From 7a3dd910103de9c2385be0b7e513f2ca8fd05a61 Mon Sep 17 00:00:00 2001 From: depasseg Date: Fri, 2 Oct 2026 16:37:55 -0400 Subject: [PATCH 1/5] Update rules.mdx Added a Jellyfin rule --- content/docs/self-host/community-guides/rules.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/self-host/community-guides/rules.mdx b/content/docs/self-host/community-guides/rules.mdx index 8a0c961..ffd5956 100644 --- a/content/docs/self-host/community-guides/rules.mdx +++ b/content/docs/self-host/community-guides/rules.mdx @@ -13,7 +13,7 @@ This table compiles paths that need to be allowed for various apps to work with | Lidarr | `/api/*` | | **Media Servers** | | | Jellyfin (iOS) | `/system/info/public` | -| Jellyfin (Roku) | `/System/Info/Public`
`/Users/AuthenticateByName`
`/Users/Public`
`/QuickConnect/Initiate`
`/QuickConnect/Connect`
`/Users/AuthenticateWithQuickConnect` | +| Jellyfin (Roku) | `/System/Info/Public`
`/Users/AuthenticateByName`
`/Users/Public`
`/QuickConnect/Initiate`
`/QuickConnect/Connect`
`/Users/AuthenticateWithQuickConnect`
`/Branding/Configuration` | | Audiobookshelf | Audiobookshelf also supports `/audiobookshelf` by default. Each rule should also be applied to this path.
`/api/*`
`/login`
`/auth/*`
`/feed/*`
`/socket.io/`
`/status`
`/logout`
`/ping`
`/public/*`
The following is needed for public shares and is optional for clients:
`/share/*`
`/_nuxt/*.js`
`/_nuxt/fonts/*` | | **Management & Monitoring** | | | Tautulli | `/api/*` | From 0da59ffb89ba8981df7e48b275ef11e57d51e75b Mon Sep 17 00:00:00 2001 From: Root-Core Date: Sat, 3 Oct 2026 10:12:55 +0000 Subject: [PATCH 2/5] Added response and request headers documentation for blueprints --- content/docs/manage/blueprints.mdx | 60 +++++++++++++++++++++++------- 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/content/docs/manage/blueprints.mdx b/content/docs/manage/blueprints.mdx index 499769e..170dfa7 100644 --- a/content/docs/manage/blueprints.mdx +++ b/content/docs/manage/blueprints.mdx @@ -205,9 +205,9 @@ public-resources: full-domain: app.example.com host-header: app.internal tls-server-name: app.internal - headers: - - name: X-Env - value: production + response-headers: + - name: Access-Control-Allow-Origin + value: * rules: - action: allow match: country @@ -458,7 +458,7 @@ Example YAML: ```yaml public-resources: my-app: - headers: + request-headers: - name: X-Env value: prod ``` @@ -467,8 +467,8 @@ Equivalent Compose labels: ```yaml labels: - - pangolin.public-resources.my-app.headers[0].name=X-Env - - pangolin.public-resources.my-app.headers[0].value=prod + - pangolin.public-resources.my-app.request-headers[0].name=X-Env + - pangolin.public-resources.my-app.request-headers[0].value=prod ``` @@ -512,8 +512,8 @@ services: - pangolin.public-resources.nginx.name=nginx - pangolin.public-resources.nginx.full-domain=nginx.fosrl.io - pangolin.public-resources.nginx.protocol=http - - pangolin.public-resources.nginx.headers[0].name=X-Example-Header - - pangolin.public-resources.nginx.headers[0].value=example-value + - pangolin.public-resources.nginx.request-headers[0].name=X-Example-Header + - pangolin.public-resources.nginx.request-headers[0].value=example-value - pangolin.public-resources.nginx.targets[0].method=http - pangolin.public-resources.nginx.targets[0].path=/path - pangolin.public-resources.nginx.targets[0].path-match=prefix @@ -652,9 +652,12 @@ public-resources: - production host-header: internal.example.local tls-server-name: internal.example.local - headers: + request-headers: - name: X-Env value: prod + response-headers: + - name: Access-Control-Allow-Origin + value: * rules: - action: allow match: country @@ -892,31 +895,60 @@ public-resources: Container label: `pangolin.public-resources.web-app.tls-server-name=internal.example.local` - + Static headers added to proxied requests. Container labels for arrays must include an index (`[0]`, `[1]`, ...). - YAML: `headers: [{ name: X-Env, value: prod }]` - Container label: `pangolin.public-resources.web-app.headers[0].name=X-Env` + YAML: `request-headers: [{ name: X-Env, value: prod }]` + Container label: `pangolin.public-resources.web-app.request-headers[0].name=X-Env` Header name. YAML: `name: X-Env` - Container label: `pangolin.public-resources.web-app.headers[0].name=X-Env` + Container label: `pangolin.public-resources.web-app.request-headers[0].name=X-Env` Header value. YAML: `value: prod` - Container label: `pangolin.public-resources.web-app.headers[0].value=prod` + Container label: `pangolin.public-resources.web-app.request-headers[0].value=prod` + + Static headers added to proxied responses. + + Container labels for arrays must include an index (`[0]`, `[1]`, ...). + + YAML: `response-headers: [{ name: Cache-Control, value: no-cache }]` + Container label: `pangolin.public-resources.web-app.response-headers[0].name=Cache-Control` + + + + Header name. + + YAML: `name: Cache-Control` + Container label: `pangolin.public-resources.web-app.response-headers[0].name=Cache-Control` + + + + Header value. + + YAML: `value: no-cache` + Container label: `pangolin.public-resources.web-app.response-headers[0].value=no-cache` + + + + + + Deprecated alias for `request-headers`. + + Ordered access rules for public resources. From 15e046f856f973cce047858f49dd7b9a9a3acafa Mon Sep 17 00:00:00 2001 From: Root-Core Date: Sat, 3 Oct 2026 10:30:49 +0000 Subject: [PATCH 3/5] Mark deprecated fields in blueprint documentation --- content/docs/manage/blueprints.