Feature Request - Internal Service Exposure & Hub Function #1706

New Issue

MrUnknownDE · 2026-04-05T19:40:05+02:00

MrUnknownDE commented

2026-04-05 19:40:05 +02:00

Originally created by @miloschwartz on 3/16/2025

Discussed in https://github.com/orgs/fosrl/discussions/23

^{Originally posted by Zetsuubou January 10, 2025}
As previously conceived on the discord server this feature request would change the direction of the project significantly.

Pangolin currently allows services to be exposed to the public through the usage of Newt or Wireguard.
However, it would be useful to be able to leverage the SSL certificates, authentication layer and general user management to also expose services on an internal Pangolin network and make those services available to other users, which can be invited to Pangolin.

The general idea here would be to have similar functionality to Tailscale, where the Pangolin server could act as a centralized hub to facilitate connections between different Newt/Wireguard nodes, whether they are services or users wanting to gain access to the aforementioned.

Summary of feature request
Existing:
Pangolin remains being able to expose services publicly like it does currently.

New or carried over features:
Pangolin can expose services on an internal network.

Valid SSL certificates; either through regular challenges or DNS challenge/API.
DNS-01 challenge added as an option to the web interface, instead of editing through configuration files.
Same Pangolin authentication like on public facing services, but for internal ones as well.

Pangolin on a VPS could act as a relay for traffic (if direct connections aren't possible or subpar), which might also have to be packaged into its own separate service, so that organizations or prosumers can organize a larger selection of relays in different locations.

Users that are added to the internal network should get segmented into their own subnet or otherwise restricted, so that they can only access resources by going through Pangolin first, unless specifically allowed to be on the same network by an administrator.

Perhaps introduce options to enable/disable exposing a service to the public or internally or both at the same time.

Cheers 👍

*Originally created by @miloschwartz on 3/16/2025* ### Discussed in https://github.com/orgs/fosrl/discussions/23 <div type='discussions-op-text'> <sup>Originally posted by **Zetsuubou** January 10, 2025</sup> As previously conceived on the discord server this feature request would change the direction of the project significantly. Pangolin currently allows services to be exposed to the public through the usage of Newt or Wireguard. However, it would be useful to be able to leverage the SSL certificates, authentication layer and general user management to also expose services on an internal Pangolin network and make those services available to other users, which can be invited to Pangolin. The general idea here would be to have similar functionality to Tailscale, where the Pangolin server could act as a centralized hub to facilitate connections between different Newt/Wireguard nodes, whether they are services or users wanting to gain access to the aforementioned. **Summary of feature request** Existing: Pangolin remains being able to expose services publicly like it does currently. **New or carried over features:** Pangolin can expose services on an internal network. - Valid SSL certificates; either through regular challenges or DNS challenge/API. - DNS-01 challenge added as an option to the web interface, instead of editing through configuration files. - Same Pangolin authentication like on public facing services, but for internal ones as well. Pangolin on a VPS could act as a relay for traffic (if direct connections aren't possible or subpar), which might also have to be packaged into its own separate service, so that organizations or prosumers can organize a larger selection of relays in different locations. Users that are added to the internal network should get segmented into their own subnet or otherwise restricted, so that they can only access resources by going through Pangolin first, unless specifically allowed to be on the same network by an administrator. Perhaps introduce options to enable/disable exposing a service to the public or internally or both at the same time. Cheers 👍 </div>

MrUnknownDE closed this issue

2026-04-05 19:40:05 +02:00

MrUnknownDE added the new feature new feature new feature new feature new feature new feature new feature labels 2026-04-05 19:40:05 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label new feature new feature new feature new feature new feature new feature new feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1706