mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-10-24 13:39:06 +02:00
1.19 docs updates
This commit is contained in:
miloschwartz
@@ -11,6 +11,8 @@ import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
Though public resources are public and accessible to via a web browser, admins can create rules to enable a layer of authenticated protection in front of public resources. By default, all public resources have Pangolin auth (Platform SSO) enabled, but a number of other authentication methods are available.
|
||||
|
||||
You can configure these settings directly on each resource or share them across multiple resources with a [resource policy](/manage/resources/public/resource-policies). A resource either uses an inline policy (no shared policy attached) or inherits a shared policy and can add resource-specific overrides on top.
|
||||
|
||||
When an unauthenticated user visits a resource in their web browser, they will be redirected to a Pangolin-controlled authentication page where they must complete authentication.
|
||||
|
||||
## User Login
|
||||
@@ -39,4 +41,4 @@ Define ranked rules to either block or allow access from specific IPs, geolocati
|
||||
|
||||
## More
|
||||
|
||||
Read about more authentication options and specific settings in [Access Control](/manage/access-control/) and [Identity Providers](/manage/identity-providers/).
|
||||
Read about more authentication options and specific settings in [Access Control](/manage/access-control/) and [Identity Providers](/manage/identity-providers/). To reuse the same authentication and access rule settings across many public resources, see [Resource Policies](/manage/resources/public/resource-policies).
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
---
|
||||
title: "HTTP / HTTPS"
|
||||
description: "Publish websites, APIs, and dashboards as authenticated public reverse proxies"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
HTTP and HTTPS public resources are the most common public resource type. They expose a web application or API on a fully qualified domain name with a valid TLS certificate, fronted by Pangolin's authenticated reverse proxy.
|
||||
|
||||
Users open the resource URL in any web browser. No Pangolin client is required.
|
||||
|
||||
## How It Works
|
||||
|
||||
1. You assign a FQDN on a domain managed in Pangolin.
|
||||
2. Pangolin terminates TLS and applies [authentication and access rules](/manage/resources/public/authentication).
|
||||
3. Authenticated requests are proxied through a site connector to your backend target.
|
||||
|
||||
Pangolin acts as a front-door barrier: unauthenticated visitors are redirected to a Pangolin login page before traffic reaches your application.
|
||||
|
||||
## Target Configuration
|
||||
|
||||
HTTP/HTTPS resources use **[targets](/manage/resources/public/targets)** to define where traffic is sent on your remote network.
|
||||
|
||||
- Add one or more targets, each with an upstream address and port.
|
||||
- Assign each target to a site. Targets on different sites enable [round-robin load balancing](/manage/resources/public/targets#multi-site-targets) and [automatic failover](/manage/resources/public/healthchecks-failover).
|
||||
- Optionally configure path-based routing, path rewriting, custom host headers, and other proxy settings.
|
||||
|
||||
This multi-target model differs from SSH, RDP, and VNC public resources, which use site selection and a single host/port instead of discrete targets.
|
||||
|
||||
## Authentication and Access Rules
|
||||
|
||||
HTTP/HTTPS resources are protocol-aware and fully support Pangolin's identity and context policies:
|
||||
|
||||
- Platform SSO and external identity providers
|
||||
- User, role, and machine access assignments
|
||||
- PIN, passcode, shareable links, and email OTP
|
||||
- Ranked allow/deny rules for IP, geolocation, URL paths, and more
|
||||
|
||||
See [Authentication](/manage/resources/public/authentication) for the full list of options. To share the same settings across multiple resources, use a [resource policy](/manage/resources/public/resource-policies).
|
||||
@@ -1,13 +1,26 @@
|
||||
---
|
||||
title: "TCP & UDP"
|
||||
description: "Configure raw TCP and UDP traffic through Pangolin tunnels"
|
||||
title: "TCP / UDP"
|
||||
description: "Expose raw TCP and UDP services on a Pangolin server port without authentication"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
TCP and UDP public resources are protocol-agnostic proxies. Unlike HTTP/HTTPS, SSH, RDP, and VNC, they do **not** receive a fully qualified domain name or TLS certificate. Instead, each resource binds to a port on the Pangolin server host. Clients connect to `<pangolin-server>:<port>` and traffic is forwarded to the downstream service through a site connector.
|
||||
|
||||
Because TCP and UDP resources are not protocol-aware, they do **not** enforce Pangolin authentication or access rules. They are simple pipes—use them only when you need a raw public proxy and accept that traffic is unauthenticated at the Pangolin layer.
