diff --git a/README.md b/README.md index 5baef277..707c4b7c 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,10 @@ _Your own self-hosted zero trust tunnel._ Full Documentation + | + + Contact Us + @@ -68,41 +72,17 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected ### Easy Deployment - Run on any cloud provider or on-premises. -- Docker Compose based setup for simplified deployment. +- **Docker Compose based setup** for simplified deployment. - Future-proof installation script for streamlined setup and feature additions. -- Use your preferred WireGuard client to connect, or use Newt, our custom user space client for the best experience. +- Use any WireGuard client to connect, or use **Newt, our custom user space client** for the best experience. ### Modular Design -- Extend functionality with existing [Traefik](https://github.com/traefik/traefik) plugins, such as [Fail2Ban](https://plugins.traefik.io/plugins/628c9ebcffc0cd18356a979f/fail2-ban) or [CrowdSec](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin). +- Extend functionality with existing [Traefik](https://github.com/traefik/traefik) plugins, such as [CrowdSec](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin) and [Geoblock](github.com/PascalMinder/geoblock). + - **Automatically install and configure Crowdsec via Pangolin's installer script.** - Attach as many sites to the central server as you wish. -## Screenshots - -
![]() |
- ![]() |
- ![]() |
-
| Sites | -Users | -Share Link | -
![]() |
- ![]() |
- - |
| Authentication | -Connectivity | -- |
## Deployment and Usage Example
@@ -112,7 +92,7 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
> [!TIP]
> Many of our users have had a great experience with [RackNerd](https://my.racknerd.com/aff.php?aff=13788). Depending on promotions, you can likely get a **VPS with 1 vCPU, 1GB RAM, and ~20GB SSD for just around $12/year**. That's a great deal!
-> We are part of the [RackNerd](https://my.racknerd.com/aff.php?aff=13788) affiliate program, so if you sign up using [our link](https://my.racknerd.com/aff.php?aff=13788), we receive a small commission which helps us maintain the project and keep it free for everyone.
+> We are part of the [RackNerd](https://my.racknerd.com/aff.php?aff=13788) affiliate program, so if you purchase through [our link](https://my.racknerd.com/aff.php?aff=13788), we receive a small commission which helps us maintain the project and keep it free for everyone.
2. **Domain Configuration**:
@@ -123,10 +103,10 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
- Install Newt or use another WireGuard client on private sites.
- Automatically establish a connection from these sites to the central server.
-4. **Configure Users & Roles**
+4. **Expose Resources**:
- - Define organizations and invite users.
- - Implement user- or role-based permissions to control resource access.
+ - Add resources to the central server and configure access control rules.
+ - Access these resources securely from anywhere.
**Use Case Example - Bypassing Port Restrictions in Home Lab**:
Imagine private sites where the ISP restricts port forwarding. By connecting these sites to Pangolin via WireGuard, you can securely expose HTTP and HTTPS resources on the private network without any networking complexity.
@@ -134,6 +114,11 @@ _Sites page of Pangolin dashboard (dark mode) showing multiple tunnels connected
**Use Case Example - IoT Networks**:
IoT networks are often fragmented and difficult to manage. By deploying Pangolin on a central server, you can connect all your IoT sites via Newt or another WireGuard client. This creates a simple, secure, and centralized way to access IoT resources without the need for intricate networking setups.
