calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-09-11 21:41:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Working on ha config and docs

Browse Source
This commit is contained in:
Owen
2026-09-11 10:49:44 -04:00
parent 695507ce9d
commit 094d3c4051
9 changed files with 201 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/ha-reference/README.md
+55 -1
View File
@@ -3,6 +3,23 @@ you need 3 instances at a minimum: node1 running pangolin, node 2 running pangol
the two pangolin nodes need to have public STATIC ips accessible on the internet <NODE1_EXTERNAL_IP> AND <NODE2_EXTERNAL_IP>
the two nodes need tp be able to address each other <NODE1_INTERNAL_IP> and <NODE2_INTERNAL_IP>
update these values in the `docker-compose.yml` file under the gerbil section:
```yaml
gerbil:
image: docker.io/fosrl/gerbil:latest
container_name: gerbil
restart: unless-stopped
depends_on:
pangolin:
condition: service_healthy
command:
- --reachableAt=http://<NODE1_INTERNAL_IP>:3004
- --generateAndSaveKeyTo=/var/config/key
- --remoteConfig=http://pangolin:3001/api/v1/
- --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP> # All trusted nodes in the cluster
```
open ports should look like this
**Outbound Rules**
@@ -28,12 +45,49 @@ add your email address for acme into <CONTACT_EMAIL>
only one of the nodes - in this case node1 - should be configured to run the acme client. the other node should have acme disabled. this is because only one node should be responsible for generating and renewing certificates. the other node will use the same certificates from the database. this is controlled with `acme.enable_acme_client`
delegating domains:
you need to create a namesever dns record. this is an a record pointing at the cluster for the DNS nameserver.
in the example config, this is ns.example.com. you can replace example.com with your domain or choose a any subdomain. Create an A record pointing at your cluster's load ballencer:
| Name | Type | Value |
| --- | --- | --- |
| ns.example.com | A | <LOAD_BALANCER_IP> |
if you plan to support cname delegation to the server you will need to add an additional cname record for the cluster. this is an example of a cname record pointing at the cluster for the DNS nameserver.
| Name | Type | Value |
| --- | --- | --- |
| cname.example.com | NS | ns.example.com |
finally, if you would like to support site-to-cloud networking, you can delegate a domain to be able to resolve site addresses withing a cloud encironement to address them through remote nodes. this looks like the above
| Name | Type | Value |
| --- | --- | --- |
| site.example.com | NS | ns.example.com |
update all three of these values in the privateConfig dns section:
```yaml
dns:
enabled: true
nameserver_name: "ns.example.com"
cname_extension: "cname.example.com"
site_extension: "site.example.com" # Optional
```
--
when you start for the first time pick one node to start first. This node will init the database and print out the init token to the logs. Use this token to visit the UI and login to create the first user. Then bring up the other nodes
notes:
traefik uses file_mode: true. this is different than the regular pangolin instrall which scrapes the http api. the file mode writes the traefik config into the dynamic directory - the routers and certs. This is because traefik will only pull cert config files from a file and not from an api. ensure there is a shared volume beteeen pangolin and traefik
be sure to download and keep up to date the maxmind databases for geoip and asn. these are used for geolocation and asn lookups. (reference the geoblocking docs here) and place them into the config directory GeoLite2-ASN.mmdb and GeoLite2-Country.mmdb
--
whats required:
@@ -51,4 +105,4 @@ if you run into loopback issues with the local pangolin instance not being able
```
gerbil:
local_exit_node_reachable_at: "http://gerbil:3004"
```
```
config/ha-reference/node1/config/dynamic/.gitkeep
