@@ -89,8 +93,8 @@ _Resources page of Pangolin dashboard (dark mode) showing multiple resources ava
1. **Deploy the Central Server**:
- - Deploy the Docker Compose stack onto a VPS hosted on a cloud platform like RackNerd, Amazon EC2, DigitalOcean Droplet, or similar. There are many cheap VPS hosting options available to suit your needs.
-
+ - Deploy the Docker Compose stack onto a VPS hosted on a cloud platform like RackNerd, Amazon EC2, DigitalOcean Droplet, or similar. There are many cheap VPS hosting options available to suit your needs.
+
> [!TIP]
> Many of our users have had a great experience with [RackNerd](https://my.racknerd.com/aff.php?aff=13788). Depending on promotions, you can likely get a **VPS with 1 vCPU, 1GB RAM, and ~20GB SSD for just around $12/year**. That's a great deal!
> We are part of the [RackNerd](https://my.racknerd.com/aff.php?aff=13788) affiliate program, so if you purchase through [our link](https://my.racknerd.com/aff.php?aff=13788), we receive a small commission which helps us maintain the project and keep it free for everyone.
@@ -112,23 +116,19 @@ _Resources page of Pangolin dashboard (dark mode) showing multiple resources ava
**Use Case Example - Bypassing Port Restrictions in Home Lab**:
Imagine private sites where the ISP restricts port forwarding. By connecting these sites to Pangolin via WireGuard, you can securely expose HTTP and HTTPS resources on the private network without any networking complexity.
-**Use Case Example - Deploying Services For Your Business**
- You can use Pangolin as an easy way to expose your business applications to your users behind a safe authentication portal you can integrate into your IDP solution. Expose resources on prem and on the cloud.
+**Use Case Example - Deploying Services For Your Business**:
+You can use Pangolin as an easy way to expose your business applications to your users behind a safe authentication portal you can integrate into your IdP solution. Expose resources on prem and on the cloud.
**Use Case Example - IoT Networks**:
IoT networks are often fragmented and difficult to manage. By deploying Pangolin on a central server, you can connect all your IoT sites via Newt or another WireGuard client. This creates a simple, secure, and centralized way to access IoT resources without the need for intricate networking setups.
-
-
-_Resources page of Pangolin dashboard (dark mode) showing HTTPS and TCP resources with access control rules._
-
## Similar Projects and Inspirations
**Cloudflare Tunnels**:
- A similar approach to proxying private resources securely, but Pangolin is a self-hosted alternative, giving you full control over your infrastructure.
+ A similar approach to proxying private resources securely, but Pangolin is a self-hosted alternative, giving you full control over your infrastructure.
-**Authentik and Authelia**:
- These projects inspired Pangolin’s centralized authentication system for proxies, enabling robust user and role management.
+**Authelia**:
+ This inspired Pangolin’s centralized authentication system for proxies, enabling robust user and role management.
## Project Development / Roadmap
diff --git a/config/config.example.yml b/config/config.example.yml
index f3ab8d6..7b5c144 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -18,6 +18,7 @@ server:
internal_hostname: "pangolin"
session_cookie_name: "p_session_token"
resource_access_token_param: "p_token"
+ secret: "your_secret_key_here"
resource_access_token_headers:
id: "P-Access-Token-Id"
token: "P-Access-Token"
diff --git a/install/config/docker-compose.yml b/install/config/docker-compose.yml
index 496b013..6c1a375 100644
--- a/install/config/docker-compose.yml
+++ b/install/config/docker-compose.yml
@@ -35,7 +35,7 @@ services:
- 80:80 # Port for traefik because of the network_mode
{{end}}
traefik:
- image: traefik:v3.3.5
+ image: traefik:v3.3.6
container_name: traefik
restart: unless-stopped
{{if .InstallGerbil}}
diff --git a/install/main.go b/install/main.go
index 82f7902..abb67ac 100644
--- a/install/main.go
+++ b/install/main.go
@@ -202,7 +202,7 @@ func collectUserInput(reader *bufio.Reader) Config {
config.BaseDomain = readString(reader, "Enter your base domain (no subdomain e.g. example.com)", "")
config.DashboardDomain = readString(reader, "Enter the domain for the Pangolin dashboard", "pangolin."+config.BaseDomain)
config.LetsEncryptEmail = readString(reader, "Enter email for Let's Encrypt certificates", "")
- config.InstallGerbil = readBool(reader, "Do you want to use Gerbil to allow tunned connections", true)
+ config.InstallGerbil = readBool(reader, "Do you want to use Gerbil to allow tunneled connections", true)
// Admin user configuration
fmt.Println("\n=== Admin User Configuration ===")
diff --git a/public/screenshots/collage.png b/public/screenshots/collage.png
index 74fe6de..c791e7e 100644
Binary files a/public/screenshots/collage.png and b/public/screenshots/collage.png differ
diff --git a/server/lib/ip.ts b/server/lib/ip.ts
index 86fe116..fd6f07a 100644
--- a/server/lib/ip.ts
+++ b/server/lib/ip.ts
@@ -17,7 +17,7 @@ function detectIpVersion(ip: string): IPVersion {
*/
function ipToBigInt(ip: string): bigint {
const version = detectIpVersion(ip);
-
+
if (version === 4) {
return ip.split('.')