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/docs/manage/blueprints.mdx b/content/docs/manage/blueprints.mdx index 499769e..95afbbc 100644 --- a/content/docs/manage/blueprints.mdx +++ b/content/docs/manage/blueprints.mdx @@ -708,7 +708,7 @@ public-resources: Container label: `pangolin.public-resources.web-app.mode=http` - + Deprecated resource type field. Use `mode` instead. **Options**: `http`, `tcp`, `udp`, `ssh`, `rdp`, `vnc` @@ -1229,7 +1229,7 @@ public-resources: Container label: `pangolin.public-resources.web-app.targets[0].rewrite-path=/` - + Deprecated alias for `rewrite-path`. @@ -1285,7 +1285,7 @@ public-resources: Check interval while the target is unhealthy. - + Deprecated alias for `unhealthy-interval`. @@ -1316,7 +1316,7 @@ public-resources: Whether redirects should be followed. - + Deprecated alias for `follow-redirects`. From 09c9be652597c3eeeb8167e8d2d2bd0ae3f3d4fa Mon Sep 17 00:00:00 2001 From: Owen Date: Thu, 15 Oct 2026 16:23:29 -0400 Subject: [PATCH 4/5] Add no-cloud --- content/docs/manage/remote-node/backhaul.mdx | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/docs/manage/remote-node/backhaul.mdx b/content/docs/manage/remote-node/backhaul.mdx index 357f705..5b21816 100644 --- a/content/docs/manage/remote-node/backhaul.mdx +++ b/content/docs/manage/remote-node/backhaul.mdx @@ -239,6 +239,7 @@ sudo pangolin up site \ --secret ts1v7480qqw01j7ba4uiw5y7l58skw7anpji2ndludhgzloh \ --endpoint https://app.pangolin.net \ --native-main +--no-cloud # Used to prevent it from failing over to Pangolin nodes ``` On Windows, set `nativeMain` in `C:\Users\\.config\pangolin\site.json` instead: @@ -248,10 +249,15 @@ On Windows, set `nativeMain` in `C:\Users\\.config\pangolin\site.json` "id": "34s48my8iba5wsl", "secret": "ts1v7480qqw01j7ba4uiw5y7l58skw7anpji2ndludhgzloh", "endpoint": "https://app.pangolin.net", - "nativeMain": true + "nativeMain": true, + "noCloud": true } ``` + + Use the no-cloud option to prevent the site from failing over to a Pangolin node if the backhaul node goes down. If you want the site to fail over, leave it out. + + If you are using a Pangolin Site on Windows, `wintun.dll` is required to run in native mode. If not already provided by the installer, you can download from https://www.wintun.net/ From e3c52135c20e352b5195cba2d32a5a5381b5ce0d Mon Sep 17 00:00:00 2001 From: Owen Date: Thu, 15 Oct 2026 16:23:37 -0400 Subject: [PATCH 5/5] Explain they can not be shared --- content/docs/manage/clients/credentials.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/manage/clients/credentials.mdx b/content/docs/manage/clients/credentials.mdx index 2ea29b0..4ed493e 100644 --- a/content/docs/manage/clients/credentials.mdx +++ b/content/docs/manage/clients/credentials.mdx @@ -4,7 +4,7 @@ description: "How machine clients authenticate with an ID and secret, and how to --- ## Understanding Credentials -Machine client credentials are only for [machine clients](/manage/clients/understanding-clients#machines): servers and automated systems that connect without a person present. Each machine client is provisioned with a unique identifier (ID), secret, and endpoint. The client uses those three values to establish a secure, encrypted connection to the server. +Machine client credentials are only for [machine clients](/manage/clients/understanding-clients#machines): servers and automated systems that connect without a person present. Each machine client is provisioned with a unique identifier (ID), secret, and endpoint. The client uses those three values to establish a secure, encrypted connection to the server. **Machine client credentials can not be shared across different clients**. User devices do not use machine client credentials. A person logs in with their Pangolin user credentials, or with an external identity provider, through the web login flow in the client. That login creates a session tied to their account. The session is not shown in the dashboard and cannot be regenerated. To disconnect a user device, have the user log out in the client.