Last reviewed Aug 26, 2026 · 792 words

Pangolin is the answer to "Cloudflare Tunnel, but I own the exit". A VPS at about $5 a month runs Pangolin, your home server runs a small client called Newt, a WireGuard tunnel connects them, and every service on your LAN gets a public HTTPS hostname with a login page in front. No port is forwarded on your router, and no third party terminates your TLS or reads your traffic. It rates Medium because the install is scripted and the moving parts hide behind one dashboard; the 512 MB RAM floor is honest for the VPS side. What you cannot skip is the VPS itself, and that is the one unavoidable cost.

The four containers, and what each one does

Pangolin is the app, API, dashboard and identity layer. Gerbil is the WireGuard server that clients connect to. Traefik is the reverse proxy doing TLS and routing. On the private side, Newt registers a site and forwards traffic to local addresses. The installer, downloaded from the project's GitHub releases and run on the VPS, writes the compose file and Traefik config for you:

wget -O installer https://github.com/fosrl/pangolin/releases/latest/download/installer_linux_amd64
chmod +x installer && sudo ./installer

Have a domain with an A record and a wildcard pointing at the VPS before running it, because certificates are requested immediately. Open ports 80 and 443 TCP and 51820 UDP on the VPS firewall. Nothing opens at home.

Adding a home service takes about 2 minutes

In the dashboard, create a Site, which gives you a Newt ID and secret. On the home server:

services:
  newt:
    image: fosrl/newt
    restart: unless-stopped
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.example.com
      - NEWT_ID=your-id
      - NEWT_SECRET=your-secret

Then create a Resource: pick the site, a hostname like photos.example.com, and the internal target http://192.168.1.20:2283. Traefik gets a route, a certificate is issued, and the resource is live. Newt reaches anything its container can reach, so one Newt per LAN is enough; it does not need to sit on the same host as the service it fronts.

Authentication is the feature, not the tunnel

Every resource can require a login through Pangolin's own user store, a one-time PIN, a shared password, or an external OIDC provider such as Authentik. Rules allow by IP range or path, so a mobile app's API path can bypass auth while the web UI stays gated. This is the layer Cloudflare sells as Access and the layer a plain reverse proxy does not have. For a household exposing Immich, Jellyfin and a few admin panels it is the right amount of identity, and the Cloudflare Access alternatives page spells out what the hosted version costs you in return.

Pangolin versus Tailscale is the real decision

Tailscale is a mesh: every device joins the network. Pangolin is an ingress: the world reaches named services through one door with a lock on it. Many homelabs end up with both, Tailscale for SSH and admin, Pangolin for the apps other people use. What Pangolin adds over running Traefik and WireGuard yourself is the dashboard and the identity layer; what it costs is a young codebase (first released in 2024) and the monthly VPS.

The honest caveats

Your VPS is now the single point of failure and the place all traffic transits, so pick a provider with a generous bandwidth cap; streaming media through a 1 TB-a-month plan gets tight. The core is AGPL-3.0, with some enterprise features behind a paid licence at last check, so read the feature matrix before assuming everything in the docs is in the free build. And keep the VPS patched: it is internet-facing by definition, and CrowdSec plugs into the Traefik it ships with.

What I'd do

A 1 GB VPS from a provider with a fat transfer allowance, the official installer, a wildcard DNS record, one Newt container at home. Every resource behind Pangolin's own login, with the 2 family-facing apps on PIN access and the admin panels on OIDC through Authentik. Tailscale alongside for SSH. That replaces Cloudflare Tunnel for about $5 a month and removes the last third party from the path to your data, which is the reason most of us started self-hosting in the first place. The proxy category covers the pieces if you would rather assemble them yourself.