Hacker News Reader

Comment by seaal | Hacker News Reader

After switching from nginx to caddy-docker-proxy a year ago I just recently made the move to Pangolin[0] and am really enjoying the experience. It's a frontend to traefik with built-in auth and ability to tunnel traffic through Wireguard. I needed the TCP forwarding for my Minecraft server and this made it very simple.

Would recommend it for anyone wanting a better version of Nginx Proxy Manager. The documentation is a little lacking so far but the maintainers are very helpful in their Discord.

[0] github.com/fosrl/pangolin

View on HN

It sounds more like an alternative to Cloudflare Tunnels. Except, the Cloudflare access is secured by Cloudflare security team.

And all your traffic would be watched and monitored by an US American company which already has access to vast amounts of your internet browsing behaviour.

Yes, that’s the downside. But if you run Pangolin on a VPS, there is no downside in that respect: in both cases a cloud provider has access.

Authentik behind Caddy does that too.

Not sure if Pangolin works this way, but in general it's possible to run tunnels end to end encrypted.

OP told that was already using Cloudflare.

Glad to see Pangolin mentioned here!

Appreciate the hard work on the project Milo :) Glad I could spread the message.

Thanks for this comment. Ive recently been looking to use a domain for a server (instead of ISP assigned address) to make it publicly accessible. The server machine still physically sits in a residential location so I dont want that exposed. This is another setup solution I can look into.

I have been looking into doing an ec2 or DO droplet with a static ip with tailscale funnel for the traffic proxy. I just like that its easy to go into the web interface for the ec2/droplet and control which IPs it allows ssh connections.

what is the use of SSO there? How this would work with other selfhosted applications that require their own auth? Because if you need to authenticate 2 times then it would not be good.

You can disable auth for specific subdomains. With cookies I rarely see the original auth anyways.

Ah ok. Though in my ideal world I would have SSO for all of my selfhosted applications and it would be one and the same. You login to SSO, you logged to an app.

Especially when my family is using the same services for some stuff. I would rather not hear them complaining that they have to 'again login to access x or y TWICE'. :)

With mobile applications it is also tricky since some of them work on app tokens and require it to setup via some application UI.

So you wold have to login twice, from mobile, which is even less convenient, and from every app since there are no shared system cookies. In summary I would rather block/whitelist IPs or IPs ranges on proxy webserver (like right now with NGINX). Which lacks UI, yes. This is where Pangolin seems much better.

The SSO is only once for all shared resources, the login of which is saved in password manager just like any other website so login isn't really an issue. You can create different users and roles with ease for anyone that needs it.

There's also a rules section that allows you to bypass all authentication with a IP, range, URL whitelist. It's all traefik under the hood after all so it's very extensible with crowdsec, fail2ban and there's always the yml if you want to deal with that.

I just have Jellyfin disabled since it has it's own auth and to prevent any issues with family members tv streaming since that's the only thing they care about anyways.

Ah ok I understand. Thanks

Reply on news.ycombinator.com