📌 What Pangolin is 1:37
fosrl/pangolin — 22,008 stars on GitHub, TypeScript, created September 2024. Described as "identity-aware VPN and tunneled reverse proxy for remote access". The project is active and the website (pangolin.io) returns HTTP 200."Pangolin is basically CloudFlare tunnels with Twingate baked in, but self-hosted. It gives you outbound tunnels, a public VPS entry point, a reverse proxy, SSL certificates, users, roles, permissions, and authentication in front of all applications."
License note. The presenter says it is open source — "every layer of it, including the SaaS option. Fully open. Nothing gated." The GitHub license field is
NOASSERTION — no SPDX license identifier. The claim is his; the license status is worth checking before deploying.🏗️ Architecture 2:46
| Component | What it does |
|---|---|
| Public VPS (Gerbil) | The entry point — terminates SSL, examines hostname, routes to the correct backend. Runs in Docker. |
| Home server (Newt) | The private-network agent — tunnels outbound via WireGuard. No port forwarding on the home router. |
| Traefik | Built-in reverse proxy — routes traffic based on hostname. Integrated, not a separate setup step. |
| WireGuard | The tunnel layer. Zero-trust access based on WireGuard — outbound-only from the home side. |
| Auth layer | Per-resource authentication — any service behind Pangolin gets an auth screen without modifying the service itself. |
⚙️ Setup 10:00
One Docker Compose file on the VPS. A companion agent — Newt — installed on the home server. The presenter walks through the UI: resources (each proxied service), sites, users, roles, and the access control model. He demonstrates adding a new service (Dozzle) behind Pangolin with a single resource definition — hostname, target port, authentication toggle.
🧩 Features
| Feature | Status |
|---|---|
| Outbound tunnels (no port forwarding) | Built-in |
| Reverse proxy with SSL | Built-in — Traefik integrated |
| Per-resource authentication | Built-in — works across all proxied services |
| Users, roles, permissions | Built-in |
| Mobile app | Available — demonstrated for on-the-go access |
| Docker Compose deployment | One file |
| Open source | Claimed — license is NOASSERTION on GitHub |
🔍 Claims checked
| Claim | Result |
|---|---|
| Pangolin is a real project | fosrl/pangolin — 22,008 ⭐, TypeScript, created Sep 2024 |
| WireGuard-based, zero-trust | Confirmed in repo description |
| Open source ("every layer, nothing gated") | License is NOASSERTION — not confirmed |
| Docker Compose deployment | Consistent with the project structure |
| Mobile app available | Claimed; not independently verified |
Method note. 404 segments across 15:25. Verified 7 August 2026.
💡 Key takeaways
- One tool replaces five. Headscale, NetBird, Cloudflare, Tailscale, Twingate — Pangolin covers all their use cases in one Docker Compose file.
- Outbound-only tunnels. No port forwarding on the home router — the VPS is the entry point.
- Per-resource auth without modifying services. Any proxied application gets an auth screen.
- The license claim is unverified. NOASSERTION on GitHub — check before deploying.
🔗 Resources
- I Found The END GAME of Homelab TunnelsSource — DevOps Toolbox, 15:25, 7 August 2026
- fosrl/pangolin22,008 ⭐ — identity-aware VPN and tunneled reverse proxy