> ## Content Index
> Fetch the complete content index at: https://notes.d4rkcyber.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Pangolin Reverse Proxy Setup
- URL: https://notes.d4rkcyber.com/pangolin-reverse-proxy-setup/
- Published: 2026-06-02T00:00:00.000Z
- Updated: 2026-10-28T14:12:08.000Z
- Description: Pangolin is a self-hosted tunneled reverse proxy and access manager. No open ports on the origin server, WireGuard tunneling via the Newt agent, and a web dashboard for managing everything.
- Author: David Dami
- Tags: Infrastructure, pangolin, reverse-proxy, tunneling, wireguard, zero-trust

## What Pangolin Does

Pangolin is a self-hosted alternative to Cloudflare Tunnel + Cloudflare Access. It acts as a reverse proxy with identity-aware access control, but the key difference from something like Traefik is that your origin server never needs any inbound ports open.

The connection from your server to Pangolin runs outbound via a WireGuard-based tunnel using an agent called **Newt**. Traffic flows like this:

![Pangolin architecture diagram](https://notes.d4rkcyber.com/content/images/2026/10/pangolin-reference.jpeg)

Your local service never touches the internet directly. Everything arrives through the tunnel.

## Components

- **Pangolin** — the central proxy server. Runs on a VPS you control.
- **Newt** — the tunnel agent. Runs on your origin server (homelab, home server, etc.).
- **Gerbil** — handles the WireGuard tunnel layer under the hood.

## Why I Use This

My main servers are on a residential connection with CGNAT. Port forwarding doesn't work cleanly and I'd rather not expose ports anyway. Pangolin gives me clean HTTPS access to homelab services without depending on Cloudflare proxying everything. I own the VPS, I own the proxy — nothing routes through a third party I don't control.

## Deploying Pangolin on a VPS

On your VPS, pull the Compose setup from the Pangolin repo:

```bash
curl -o compose.yml https://raw.githubusercontent.com/fosrl/pangolin/main/compose.yml
cp config.example.yml config.yml

```

Key values to set in `config.yml`:

- `domain` — the domain pointing to your VPS for the Pangolin dashboard
- `dashboard_port` — port for the admin UI
- `acme_email` — for Let's Encrypt cert generation

Start it:

```bash
docker compose up -d

```

Pangolin handles SSL automatically via Let's Encrypt once the DNS is pointed at the VPS.

## Installing Newt on the Origin Server

On the server running your services, install the Newt agent:

```bash
curl -fsSL https://raw.githubusercontent.com/fosrl/newt/main/install.sh | sudo bash

```

Configure it in `/etc/newt/config.yml`:

```yaml
pangolin_url: https://your-pangolin-domain.com
token: your_site_token_from_dashboard

```

Enable and start:

```bash
sudo systemctl enable newt --now

```

## Adding Services in the Dashboard

1. Log into the Pangolin dashboard
2. Create a new site — this generates the Newt token
3. Add resources to the site: set the internal hostname/port and the public-facing subdomain
4. Pangolin creates the routing and provisions the cert automatically

Once Newt is connected and the site is configured, the service is reachable at the hostname you set — no DNS record management needed beyond pointing the domain at Pangolin.

## Access Control

Pangolin has built-in access management:

- **Password-protected shareable links** — good for sharing specific services temporarily
- **OIDC/SSO** — wire it to your identity provider
- **Email-based one-time access** — for ad-hoc sharing without creating accounts

For internal services I use no additional auth layer since the tunnel itself is the access gate. For anything I share externally, password-protected links are the go-to.