|
||||
|
||||
For workloads that do not need a public proxy, prefer a [private host or CIDR resource](/manage/resources/understanding-resources#private-resource-types) so traffic stays on the zero-trust tunnel with full access control.
|
||||
|
||||
## Target Configuration
|
||||
|
||||
TCP and UDP resources use **[targets](/manage/resources/public/targets)** like HTTP/HTTPS resources:
|
||||
|
||||
- Add one or more targets with an upstream address and port.
|
||||
- Assign targets to different sites for round-robin routing and failover.
|
||||
|
||||
## Self-Hosted Setup
|
||||
|
||||
<Note>
|
||||
This feature is only available in self-hosted Pangolin instances. If you're using Pangolin Cloud, you will need to deploy a remote node.
|
||||
@@ -15,7 +28,7 @@ This feature is only available in self-hosted Pangolin instances. If you're usin
|
||||
|
||||
Pangolin supports raw TCP and UDP traffic because Newt can pass anything through the tunnel.
|
||||
|
||||
In Pangolin Community Edition, ensure you have the flag enabled in the config file:
|
||||
In Community Edition or Enterprise Edition, ensure you have the flag enabled in the config file:
|
||||
|
||||
```
|
||||
flags:
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
title: "RDP"
|
||||
description: "Control a Windows computer remotely through a full RDP client rendered in the browser"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
<Note>
|
||||
Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition).
|
||||
</Note>
|
||||
|
||||
RDP public resources render a full Remote Desktop Protocol client in the browser. Users visit a FQDN, complete Pangolin authentication, and get an interactive Windows desktop session—including file transfers, clipboard copy/paste, and standard RDP features—without installing remote desktop software.
|
||||
|
||||
## How It Works
|
||||
|
||||
1. You assign a FQDN on a domain managed in Pangolin.
|
||||
2. The user completes [authentication and access rules](/manage/resources/public/authentication) in the browser.
|
||||
3. Pangolin renders the RDP session and proxies traffic to the Windows host through a site connector.
|
||||
|
||||
No Pangolin client is required. Any modern web browser is sufficient.
|
||||
|
||||
## Site and Host Configuration
|
||||
|
||||
RDP public resources do **not** use [targets](/manage/resources/public/targets). Instead, you:
|
||||
|
||||
1. Select which sites can route to the resource.
|
||||
2. Enter the backend Windows host and RDP port (default `3389`).
|
||||
|
||||
Pangolin routes through the site that is online and healthiest, using the same intelligent multi-site routing model as [private resources](/manage/resources/private/multi-site-routing).
|
||||
|
||||
## Authentication and Access Rules
|
||||
|
||||
RDP public resources are protocol-aware and support the full set of Pangolin [authentication and access rules](/manage/resources/public/authentication), including platform SSO, identity providers, user/role assignments, and context-based allow/deny rules. You can share these settings across resources with a [resource policy](/manage/resources/public/resource-policies).
|
||||
|
||||
RDP session credentials (Windows username and password) are entered in the browser-rendered client after Pangolin authentication succeeds.
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
title: "Resource Policies"
|
||||
description: "Share authentication and access rule settings across multiple public resources"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
<Note>
|
||||
Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition).
|
||||
</Note>
|
||||
|
||||
Resource policies let you define authentication and access rule settings once and apply them to multiple public resources. Instead of configuring the same PIN code, user assignments, or geo-blocking rules on every resource individually, you attach a shared policy and every linked resource inherits those settings.
|
||||
|
||||
<Note>
|
||||
Resource policies currently apply to **public resources** only. Support for private resources is coming soon.
|
||||
</Note>
|
||||
|
||||
## What a Resource Policy Contains
|
||||
|
||||
A resource policy holds the same settings you configure on a public resource's authentication and access tabs:
|
||||
|
||||
**Authentication**
|
||||
|
||||
- Platform SSO and external identity providers
|
||||
- PIN and passcode
|
||||
- User and role assignments
|
||||
- Shareable links, access tokens, and email OTP
|
||||
|
||||
**Access rules**
|
||||
|
||||
- Ranked allow, deny, and pass-to-auth rules
|
||||
- IP and CIDR matching
|
||||
- [Geo-blocking](/manage/geoblocking) and [ASN blocking](/manage/asnblocking)
|
||||
- URL path and other context-based conditions
|
||||
|
||||
See [Authentication](/manage/resources/public/authentication) for a full overview of these options.
