🐼 Pangolin — Cloud Tunnel Gateway

Host: Cloud – Starbuck VPS · Compose: Cloud/Starbuck/pangolin/compose.yaml
Stack name: pangolin

1. Overview

Pangolin (by Fossorial) is a self-hosted reverse tunnel gateway — similar to Cloudflare Tunnel but fully self-managed. It allows homelab services to be securely exposed through the Starbuck cloud VPS without opening firewall ports at home. The Newt client in Homelab/Docker/tools/ connects back to this server. Gerbil handles WireGuard tunnelling, and Traefik manages TLS termination on the VPS side.

2. Architecture & Services

Service	Image	Port	Role
`pangolin`	`fosrl/pangolin-node:1.4.0`	—	Control plane: manages tunnel routes and config
`gerbil`	`fosrl/gerbil:1.4.1`	`80`, `443`, `21820/udp`, `51820/udp`	WireGuard tunnel endpoint + traffic routing
`traefik`	`traefik:v3.7.5`	(shares Gerbil network)	TLS termination for tunnelled services

3. Networking

default (pangolin bridge) — All three services share this bridge network.
Traefik uses network_mode: service:gerbil — all external ports appear on the Gerbil container.
WireGuard tunnels arrive on 21820/udp and 51820/udp.

4. Persistent Storage

Container	Host Path / Volume	Description
`pangolin`	`/home/michael/data/pangolin/config`	Pangolin config YAML
`gerbil`	`/home/michael/data/pangolin/config/`	Gerbil key file
`traefik`	`/home/michael/data/pangolin/config/traefik`	Traefik config
`traefik`	`/home/michael/data/pangolin/config/letsencrypt`	Let's Encrypt certificates
`traefik` / `pangolin`	`pangolin-data` (named vol)	Shared certs and dynamic config

5. Environment Variables

No environment variables in the compose. All configuration is file-based: - Pangolin: /home/michael/data/pangolin/config/config.yaml - Traefik: /home/michael/data/pangolin/config/traefik/traefik_config.yml

6. Access & Usage

The Pangolin dashboard is accessible after startup. The Newt client (Homelab/Docker/tools/newt) connects to https://pangolin.fossorial.io to establish the tunnel.

# Start on Starbuck VPS
docker compose -f Cloud/Starbuck/pangolin/compose.yaml up -d

# Health check
curl -f http://localhost:3001/api/v1/

7. Maintenance & Backup

# Update
docker compose -f Cloud/Starbuck/pangolin/compose.yaml pull
docker compose -f Cloud/Starbuck/pangolin/compose.yaml up -d

# Backup
rsync -av /home/michael/data/pangolin/ /backup/pangolin/