HTTP / HTTPS

HTTP and HTTPS public resources are the most common public resource type. They expose a web application or API on a fully qualified domain name with a valid TLS certificate, fronted by Pangolin's authenticated reverse proxy.

Users open the resource URL in any web browser. No Pangolin client is required.

BenefitsCopy Anchor Link

• Publish apps from behind NAT or a firewall without opening inbound ports or needing a public IP on the backend.
• Every resource gets a valid TLS certificate that Pangolin issues and renews.
• Unauthenticated visitors are stopped at Pangolin before any traffic reaches your app.
• SSO, identity providers, and context rules like geo-blocking protect apps that have no login of their own.
• Multiple targets across sites give load balancing, health checks, and automatic failover.
• Users only need a browser, so contractors, customers, and personal devices can get access without installing anything.

Use CasesCopy Anchor Link

• Put self-hosted apps such as Grafana, Home Assistant, or an internal wiki behind SSO.
• Publish a public website or API running on a home server or private network.
• Share a staging site with a client using a PIN, passcode, or expiring link.
• Restrict an admin panel to certain countries, IP ranges, or URL paths with access rules.
• Load balance a web app across servers in different locations.

How It WorksCopy Anchor Link

1. You assign a FQDN on a domain managed in Pangolin.
2. Pangolin terminates TLS and applies authentication and access rules.
3. Authenticated requests are proxied through a site connector to your backend target.

Pangolin acts as a front-door barrier: unauthenticated visitors are redirected to a Pangolin login page before traffic reaches your application.

Target ConfigurationCopy Anchor Link

HTTP/HTTPS resources use targets to define where traffic is sent on your remote network.

• Add one or more targets, each with an upstream address and port.
• Assign each target to a site. Targets on different sites enable load balancing and automatic failover.
• Optionally configure path-based routing, path rewriting, a load balancing strategy, sticky sessions, custom host headers, and other proxy settings.

This multi-target model differs from SSH, RDP, and VNC public resources, which use site selection and a single host/port instead of discrete targets.

Authentication and Access RulesCopy Anchor Link

HTTP/HTTPS resources are protocol-aware and fully support Pangolin's identity and context policies:

• Platform SSO and external identity providers
• User, role, and machine access assignments
• PIN, passcode, shareable links, and email OTP
• Ranked allow/deny rules for IP, geolocation, URL paths, and more

See Authentication for the full list of options. To share the same settings across multiple resources, use a resource policy.