+
+
+
+_Resources page of Pangolin dashboard (dark mode) showing HTTPS and TCP resources with access control rules._
+
## Similar Projects and Inspirations
**Cloudflare Tunnels**:
diff --git a/config/config.example.yml b/config/config.example.yml
index d60ab2ba..d7b70a69 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -1,3 +1,6 @@
+# To see all available options, please visit the docs:
+# https://docs.fossorial.io/Pangolin/Configuration/config
+
app:
dashboard_url: "http://localhost:3002"
log_level: "info"
diff --git a/install/config/config.yml b/install/config/config.yml
index ff99b1f9..8b21b840 100644
--- a/install/config/config.yml
+++ b/install/config/config.yml
@@ -1,3 +1,6 @@
+# To see all available options, please visit the docs:
+# https://docs.fossorial.io/Pangolin/Configuration/config
+
app:
dashboard_url: "https://{{.DashboardDomain}}"
log_level: "info"
@@ -26,7 +29,6 @@ traefik:
cert_resolver: "letsencrypt"
http_entrypoint: "web"
https_entrypoint: "websecure"
- prefer_wildcard_cert: false
gerbil:
start_port: 51820
diff --git a/install/config/crowdsec/docker-compose.yml b/install/config/crowdsec/docker-compose.yml
index 982b3335..d03861d4 100644
--- a/install/config/crowdsec/docker-compose.yml
+++ b/install/config/crowdsec/docker-compose.yml
@@ -11,8 +11,6 @@ services:
ENROLL_TAGS: docker
healthcheck:
test: ["CMD", "cscli", "capi", "status"]
- depends_on:
- - gerbil # Wait for gerbil to be healthy
labels:
- "traefik.enable=false" # Disable traefik for crowdsec
volumes:
@@ -24,12 +22,5 @@ services:
- ./config/crowdsec_logs/syslog:/var/log/syslog:ro # syslog
- ./config/crowdsec_logs:/var/log # crowdsec logs
- ./config/traefik/logs:/var/log/traefik # traefik logs
- ports:
- - 9090:9090 # port mapping for local firewall bouncers
- - 6060:6060 # metrics endpoint for prometheus
- expose:
- - 9090 # http api for bouncers
- - 6060 # metrics endpoint for prometheus
- - 7422 # appsec waf endpoint
restart: unless-stopped
command: -t # Add test config flag to verify configuration
\ No newline at end of file
diff --git a/install/crowdsec.go b/install/crowdsec.go
index 2d56ecc6..c545a90d 100644
--- a/install/crowdsec.go
+++ b/install/crowdsec.go
@@ -82,6 +82,11 @@ func installCrowdsec(config Config) error {
return fmt.Errorf("failed to restart containers: %v", err)
}
+ if checkIfTextInFile("config/traefik/dynamic_config.yml", "PUT_YOUR_BOUNCER_KEY_HERE_OR_IT_WILL_NOT_WORK") {
+ fmt.Println("Failed to replace bouncer key! Please retrieve the key and replace it in the config/traefik/dynamic_config.yml file using the following command:")
+ fmt.Println(" docker exec crowdsec cscli bouncers add traefik-bouncer")
+ }
+
return nil
}
@@ -119,3 +124,14 @@ func GetCrowdSecAPIKey() (string, error) {
return apiKey, nil
}
+
+func checkIfTextInFile(file, text string) bool {
+ // Read file
+ content, err := os.ReadFile(file)
+ if err != nil {
+ return false
+ }
+
+ // Check for text
+ return bytes.Contains(content, []byte(text))
+}
diff --git a/public/screenshots/auth.png b/public/screenshots/auth.png
deleted file mode 100644
index 1bcc35e6..00000000
Binary files a/public/screenshots/auth.png and /dev/null differ
diff --git a/public/screenshots/collage.png b/public/screenshots/collage.png
new file mode 100644
index 00000000..74fe6deb
Binary files /dev/null and b/public/screenshots/collage.png differ
diff --git a/public/screenshots/connectivity.png b/public/screenshots/connectivity.png
deleted file mode 100644
index 7b6ca88d..00000000
Binary files a/public/screenshots/connectivity.png and /dev/null differ
diff --git a/public/screenshots/resources.png b/public/screenshots/resources.png
new file mode 100644
index 00000000..2ee2c6e2
Binary files /dev/null and b/public/screenshots/resources.png differ
diff --git a/public/screenshots/share-link.png b/public/screenshots/share-link.png
deleted file mode 100644
index 7515c8fe..00000000
Binary files a/public/screenshots/share-link.png and /dev/null differ
diff --git a/public/screenshots/sites.png b/public/screenshots/sites.png
index eb82212f..aa7294f5 100644
Binary files a/public/screenshots/sites.png and b/public/screenshots/sites.png differ
diff --git a/public/screenshots/users.png b/public/screenshots/users.png
deleted file mode 100644
index 08a8f591..00000000
Binary files a/public/screenshots/users.png and /dev/null differ
diff --git a/server/auth/sessions/app.ts b/server/auth/sessions/app.ts
index 62850453..bdd593f7 100644
--- a/server/auth/sessions/app.ts
+++ b/server/auth/sessions/app.ts
@@ -129,18 +129,19 @@ export async function invalidateAllSessions(userId: string): Promise