English
Pangolin Hosting
Pangolin is a self-hosted identity-aware proxy that publishes private apps through WireGuard tunnels or plain reverse-proxy routes.
- One click deploy
- 15 GB Disk Space Needed
- 1 GB RAM Memory needed
- From 2 € Price
No setup fees
Official links
Pangolin’s official links and original website
- Go to Repository
Pangolin GitHub
- More
Pangolin Website
What you get
on AvaHost
One-click deployment, a custom domain, free HTTPS, automatic application updates, and scheduled backups come with every Cloud App. You can run multiple apps on one server, and terminal access is included.
This template does not include a database container.
Tech
- Docker image
- fosrl/pangolin:latest
- Default port
- 0
How Pangolin works
Pangolin, from the fosrl project, is an identity-aware reverse proxy with an optional WireGuard tunnel. The usual self-host install is Docker: the pangolin image, a Gerbil tunnel component, and Traefik for the edge. The quick-install guide asks for a Linux host with a public IP, a domain aimed at that address, and open TCP 80 and 443. Tunneling also wants UDP 51820 and UDP 21820. You can skip Gerbil and use Pangolin as a reverse proxy only.
The default database is SQLite, so this baseline does not add a separate database container. A PostgreSQL build exists for people who want that engine, using the postgresql image tag and a connection string. Cluster docs add Redis as well. Those extras are outside the single-node baseline described here. The public dashboard hostname is how operators sign in and attach sites.
Key Pangolin features
Operators add resources in the dashboard and choose whether clients reach them through the tunnel or through published HTTP routes. Gerbil holds the WireGuard side when tunneling is on. Traefik terminates the web edge in the documented compose layout. Anonymous telemetry can be turned off in config. Secrets in the server config are yours to set; the sample files ship with placeholders.
AvaHost wraps that stack with automatic updates and scheduled backups of the persistent config and data. You still review upstream notes when tunnel ports, image tags, or the dashboard URL change. A dedicated public IP is required on this package so the documented UDP listeners and the dashboard address stay on a stable endpoint.
Pangolin vs Cloudflare Tunnel
Pangolin
Pangolin is for people who want the tunnel exit and the proxy policy on hardware they rent, with the dashboard beside it. Cloudflare Tunnel may be preferable when the priority is that company's edge network, its account model, and not running the connector's public ports yourself.
Cloudflare Tunnel
They overlap as ways to publish a private app, and they differ in who operates the public hop. Read both docs against the path you actually need, including UDP if you turn tunneling on.
Who uses Pangolin
Homelab and small-team operators who are tired of opening every origin to the internet use Pangolin to publish selected apps. It also fits a plain reverse-proxy role when tunneling is disabled. It is the wrong package if you cannot accept a public IP and the UDP ports, or if you need the vendor-operated Cloudflare network specifically.
Self-hosting Pangolin: requirements and cost
The AvaHost baseline for Pangolin is 1024 MB of RAM and 1 CPU core, SQLite inside the app, image fosrl/pangolin. On AvaHost the recommended minimum for Pangolin is Plan 1 at €2. The package includes one-click deployment, a hostname for the dashboard, automated HTTPS on the web UI, automatic updates, and scheduled backups. This deployment requires a dedicated public IP so clients and tunnel peers can use a stable address. Application mail is not included with Pangolin. PostgreSQL and multi-node Redis are optional upstream layouts, not part of this minimum.
F.A.Q
Pangolin starts at €2 on Plan 1. The figure covers the single-node baseline with SQLite, not a PostgreSQL cluster and not Redis. Turning on extra nodes, a heavier tunnel load, or large access logs can call for more RAM than this minimum. Vendor accounts you attach inside the dashboard stay billable by those vendors.
Yes. Aim the dashboard hostname at the hosted instance and automated HTTPS covers the browser UI once DNS is in place. Tunnel mode still needs the public UDP ports from the fosrl guide, which are separate from the website certificate. You keep the DNS records and the list of published resources.
AvaHost updates the Pangolin deployment automatically and keeps its config and SQLite data attached, with backups on a schedule. Check upstream release notes when Gerbil, Traefik, or the dashboard path changes, and confirm a test resource still opens afterwards. Keep your own copy of any custom config you consider critical.
Yes. Pangolin on this package requires a dedicated public IP because the project documents a public address plus UDP 51820 and 21820 for tunneling. The address does not configure your apps for you: you still set authentication, resource rules, and who may open a tunnel. Reverse-proxy-only mode still uses that stable public endpoint.