|
||||
|
||||
## Shared Policies vs. Inline Policies
|
||||
|
||||
Each public resource uses one of two modes:
|
||||
|
||||
| Mode | Description |
|
||||
| --- | --- |
|
||||
| **Shared policy** | The resource inherits settings from a resource policy. Multiple resources can reference the same policy. |
|
||||
| **None (inline policy)** | The resource keeps its own settings with no shared policy attached. The policy applies only to that resource. |
|
||||
|
||||
Choose **None** when a resource needs a one-off configuration. Choose a shared policy when several resources should enforce the same baseline—for example, a standard login requirement and geo-blocking rules across every app in a team.
|
||||
|
||||
## Additive Policies
|
||||
|
||||
Shared policies are **additive**. A resource policy provides the base layer, and the resource itself can add settings on top.
|
||||
|
||||
For example:
|
||||
|
||||
1. A shared policy **denies** all countries.
|
||||
2. You attach that policy to a public HTTP resource.
|
||||
3. On the resource, you add an additional **allow** rule for a specific country.
|
||||
|
||||
The resource-specific rule sits on top of the shared policy, so visitors from that country can pass through while everyone else remains blocked. The same pattern works for users, roles, IP allow lists, and other rule types.
|
||||
|
||||
Use additive policies when most resources share a common baseline but individual resources need small exceptions.
|
||||
|
||||
## Create a Resource Policy
|
||||
|
||||
1. In the Pangolin dashboard, open the **Shared Policies** section for your organization.
|
||||
2. Start the policy wizard to define authentication and access rule settings.
|
||||
3. Save the policy with a descriptive name.
|
||||
|
||||
You can edit a shared policy at any time from this section. Changes apply to every public resource that references the policy.
|
||||
|
||||
## Apply a Policy to a Resource
|
||||
|
||||
1. Open the public resource in the dashboard.
|
||||
2. Go to the **General** tab.
|
||||
3. Under **Shared Policy**, select the policy you want to attach—or choose **None** for an inline-only policy.
|
||||
|
||||
Once a shared policy is attached, the resource inherits its settings immediately.
|
||||
|
||||
## Editing Settings on a Resource with a Shared Policy
|
||||
|
||||
When a shared policy is applied, settings defined on the shared policy are **read-only** on the resource. They appear grayed out or disabled, sometimes with a lock icon. You cannot change those values from the resource—you must edit the shared policy directly.
|
||||
|
||||
You can still add settings on the resource that layer on top of the shared policy:
|
||||
|
||||
- **Authentication** — add additional users and roles beyond what the shared policy grants
|
||||
- **Access rules** — add additional allow, deny, or pass-to-auth rules
|
||||
|
||||
These resource-specific additions are additive. They combine with the shared policy rather than replacing it, as described in [Additive Policies](#additive-policies).
|
||||
|
||||
<Tip>
|
||||
If a setting on a resource looks locked, open the linked shared policy to change it. To make the resource fully self-contained again, set **Shared Policy** to **None** on the General tab.
|
||||
</Tip>
|
||||
@@ -0,0 +1,55 @@
|
||||
---
|
||||
title: "SSH"
|
||||
description: "Access a remote shell in the browser with password, key, or Pangolin identity authentication"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
<Note>
|
||||
Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition).
|
||||
</Note>
|
||||
|
||||
SSH public resources render a full interactive terminal in the browser. Users visit a FQDN—no SSH client or Pangolin desktop client is required.
|
||||
|
||||
## How It Works
|
||||
|
||||
1. You assign a FQDN on a domain managed in Pangolin.
|
||||
2. The user completes [public resource authentication](/manage/resources/public/authentication) in the browser (platform SSO, identity providers, access rules, and so on).
|
||||
3. Depending on the SSH [configuration](/manage/ssh#configuration-options) you chose, the user may be prompted for a second credential step or proceed directly into the terminal.
|
||||
4. Pangolin renders the session and proxies traffic to the backend through a site connector.
|
||||
|
||||
## Site and Host Configuration
|
||||
|
||||
SSH public resources do **not** use [targets](/manage/resources/public/targets). Instead, you:
|
||||
|
||||
1. Select which sites can route to the resource.
|
||||
2. Enter the backend host and port—unless you selected **Pangolin SSH** mode, which executes sessions on the site connector host and does not require a host or port.
|
||||
|
||||
<Warning>
|
||||
**Pangolin SSH mode requires root.** Newt must run as root on the site connector host. Use `sudo newt ...` or run the Newt systemd service as root. See [Install a site](/manage/sites/install-site).
