deploy test

about/how-pangolin-works.mdx

@@ -0,0 +1,52 @@
+---
+title: "How Pangolin Works"
+---
+
+## Architecture
+
+Pangolin is an open-source system composed of several interconnected components that work together to provide secure, application-specific access. The central server, often referred to as the point of presence, is the core of the system. In self-hosted deployments, the point of presence typically includes Pangolin, Gerbil, and Traefik with its custom plugin, Badger.
+
+A site represents a connection to an edge network. Pangolin can manage multiple edge networks simultaneously through its lightweight site client, Newt, which facilitates secure communication between the point of presence and the edge networks.
+
+## System Diagram
+
+<Card img="/images/system-diagram.svg">
+</Card>
+
+## Components
+
+### Pangolin
+
+Pangolin serves as the main control plane and orchestrates the system. It includes:
+- An external-facing REST API for user interactions.
+- A WebSocket server for managing connections to Newt clients.
+- An internal REST API for communication between system components.
+- A frontend server for the web interface.
+- Integration with the main database for data storage.
+- A built-in authentication system for Zero Trust Network Access (ZTNA).
+
+### Gerbil
+
+Gerbil is responsible for managing WireGuard tunnels. It acts as a peer management server, creating and maintaining secure, encrypted tunnels between edge networks (sites) and the point of presence.
+
+### Newt
+
+Newt is a lightweight, user-space client designed to run on edge networks. It:
+
+- Searches for the closest point of presence for optimal connectivity.
+- Connects to the Pangolin server via WebSocket and to Gerbil using a fully user-space WireGuard implementation.
+- Facilitates access to other resources on the edge network by creating TCP/UDP proxies.
+
+### Traefik
+
+Traefik is a high-performance, modular reverse proxy that routes requests to backend resources. It handles middleware, SSL termination, and provides extensibility through its plugin system. Key features include:
+
+- Badger: A custom authentication middleware plugin.
+- Compatibility with security plugins like GeoBlock and CrowdSec for enhanced protection.
+
+### Badger
+
+Badger is Pangolin’s custom Traefik middleware plugin that enforces authentication. It:
+
+- Intercepts incoming requests to the Traefik reverse proxy.
+- Redirects unauthenticated requests to the Pangolin server for authentication, ensuring secure access to backend resources.

about/pangolin-vs-traditional-reverse-proxy.mdx

@@ -0,0 +1,56 @@
+---
+title: "Pangolin vs. Reverse Proxy"
+---
+
+Pangolin shares many similarities with traditional reverse proxies, as it builds upon the same foundational principles. In fact, Pangolin leverages Traefik, one of the most popular reverse proxies, as its core component.
+
+Like a traditional reverse proxy, Pangolin acts as an intermediary between clients and backend servers. Requests are routed through Pangolin, which determines the appropriate backend server to handle the request. This ensures that clients never directly communicate with backend servers. Pangolin also handles key reverse proxy functionalities, including:
+
+- **Routing**: Directing traffic to the appropriate backend service.
+- **SSL Termination**: Managing HTTPS encryption and decryption.
+- **Logging**: Capturing and storing request/response data.
+- **Middleware Management**: Supporting plugins and middleware for additional functionality.
+
+## Key Differences
+
+### Tunneling
+
+Traditional reverse proxies typically operate on the same network as the backend servers they connect to. This setup requires:
+
+- A public IP address for the network.
+- Open ports (e.g., TCP 443 and 80) to allow external traffic.
+
+Pangolin eliminates these requirements by introducing tunneling, which allows it to operate on a completely separate server and network from the backend services. Key benefits of Pangolin's tunneling include:
+
+- **Centralized Management**: Multiple isolated edge networks can connect to a single Pangolin instance, meaning you only need to manage one reverse proxy server.
+- **Encrypted Traffic**: All traffic between the edge network and the central Pangolin server is fully encrypted.
+- **No Public IP or Open Ports**: Edge networks do not require a public IP address or open ports, reducing the attack surface and simplifying network configurations.
+
+This tunneling capability makes Pangolin particularly useful for environments with restrictive network policies, such as those behind Carrier-Grade NAT (CGNAT) or firewalls.
+
+### Identity-Aware Proxy (IAP)
+
+Pangolin incorporates Identity-Aware Proxy (IAP) functionality, enabling zero-trust access to backend services. Unlike traditional reverse proxies, which often rely on network-based trust, Pangolin evaluates every access request based on user identity, device, location, and other contextual factors.
+
+#### How IAP Works
+
+1. **User Request**: A user attempts to access a protected internal web app, API, or resource.
+2. **Request Interception**: The request is intercepted by Pangolin's IAP instead of being routed directly to the backend.
+3. **Authentication & Authorization**: Pangolin verifies the user’s identity using OAuth2/OpenID (e.g., Google, Azure AD, Okta).
+4. **Context-Aware Checks**: Additional conditions, such as IP address, group membership, or geographic location, are evaluated.
+5. **Access Decision**: If all checks are passed, the request is forwarded to the backend service; otherwise, access is denied.
+
+#### Access Control Features
+
+Pangolin provides a robust suite of access control mechanisms, including but not limited to: 
+
+- **User and Role-Based Access Control (RBAC)**: Define granular permissions for users and roles.
+- **Resource-Specific Security**:
+  - PIN codes and passwords for individual resources.
+  - Shareable links with expiration dates.
+- **Authentication Options**:
+  - Email-based One-Time Passwords (OTP).
+  - Single Sign-On (SSO) with external identity providers via OIDC.
+  - Two-Factor Authentication (2FA) and passkeys.
+- **Contextual Rules**:
+  - IP, CIDR, and path-based access rules.

about/pangolin-vs-vpn.mdx

@@ -0,0 +1,28 @@
+---
+title: "Pangolin vs. VPN"
+---
+
+Pangolin and VPNs both provide secure remote access, but they differ in functionality and use cases. VPNs grant full network-level access, requiring client-side software to connect, while Pangolin provides application-specific access directly through a web browser with authentication, eliminating the need for additional software on the user’s device.
+
+## Key Differences
+
+### Access Scope
+
+  - **Pangolin**: Exposes specific applications or services securely. Users access resources via a browser, ensuring no full network access is granted.
+  - **VPN**: Provides unrestricted access to the entire private network, which can increase security risks if a device is compromised.
+
+### Access Control
+
+  - **Pangolin**: Enforces zero-trust policies with role-based access control (RBAC), path-based rules, and authentication methods like SSO, OIDC, and 2FA.
+  - **VPN**: Relies on network segmentation or ACLs for security, with fewer granular controls.
+
+### Deployment
+
+  - **Pangolin**: Operates as a centralized reverse proxy using encrypted WireGuard tunnels, requiring no public IPs or open ports on edge networks.
+  - **VPN**: Requires a VPN server, public IPs, and open ports for inbound connections.
+
+# Pangolin vs. Mesh VPN (e.g., Tailscale, Netbird)
+
+Pangolin and mesh VPNs like Tailscale or Netbird both provide secure remote access, but they differ in their approach and functionality. Mesh VPNs focus on creating peer-to-peer connections between devices for full network access, while Pangolin is designed to expose specific applications or services securely through points of presence, with no need for client-side software on user devices.
+
+Pangolin is a better choice for application-specific access with zero-trust security and no client-side software requirements. Mesh VPNs like Tailscale or Netbird are more suitable for full network access and peer-to-peer connectivity. For environments prioritizing granular access control and simplicity, Pangolin offers a more focused and secure solution.