mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-10-21 20:19:11 +02:00
55 lines
3.1 KiB
Plaintext
55 lines
3.1 KiB
Plaintext
---
|
|
title: "HTTP / HTTPS"
|
|
description: "Publish websites, APIs, and dashboards as authenticated public reverse proxies"
|
|
---
|
|
|
|
HTTP and HTTPS public resources are the most common public resource type. They expose a web application or API on a fully qualified domain name with a valid TLS certificate, fronted by Pangolin's authenticated reverse proxy.
|
|
|
|
Users open the resource URL in any web browser. No Pangolin client is required.
|
|
|
|
## Benefits
|
|
|
|
- Publish apps from behind NAT or a firewall without opening inbound ports or needing a public IP on the backend.
|
|
- Every resource gets a valid TLS certificate that Pangolin issues and renews.
|
|
- Unauthenticated visitors are stopped at Pangolin before any traffic reaches your app.
|
|
- SSO, identity providers, and context rules like geo-blocking protect apps that have no login of their own.
|
|
- Multiple targets across sites give load balancing, health checks, and automatic failover.
|
|
- Users only need a browser, so contractors, customers, and personal devices can get access without installing anything.
|
|
|
|
## Use Cases
|
|
|
|
- Put self-hosted apps such as Grafana, Home Assistant, or an internal wiki behind SSO.
|
|
- Publish a public website or API running on a home server or private network.
|
|
- Share a staging site with a client using a PIN, passcode, or expiring link.
|
|
- Restrict an admin panel to certain countries, IP ranges, or URL paths with access rules.
|
|
- Load balance a web app across servers in different locations.
|
|
|
|
## How It Works
|
|
|
|
1. You assign a FQDN on a domain managed in Pangolin.
|
|
2. Pangolin terminates TLS and applies [authentication and access rules](/manage/resources/public/authentication).
|
|
3. Authenticated requests are proxied through a site connector to your backend target.
|
|
|
|
Pangolin acts as a front-door barrier: unauthenticated visitors are redirected to a Pangolin login page before traffic reaches your application.
|
|
|
|
## Target Configuration
|
|
|
|
HTTP/HTTPS resources use **[targets](/manage/resources/public/targets)** to define where traffic is sent on your remote network.
|
|
|
|
- Add one or more targets, each with an upstream address and port.
|
|
- Assign each target to a site. Targets on different sites enable [round-robin load balancing](/manage/resources/public/targets#multi-site-targets) and [automatic failover](/manage/resources/public/healthchecks-failover).
|
|
- Optionally configure path-based routing, path rewriting, custom host headers, and other proxy settings.
|
|
|
|
This multi-target model differs from SSH, RDP, and VNC public resources, which use site selection and a single host/port instead of discrete targets.
|
|
|
|
## Authentication and Access Rules
|
|
|
|
HTTP/HTTPS resources are protocol-aware and fully support Pangolin's identity and context policies:
|
|
|
|
- Platform SSO and external identity providers
|
|
- User, role, and machine access assignments
|
|
- PIN, passcode, shareable links, and email OTP
|
|
- Ranked allow/deny rules for IP, geolocation, URL paths, and more
|
|
|
|
See [Authentication](/manage/resources/public/authentication) for the full list of options. To share the same settings across multiple resources, use a [resource policy](/manage/resources/public/resource-policies).
|