.reduce((acc, octet) => {
@@ -105,7 +105,7 @@ export function cidrToRange(cidr: string): IPRange {
const version = detectIpVersion(ip);
const prefixBits = parseInt(prefix);
const ipBigInt = ipToBigInt(ip);
-
+
// Validate prefix length
const maxPrefix = version === 4 ? 32 : 128;
if (prefixBits < 0 || prefixBits > maxPrefix) {
@@ -116,7 +116,7 @@ export function cidrToRange(cidr: string): IPRange {
const mask = BigInt.asUintN(version === 4 ? 64 : 128, (BigInt(1) << shiftBits) - BigInt(1));
const start = ipBigInt & ~mask;
const end = start | mask;
-
+
return { start, end };
}
@@ -136,17 +136,17 @@ export function findNextAvailableCidr(
if (!startCidr && existingCidrs.length === 0) {
return null;
}
-
+
// If no existing CIDRs, use the IP version from startCidr
- const version = startCidr
+ const version = startCidr
? detectIpVersion(startCidr.split('/')[0])
: 4; // Default to IPv4 if no startCidr provided
-
+
// Use appropriate default startCidr if none provided
startCidr = startCidr || (version === 4 ? "0.0.0.0/0" : "::/0");
-
+
// If there are existing CIDRs, ensure all are same version
- if (existingCidrs.length > 0 &&
+ if (existingCidrs.length > 0 &&
existingCidrs.some(cidr => detectIpVersion(cidr.split('/')[0]) !== version)) {
throw new Error('All CIDRs must be of the same IP version');
}
@@ -196,12 +196,14 @@ export function findNextAvailableCidr(
export function isIpInCidr(ip: string, cidr: string): boolean {
const ipVersion = detectIpVersion(ip);
const cidrVersion = detectIpVersion(cidr.split('/')[0]);
-
+
+ // If IP versions don't match, the IP cannot be in the CIDR range
if (ipVersion !== cidrVersion) {
- throw new Error('IP address and CIDR must be of the same version');
+ // throw new Erorr
+ return false;
}
const ipBigInt = ipToBigInt(ip);
const range = cidrToRange(cidr);
return ipBigInt >= range.start && ipBigInt <= range.end;
-}
\ No newline at end of file
+}
diff --git a/server/license/license.ts b/server/license/license.ts
index 7887f45..e97b8f5 100644
--- a/server/license/license.ts
+++ b/server/license/license.ts
@@ -13,12 +13,19 @@ import moment from "moment";
import { setHostMeta } from "@server/setup/setHostMeta";
import { encrypt, decrypt } from "@server/lib/crypto";
+const keyTypes = ["HOST", "SITES"] as const;
+type KeyType = (typeof keyTypes)[number];
+
+const keyTiers = ["PROFESSIONAL", "ENTERPRISE"] as const;
+type KeyTier = (typeof keyTiers)[number];
+
export type LicenseStatus = {
isHostLicensed: boolean; // Are there any license keys?
isLicenseValid: boolean; // Is the license key valid?
hostId: string; // Host ID
maxSites?: number;
usedSites?: number;
+ tier?: KeyTier;
};
export type LicenseKeyCache = {
@@ -26,7 +33,8 @@ export type LicenseKeyCache = {
licenseKeyEncrypted: string;
valid: boolean;
iat?: Date;
- type?: "LICENSE" | "SITES";
+ type?: KeyType;
+ tier?: KeyTier;
numSites?: number;
};
@@ -54,7 +62,8 @@ type ValidateLicenseAPIResponse = {
type TokenPayload = {
valid: boolean;
- type: "LICENSE" | "SITES";
+ type: KeyType;
+ tier: KeyTier;
quantity: number;
terminateAt: string; // ISO
iat: number; // Issued at
@@ -182,11 +191,12 @@ LQIDAQAB
licenseKeyEncrypted: key.licenseKeyId,
valid: payload.valid,
type: payload.type,
+ tier: payload.tier,
numSites: payload.quantity,
iat: new Date(payload.iat * 1000)
});
- if (payload.type === "LICENSE") {
+ if (payload.type === "HOST") {
foundHostKey = true;
}
} catch (e) {
@@ -273,6 +283,7 @@ LQIDAQAB
);
cached.valid = payload.valid;
cached.type = payload.type;
+ cached.tier = payload.tier;
cached.numSites = payload.quantity;
cached.iat = new Date(payload.iat * 1000);
@@ -311,8 +322,9 @@ LQIDAQAB
logger.debug("Checking key", cached);
- if (cached.type === "LICENSE") {
+ if (cached.type === "HOST") {
status.isLicenseValid = cached.valid;
+ status.tier = cached.tier;
}
if (!cached.valid) {
diff --git a/server/routers/accessToken/listAccessTokens.ts b/server/routers/accessToken/listAccessTokens.ts
index 1ed7b14..07ef9aa 100644
--- a/server/routers/accessToken/listAccessTokens.ts
+++ b/server/routers/accessToken/listAccessTokens.ts
@@ -172,9 +172,20 @@ export async function listAccessTokens(
)
);
}
- const { orgId, resourceId } = parsedParams.data;
+ const { resourceId } = parsedParams.data;
- if (orgId && orgId !== req.userOrgId) {
+ const orgId =
+ parsedParams.data.orgId ||
+ req.userOrg?.orgId ||
+ req.apiKeyOrg?.orgId;
+
+ if (!orgId) {
+ return next(
+ createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
+ );
+ }
+
+ if (req.user && orgId && orgId !== req.userOrgId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
@@ -183,21 +194,29 @@ export async function listAccessTokens(
);
}
- const accessibleResources = await db
- .select({
- resourceId: sql