61–70 of 132 posts
Earlier quoted context omitted.
Would love to understand it better too. It looks like the use cases are similar but the tech is different. NetBird is an alternative to Tailscale that uses Wireguard under the hood while these seem to use Traefik under the hood. I am personally a user of NetBird and love it. The design of the UI is very similar though :)
Pangolin also uses WireGuard and does not lock features behind a paywall.
Also interested in knowing whether a professional security audit was done and if there is a public security pentesting program. This is especially important given the blast radius of an authentication service.
Earlier quoted context omitted.
Out of curiosity why not give your sister restricted access to your tailnet instead? Then nothing is public.
Tailscale and Plex do not play nicely, particularly since Plex implemented a bunch of shit to try to charge users for accessing their own files outside what it considers a local network. Switching to Jellyfin is on my maintenance list. It's very understandable that if you had given a family member access to your Plex server before this year and it "just worked" you might look now at Tailscale as a way to put them on…
Hello Eveyone, this is the other maintainer here. Just wanted to add some more detail about the other components of this system: Pangolin uses Traefik under the hood to do the actual HTTP proxying. A plugin, Badger, provides a way to authenticate every request with Pangolin. A second service, Gerbil, provides a WireGuard management server that Pangolin can use to create peers for connectivity. And finally, there is N…
Traefik is awesome, and one of the biggest reasons is it's extensibility and robustness.
It absolutely does not get enough attention!
If you use this, it makes sense to run it at home. If you run it on a VPS, traffic is decrypted on VPS, the same privacy issue with Cloudflare tunnels. You have to trust the VPS provider.
What can you even do if you can't trust a VPS provider?
Hello Eveyone, this is the other maintainer here. Just wanted to add some more detail about the other components of this system: Pangolin uses Traefik under the hood to do the actual HTTP proxying. A plugin, Badger, provides a way to authenticate every request with Pangolin. A second service, Gerbil, provides a WireGuard management server that Pangolin can use to create peers for connectivity. And finally, there is N…
> Pangolin uses Traefik under the hood to do the actual HTTP proxying. Traefik is awesome, and one of the biggest reasons is it's extensibility and robustness. It absolutely does not get enough attention!
The one thing I haven’t been able to figure out how to do with it is do compression (gzip/br/zstd) there, so I’m handling it in the application layer, which feels suboptimal.
Any tips? Seems like a table stakes sort of feature in the space that shouldn’t be too hard to implement.
Earlier quoted context omitted.
> Pangolin uses Traefik under the hood to do the actual HTTP proxying. Traefik is awesome, and one of the biggest reasons is it's extensibility and robustness. It absolutely does not get enough attention!
I’m using it as my ingress controller on my K3S homelab and it has definitely been a nice DX so far. The one thing I haven’t been able to figure out how to do with it is do compression (gzip/br/zstd) there, so I’m handling it in the application layer, which feels suboptimal. Any tips? Seems like a table stakes sort of feature in the space that shouldn’t be too hard to implement.
https://doc.traefik.io/traefik/middlewares/http/compress/
Are you trying to compress the request that has already come in to your cluster? I'm not sure there's a ton of value to be extracted there, since the requests have already made their way across the internet uncompressed to your ingress point.
If there's a "long way" to go after hitting your ingress controller then maybe there's something to be gained...
I've been wanting to add some authentication lately so that I can manage access to the homelab resources. I currently prohibit all traffic and only allow the Wireguard subnet, but this means any clients have to be provisioned in Wireguard, which is a nuisance to setup manually. It does seem to work well enough though.
Pangolin seems like it would be a one-stop replacement and simplify the setup, especially once I look at adding user management to the mix.