|
||||
</Warning>
|
||||
|
||||
Pangolin routes through the site that is online and healthiest, using the same intelligent multi-site routing model as [private resources](/manage/resources/private/multi-site-routing).
|
||||
|
||||
## SSH Configuration
|
||||
|
||||
The SSH settings on a public resource use the same options as [private SSH resources](/manage/resources/private/ssh). Mode, authentication method, and auth daemon location are configured identically in the dashboard.
|
||||
|
||||
See [SSH Access](/manage/ssh) for a full explanation of each option, setup instructions, and an example for every configuration combination.
|
||||
|
||||
## How Public SSH Differs from Private SSH
|
||||
|
||||
| | Public SSH | [Private SSH](/manage/resources/private/ssh) |
|
||||
|---|------------|----------------------------------------------|
|
||||
| **Access** | Web browser at a public FQDN | Pangolin CLI: `pangolin ssh <alias>` |
|
||||
| **Client required** | No | Yes — user must be connected with the Pangolin client |
|
||||
| **First auth layer** | [Public resource authentication](/manage/resources/public/authentication) — login page, SSO, access rules | Identity from the active client connection; [private resource access rules](/manage/resources/private/authentication) |
|
||||
| **Hostname** | Public FQDN on your Pangolin domain | [Alias](/manage/resources/private/alias) on the private resource |
|
||||
|
||||
## Authentication and Access Rules
|
||||
|
||||
SSH public resources are protocol-aware and support the full set of Pangolin [authentication and access rules](/manage/resources/public/authentication). These rules gate who can reach the resource URL in the first place—before any SSH session or host credential prompt begins.
|
||||
|
||||
You can configure these settings inline on the resource or attach a shared [resource policy](/manage/resources/public/resource-policies) and add resource-specific overrides on top.
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
title: "VNC"
|
||||
description: "View and control a remote display through a VNC client rendered in the browser"
|
||||
---
|
||||
|
||||
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
||||
|
||||
<PangolinCloudTocCta />
|
||||
|
||||
<Note>
|
||||
Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition).
|
||||
</Note>
|
||||
|
||||
VNC public resources render a full VNC client in the browser. Users visit a FQDN, complete Pangolin authentication, and get an interactive remote display session without installing a VNC viewer.
|
||||
|
||||
## How It Works
|
||||
|
||||
1. You assign a FQDN on a domain managed in Pangolin.
|
||||
2. The user completes [authentication and access rules](/manage/resources/public/authentication) in the browser.
|
||||
3. Pangolin renders the VNC session and proxies traffic to the VNC server through a site connector.
|
||||
|
||||
No Pangolin client is required.
|
||||
|
||||
## Site and Host Configuration
|
||||
|
||||
VNC public resources do **not** use [targets](/manage/resources/public/targets). Instead, you:
|
||||
|
||||
1. Select which sites can route to the resource.
|
||||
2. Enter the backend VNC server host and port (commonly `5900` or `5900 + display number`).
|
||||
|
||||
Pangolin routes through the site that is online and healthiest, using the same intelligent multi-site routing model as [private resources](/manage/resources/private/multi-site-routing).
|
||||
|
||||
## Authentication and Access Rules
|
||||
|
||||
VNC public resources are protocol-aware and support the full set of Pangolin [authentication and access rules](/manage/resources/public/authentication), including platform SSO, identity providers, user/role assignments, and context-based allow/deny rules. You can share these settings across resources with a [resource policy](/manage/resources/public/resource-policies).
|
||||
|
||||
VNC session credentials (if configured on the VNC server) are entered in the browser-rendered client after Pangolin authentication succeeds.
|
||||
@@ -13,7 +13,7 @@ Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [En
|
||||
|
||||
With a wildcard public resource, one resource owns an entire subdomain level: every hostname under that level is proxied through the same Pangolin resource and tunnel so downstream systems can route further (for example another reverse proxy or Kubernetes ingress).
|
||||
|
||||
Access rules and authentication you set on that resource apply to all hostnames matched by the wildcard. If you enable a PIN code, every hostname under the wildcard requires that PIN.
|
||||
Access rules and authentication you set on that resource apply to all hostnames matched by the wildcard. If you enable a PIN code, every hostname under the wildcard requires that PIN. You can also attach a [resource policy](/manage/resources/public/resource-policies) so the same shared settings apply to the wildcard and any other linked public resources.
|
||||
|
||||
## Creating a Wildcard Resource
|
||||
|
||||
|
||||
Reference in New Issue
Block a user