diff --git a/docs.json b/docs.json index 81ee06c..0c92ecc 100644 --- a/docs.json +++ b/docs.json @@ -303,6 +303,14 @@ "self-host/manual/podman-quadlets" ] }, + { + "group": "Clustering", + "pages": [ + "self-host/clustering/understanding-clustering", + "self-host/clustering/requirements", + "self-host/clustering/deploy-a-cluster" + ] + }, "self-host/dns-and-networking", { "group": "Advanced Configuration", @@ -318,15 +326,6 @@ "self-host/advanced/observability", "self-host/advanced/enable-geolocation", "self-host/advanced/enable-asn-lookup", - { - "group": "Clustering", - "icon": "server", - "pages": [ - "self-host/advanced/clustering/understanding-clustering", - "self-host/advanced/clustering/requirements", - "self-host/advanced/clustering/deploy-a-cluster" - ] - }, "self-host/advanced/traefik-log-rotation", "self-host/telemetry" ] @@ -514,8 +513,7 @@ "redirects": [ { "source": "/self-host/advanced/clustering", - "destination": "/self-host/advanced/clustering/understanding-clustering", - "permanent": true + "destination": "/self-host/advanced/clustering/understanding-clustering" }, { "source": "/self-host/advanced/enable-geoblocking", diff --git a/images/ha-deployment-diagram.png b/images/ha-deployment-diagram.png new file mode 100644 index 0000000..a86dcb7 Binary files /dev/null and b/images/ha-deployment-diagram.png differ diff --git a/manage/remote-node/backhaul.mdx b/manage/remote-node/backhaul.mdx index f7cc1dd..d4aa7d8 100644 --- a/manage/remote-node/backhaul.mdx +++ b/manage/remote-node/backhaul.mdx @@ -1,9 +1,10 @@ --- -title: "Site to Cloud" -description: "Turn a remote node into a network concentrator that routes traffic between a cloud VPC and your Pangolin sites" +title: "Site to Cloud Backhaul" +description: "Turn a remote node into a network concentrator that routes traffic between a cloud VPC and your Pangolin sites for edge to cloud backhaul" --- + - Site to cloud is an advanced [remote node](/manage/remote-node/understanding-nodes) configuration available in [Pangolin Cloud](https://app.pangolin.net/auth/signup). + Site to cloud is an advanced [remote node](/manage/remote-node/understanding-nodes) configuration available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition). A standard remote node terminates WireGuard tunnels and proxies HTTP(S) traffic to your resources. A **backhaul** node goes a step further: it acts as an IP router between an entire network, such as a cloud VPC, and your Pangolin sites. Instead of just forwarding individual resource connections, the node forwards whole subnets, letting hosts on either side reach each other without needing to install site and client on every machine. diff --git a/manage/remote-node/quick-install-remote.mdx b/manage/remote-node/quick-install-remote.mdx index 78958ac..930ac5a 100644 --- a/manage/remote-node/quick-install-remote.mdx +++ b/manage/remote-node/quick-install-remote.mdx @@ -6,7 +6,7 @@ description: "Deploy your own remote Pangolin node in under 10 minutes with our Before you begin, ensure you have: -- **Pangolin Cloud** account. You can [create a free account here](https://app.pangolin.net/auth/signup). No subscription required. +- **Pangolin Cloud** account. You can [create a free account here](https://app.pangolin.net/auth/signup) OR a [clustered self-hosted Pangolin Enterprise deployment](/self-host/clustering/understanding-clustering). - **Linux server** with root access and public IP address. - **Open ports on firewall** for 80 (TCP), 443 (TCP), 51820 (UDP), and 21820 (UDP for clients). @@ -43,6 +43,14 @@ Before installing Pangolin, ensure you've opened the required port on your firew ``` The installer places all files in the current directory. Move the installer to your desired installation directory before running it. + + + If you're not using Pangolin Cloud (`app.pangolin.net`) and instead have a self-hosted Pangolin Enterprise deployment, pass its URL with the `--pangolin-endpoint` flag so the installer requests node credentials from your instance instead: + + ```bash + sudo ./installer --pangolin-endpoint https://pangolin.example.com + ``` + @@ -64,7 +72,7 @@ If you don't have them yet you can just select no when asked and we will create - If you choose to use a domain keep in mind this just resolves your node on the internet while the actual subdomains for resources will be managed in the cloud. + If you choose to use a domain keep in mind this just resolves your node on the internet while the actual subdomains for resources will be managed in the server. @@ -79,7 +87,7 @@ Your managed credentials have been obtained successfully. Secret: n7sd18twfko0q0vrb7wyclqzbvvnx1fqt7ezv8xewhdb9s7d ``` -Go to the [Pangolin dashboard](https://app.pangolin.net/) and log in. Navigate to the "Self-hosted" section and add a new node. Select the adopt method. Use this ID and secret to register your node. +Go to the [Pangolin dashboard](https://app.pangolin.net/) (or your own panel's URL if you passed `--pangolin-endpoint`) and log in. Navigate to the "Self-hosted" section and add a new node. Select the adopt method. Use this ID and secret to register your node. More than one account can use the same node credentials. This is useful for teams. @@ -97,6 +105,4 @@ Once installation completes successfully, you'll see: Installation complete! ``` -Navigate to the [Pangolin dashboard](https://app.pangolin.net/) and create sites, resources, and targets for your remote node. - -{/* ## Video Walkthrough */} +Navigate to the [Pangolin dashboard](https://app.pangolin.net/) (or your own dashboard if self-hosted) and create sites, resources, and targets for your remote node. \ No newline at end of file diff --git a/manage/remote-node/understanding-nodes.mdx b/manage/remote-node/understanding-nodes.mdx index 9e15bd0..e9f0e11 100644 --- a/manage/remote-node/understanding-nodes.mdx +++ b/manage/remote-node/understanding-nodes.mdx @@ -3,7 +3,9 @@ title: "Remote Nodes" description: "Control your own Pangolin node with cloud management" --- - Remote Nodes are available in [Pangolin Cloud](https://app.pangolin.net/auth/signup). + Remote nodes are only available in [Pangolin + Cloud](https://app.pangolin.net/auth/signup) and [Enterprise + Edition](/self-host/enterprise-edition). Remote nodes, you run your own Pangolin node - your tunnels, SSL termination, and traffic all stay on your server and use your bandwidth. The difference is that management and monitoring are handled through our cloud. The node just handles terminating Wireguard tunnels, serving HTTP(S) traffic, and routing relayed client connections - it is essentially a remote networking hub. diff --git a/self-host/advanced/clustering/deploy-a-cluster.mdx b/self-host/clustering/deploy-a-cluster.mdx similarity index 99% rename from self-host/advanced/clustering/deploy-a-cluster.mdx rename to self-host/clustering/deploy-a-cluster.mdx index 52f39f8..5a7407e 100644 --- a/self-host/advanced/clustering/deploy-a-cluster.mdx +++ b/self-host/clustering/deploy-a-cluster.mdx @@ -31,9 +31,7 @@ Throughout this guide, replace the following placeholders with your own values: | `LOAD_BALANCER_IP` | IP address of the load balancer in front of the cluster | | `pangolin.example.com` | Your dashboard domain - DNS points at the load balancer, not at either node | - You need a domain for the Pangolin UI and API (`pangolin.example.com` in this guide), pointed at your load balancer. **The load balancer is responsible for TLS on this domain** - terminate HTTPS there and forward plain HTTP to the nodes' dashboard port. The nodes' built-in ACME client only issues certificates for resource domains under the delegated nameserver zone, not for the dashboard domain itself. See [Requirements](/self-host/advanced/clustering/requirements#dashboard-domain). - diff --git a/self-host/advanced/clustering/requirements.mdx b/self-host/clustering/requirements.mdx similarity index 99% rename from self-host/advanced/clustering/requirements.mdx rename to self-host/clustering/requirements.mdx index a27f8e7..ba3cfee 100644 --- a/self-host/advanced/clustering/requirements.mdx +++ b/self-host/clustering/requirements.mdx @@ -35,11 +35,9 @@ For sizing information, see [Choosing a VPS](/self-host/choosing-a-vps) - the sa You also need a domain for the Pangolin UI and API itself (e.g. `pangolin.example.com`) - this is separate from the nameserver domain above, which is the nameserver to resolve resource DNS. - Point this domain's DNS record at your **load balancer**, not at either node directly. The load balancer is also responsible for obtaining and serving the TLS certificate for this domain - the nodes' built-in ACME client only issues certificates for resource domains under the delegated nameserver zone, not for the dashboard domain. Terminate TLS at the load balancer and forward plain HTTP to the nodes. You must also set this domain as `app.dashboard_url` and add it to `server.cors.origins` in every node's `config.yml`. See [Deploy a Cluster](/self-host/advanced/clustering/deploy-a-cluster). - ### Required Ports diff --git a/self-host/advanced/clustering/understanding-clustering.mdx b/self-host/clustering/understanding-clustering.mdx similarity index 90% rename from self-host/advanced/clustering/understanding-clustering.mdx rename to self-host/clustering/understanding-clustering.mdx index 71138fc..a9a16f6 100644 --- a/self-host/advanced/clustering/understanding-clustering.mdx +++ b/self-host/clustering/understanding-clustering.mdx @@ -15,44 +15,12 @@ In a clustered configuration, multiple Pangolin instances operate together, shar A Pangolin cluster consists of several coordinated components that work together to provide high availability and seamless failover. -```mermaid -flowchart TB - Users(["Users / Browsers"]) - Sites(["Site Connectors (Newt)"]) - - LB["Load Balancer
(your own)
TCP 80 · 443 · 3000 · UDP 53"] - - subgraph Node1["Node 1"] - direction TB - G1["Gerbil
WireGuard + SNI proxy"] - T1["Traefik
TLS termination"] - P1["Pangolin
UI · API · DNS · ACME client"] - G1 --- T1 --- P1 - end - - subgraph Node2["Node 2"] - direction TB - G2["Gerbil
WireGuard + SNI proxy"] - T2["Traefik
TLS termination"] - P2["Pangolin
UI · API · DNS"] - G2 --- T2 --- P2 - end - - PG[("PostgreSQL
shared state + certs")] - RD[("Valkey / Redis
pub/sub + sessions")] - - Users --> LB - LB --> G1 - LB --> G2 - Sites -. WireGuard tunnel .-> G1 - Sites -. WireGuard tunnel .-> G2 - G1 <-. cross-node request routing .-> G2 - - P1 <--> PG - P2 <--> PG - P1 <--> RD - P2 <--> RD -``` + + Diagram showing the cluster deployment + ### Pangolin Instances