diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..b39546b
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,5 @@
+{
+ "cSpell.words": [
+ "nessicary"
+ ]
+}
\ No newline at end of file
diff --git a/self-host/advanced/config-file.mdx b/self-host/advanced/config-file.mdx
index 675c4ca..9c2aead 100644
--- a/self-host/advanced/config-file.mdx
+++ b/self-host/advanced/config-file.mdx
@@ -166,6 +166,14 @@ This section contains the complete reference for all configuration options in `c
**Example**: `3003`
+
+ The port for the AI Gateway service.
+
+ **Example**: `3005`
+
+ **Default**: `3005`
+
+
The hostname of the Pangolin container for internal communication.
@@ -210,12 +218,52 @@ This section contains the complete reference for all configuration options in `c
+
+ Names of the HTTP headers Badger injects into proxied requests to identify an authenticated user or virtual API key. Also used by the AI Gateway to attach the identified user to a request once it has passed Badger's session/key verification.
+
+
+
+ Header name for the authenticated user's ID.
+
+ **Default**: `Remote-User-Id`
+
+
+
+ Header name for the virtual API key ID.
+
+ **Default**: `Remote-Virtual-Api-Key-Id`
+
+
+
+ Header name for the authenticated username.
+
+ **Default**: `Remote-User`
+
+
+
+ Header name for the authenticated user's email.
+
+ **Default**: `Remote-Email`
+
+
+
+ Header name for the authenticated user's display name.
+
+ **Default**: `Remote-Name`
+
+
+
+ Header name for the authenticated user's role.
+
+ **Default**: `Remote-Role`
+
+
+
+
Query parameter for session request tokens.
- **Example**: `p_session_request`
-
- **Default**: `p_session_request`
+ **Default**: `resource_session_request_param`
@@ -260,6 +308,18 @@ This section contains the complete reference for all configuration options in `c
+
+ Whether to have Badger stamp the resolved client IP into a dedicated `X-Pangolin-Client-Ip` header on the site-resource AI Gateway route.
+
+ **Default**: `false`
+
+ **Environment Variable**: `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER`
+
+
+ Useful when an intermediary proxy sits between Traefik and the AI Gateway and overwrites `X-Forwarded-For`/`X-Real-Ip` instead of appending to them. Requires a Badger version that supports `realIpHeader`.
+
+
+
Dashboard session duration in hours.
@@ -302,6 +362,16 @@ This section contains the complete reference for all configuration options in `c
Used for IP geolocation functionality. Requires a MaxMind GeoLite2 or GeoIP2 database file.
+
+
+ Path to the MaxMind ASN database file for ASN lookups.
+
+ **Example**: `./config/GeoLite2-ASN.mmdb`
+
+
+ Sibling setting to `maxmind_db_path`. Used to resolve the ASN for an IP address.
+
+
@@ -329,13 +399,13 @@ This section contains the complete reference for all configuration options in `c
**Example**: `example.com`
-
+
The Traefik certificate resolver name.
**Example**: `letsencrypt`
- This must match the certificate resolver name in your Traefik configuration.
+ This must match the certificate resolver name in your Traefik configuration. If omitted, falls back to `traefik.cert_resolver`.
@@ -449,6 +519,16 @@ This section contains the complete reference for all configuration options in `c
**Default**: `["newt", "wireguard", "local"]`
+
+ Whether Traefik generates routes for raw TCP/UDP (non-HTTP) resources.
+
+ **Default**: `true`
+
+
+ This gates Traefik's config generation and is distinct from `flags.allow_raw_resources`, which gates the API from accepting new raw resources.
+
+
+
Whether to use file-based configuration mode for Traefik.
@@ -468,6 +548,24 @@ This section contains the complete reference for all configuration options in `c
**Default**: `pp-transport-v`
+
+
+ Rate limit settings for the browser gateway Traefik middleware.
+
+
+
+ Average number of requests per second allowed.
+
+ **Default**: `30`
+
+
+
+ Maximum burst size allowed above the average rate.