View File
config/ha-reference/node1/config/dynamic/dynamic_config.yml
+67
View File
@@ -0,0 +1,67 @@
http:
middlewares:
badger:
plugin:
badger:
disableForwardAuth: true
routers:
# Next.js router (handles everything except API and WebSocket paths)
next-router:
rule: "!PathPrefix(`/api/v1`)"
service: next-service
entryPoints:
- dashboard
middlewares:
- badger
# API router (handles /api/v1 paths)
api-router:
rule: "PathPrefix(`/api/v1`)"
service: api-service
entryPoints:
- dashboard
middlewares:
- badger
# WebSocket router
ws-router:
rule: "PathPrefix(`/`)"
service: api-service
entryPoints:
- dashboard
middlewares:
- badger
services:
next-service:
loadBalancer:
servers:
- url: "http://pangolin:3002" # Next.js server
api-service:
loadBalancer:
servers:
- url: "http://pangolin:3000" # API/WebSocket server
tcp:
serversTransports:
pp-transport-v1:
proxyProtocol:
version: 1
pp-transport-v2:
proxyProtocol:
version: 2
udp:
routers:
dns-router:
entryPoints:
- dns
service: dns-service
services:
dns-service:
loadBalancer:
servers:
- address: "pangolin:53"
config/ha-reference/node1/config/traefik/traefik_config.yml
+4
View File
@@ -33,6 +33,10 @@ entryPoints:
encodedCharacters:
allowEncodedSlash: true
allowEncodedQuestionMark: true
dashboard:
address: ":3000"
dns:
address: ":53/udp"
serversTransport:
insecureSkipVerify: true
config/ha-reference/node1/docker-compose.yml
+2 -9
View File
@@ -4,15 +4,6 @@ services:
image: docker.io/fosrl/pangolin:ee-latest
container_name: pangolin
restart: unless-stopped
deploy:
resources:
limits:
memory: 2g
reservations:
memory: 512m
ports:
- 53:53/udp # DNS
- 3000:3000 # Pangolin UI
volumes:
- ./config:/app/config
- ./config/certificates:/var/certificates
@@ -43,9 +34,11 @@ services:
ports:
- 51820:51820/udp # wireguard
- 21820:21820/udp # relay
- 53:53/udp # DNS
- 443:8443 # resources
- 80:80 # web
- 3004:3004 # gerbil api
- 3000:3000 # Pangolin UI
traefik:
image: docker.io/traefik:v3.7.11
config/ha-reference/node2/config/dynamic/.gitkeep
View File
config/ha-reference/node2/config/dynamic/dynamic_config.yml
+67
View File
@@ -0,0 +1,67 @@
http:
middlewares:
badger:
plugin:
badger:
disableForwardAuth: true
routers:
# Next.js router (handles everything except API and WebSocket paths)
next-router:
rule: "!PathPrefix(`/api/v1`)"
service: next-service
entryPoints:
- dashboard
middlewares:
- badger
# API router (handles /api/v1 paths)
api-router:
rule: "PathPrefix(`/api/v1`)"
service: api-service
entryPoints:
- dashboard
middlewares:
- badger
# WebSocket router
ws-router:
rule: "PathPrefix(`/`)"
service: api-service
entryPoints:
- dashboard
middlewares:
- badger
services:
next-service:
loadBalancer:
servers:
- url: "http://pangolin:3002" # Next.js server
api-service:
loadBalancer:
servers:
- url: "http://pangolin:3000" # API/WebSocket server
tcp:
serversTransports:
pp-transport-v1:
proxyProtocol:
version: 1
pp-transport-v2:
proxyProtocol:
version: 2
udp:
routers:
dns-router:
entryPoints:
- dns
service: dns-service
services:
dns-service:
loadBalancer:
servers:
- address: "pangolin:53"
config/ha-reference/node2/config/traefik/traefik_config.yml
+4
View File
@@ -33,6 +33,10 @@ entryPoints:
encodedCharacters:
allowEncodedSlash: true
allowEncodedQuestionMark: true
dashboard:
address: ":3000"
dns:
address: ":53/udp"
serversTransport:
insecureSkipVerify: true
config/ha-reference/node2/docker-compose.yml
+2 -9
View File
@@ -4,15 +4,6 @@ services:
image: docker.io/fosrl/pangolin:ee-latest
container_name: pangolin
restart: unless-stopped
deploy:
resources:
limits:
memory: 2g
reservations:
memory: 512m
ports:
- 53:53/udp # DNS
- 3000:3000 # Pangolin UI
volumes:
- ./config:/app/config
- ./config/certificates:/var/certificates
@@ -43,9 +34,11 @@ services:
ports:
- 51820:51820/udp # wireguard
- 21820:21820/udp # relay
- 53:53/udp # DNS
- 443:8443 # resources
- 80:80 # web
- 3004:3004 # gerbil api
- 3000:3000 # Pangolin UI
traefik:
image: docker.io/traefik:v3.7.11