+
+ **Default**: `50`
+
+
+
@@ -483,6 +581,14 @@ This section contains the complete reference for all configuration options in `c
**Example**: `pangolin.example.com`
+
+ Name of the exit node record that identifies this server's own Gerbil exit node.
+
+
+ Used to look up (or create, if missing) this instance's exit node in the database. Useful when running multiple exit nodes so this server can find its own.
+
+
+
Starting port for WireGuard tunnels.
@@ -590,13 +696,13 @@ This section contains the complete reference for all configuration options in `c
Time window for rate limiting in minutes.
- **Example**: `1`
+ **Default**: `1`
Maximum number of requests allowed in the time window.
- **Example**: `100`
+ **Default**: `500`
@@ -795,6 +901,12 @@ This section contains the complete reference for all configuration options in `c
When enabled, Enterprise-only features are hidden from the UI.
+
+
+ When set to true Pangolin will not generate publicly facing placeholder pages for private HTTP resources. This can impact the ability for Pangolin to generate nessicary certificates.
+
+ **Default**: `false`
+
@@ -861,6 +973,78 @@ This section contains the complete reference for all configuration options in `c
**Example**: `10000`
+
+
+ Whether to allow Postgres query JIT compilation on pooled connections.
+
+ **Default**: `true`
+
+
+ Set to `false` when connecting through a pooler (e.g. PgBouncer) that rejects the JIT startup option. When disabled, `SET jit = off` is run on each new connection.
+
+
+
+
+
+
+
+### Logs Database
+
+
+ Configuration for an optional, separate PostgreSQL database dedicated to logs, kept apart from the main application database.
+
+
+
+ Connection string for the dedicated logs database.
+
+ **Environment Variable**: `POSTGRES_LOGS_CONNECTION_STRING`
+
+ **Example**: `postgresql://user:password@host:port/logs_database`
+
+
+ If not set, logging falls back to the main `postgres` database.
+
+
+
+
+ Read-only replica configurations for the logs database.
+
+
+
+ Connection string for the read replica logs database.
+
+ **Example**: `postgresql://user:password@replica-host:port/logs_database`
+
+
+
+
+
+ Connection pool settings for the logs database. Falls back to `postgres.pool` values when omitted.
+
+
+
+ Maximum number of connections to the primary logs database.
+
+ **Default**: `20`
+
+
+
+ Maximum number of connections to logs replica databases.
+
+ **Default**: `10`
+
+
+
+ Time in milliseconds before idle connections are closed.
+
+ **Default**: `30000` (30 seconds)
+
+
+
+ Time in milliseconds to wait for a database connection.
+
+ **Default**: `5000` (5 seconds)
+
@@ -984,4 +1168,5 @@ Some configuration values can be set using environment variables for enhanced se
| PostgreSQL Connection String | `POSTGRES_CONNECTION_STRING` | `postgres.connection_string` |
| PostgreSQL Replica Connection Strings | `POSTGRES_REPLICA_CONNECTION_STRINGS` | `postgres.replicas` (comma-separated list of connection strings) |
| PostgreSQL Logs Connection String | `POSTGRES_LOGS_CONNECTION_STRING` | `postgres_logs.connection_string` |
-| Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency |
\ No newline at end of file
+| Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency |
+| Enable AI Gateway Client IP Header | `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` | `server.enable_ai_gateway_client_ip_header` |
\ No newline at end of file
diff --git a/self-host/manual/kubernetes/pangolin/configuration.mdx b/self-host/manual/kubernetes/pangolin/configuration.mdx
index cefcbd3..4be0274 100644
--- a/self-host/manual/kubernetes/pangolin/configuration.mdx
+++ b/self-host/manual/kubernetes/pangolin/configuration.mdx
@@ -279,7 +279,6 @@ pangolin:
start_port: 51820
clients_start_port: 21820
base_endpoint: "pangolin.example.com"
- use_subdomain: false
traefik:
enabled: true
http_entrypoint: web