Configuration File

The URL where your Pangolin dashboard is hosted.

Examples: https://example.com, https://pangolin.example.com

This URL is used for generating links, redirects, and authentication flows. You can run Pangolin on a subdomain or root domain.

The logging level for the application.

Options: debug, info, warn, error

Default: info

Whether to save logs to files in the config/logs/ directory.

Default: false

Whether to log failed authentication attempts for security monitoring.

Default: false

Telemetry configuration settings.

Notification configuration settings.

The port for the front-end API that handles external requests.

Example: 3000

The port for the internal private-facing API.

Example: 3001

The port for the frontend server (Next.js).

Example: 3002

The port for the integration API (optional).

Example: 3003

The port for the AI Gateway service.

Example: 3005

Default: 3005

The hostname of the Pangolin container for internal communication.

Example: pangolin

The name of the session cookie for storing authentication tokens.

Example: p_session_token

Default: p_session_token

Query parameter name for passing access tokens in requests.

Example: p_token

Default: p_token

HTTP headers for passing access tokens in requests.

Names of the HTTP headers Badger injects into proxied requests to identify an authenticated user or virtual API key. Also used by the AI Gateway to attach the identified user to a request once it has passed Badger's session/key verification.

Query parameter for session request tokens.

Default: resource_session_request_param

Cross-Origin Resource Sharing (CORS) configuration.

Number of proxy headers to trust for client IP detection.

Example: 1

Default: 1

IP ranges, in CIDR format, of the upstream proxies or load balancers that Badger trusts to supply the real client IP.

Example: ["10.0.0.0/8", "172.16.0.0/12"]

Default: []

Name of the HTTP header Badger reads the real client IP from when a request arrives from a trusted IP range.

Example: X-Real-Ip

Default: "" (uses CF-Connecting-IP)

server:
    trust_ips: ["10.0.0.0/8"]
    custom_ip_header: "X-Real-Ip"

Whether to have Badger stamp the resolved client IP into a dedicated X-Pangolin-Client-Ip header on the site-resource AI Gateway route.

Default: false

Environment Variable: ENABLE_AI_GATEWAY_CLIENT_IP_HEADER (or ENABLE_AI_GATEWAY_CLIENT_IP_HEADER_FILE to read the value from a file — see Reading secrets from a file)

Dashboard session duration in hours.

Example: 720 (30 days)

Default: 720

Resource session duration in hours.

Example: 720 (30 days)

Default: 720

Secret key for encrypting sensitive data.

Environment Variable: SERVER_SECRET (or SERVER_SECRET_FILE to read the value from a file — see Reading secrets from a file)

Minimum Length: 8 characters

Example: "d28@a2b.2HFTe2bMtZHGneNYgQFKT2X4vm4HuXUXBcq6aVyNZjdGt6Dx-_A@9b3y"

Path to the MaxMind GeoIP database file for geolocation features.

Example: ./config/GeoLite2-Country.mmdb

Path to the MaxMind ASN database file for ASN lookups.

Example: ./config/GeoLite2-ASN.mmdb

Domain configuration with a unique key of your choice.

The Traefik entrypoint name for HTTP traffic.

Example: web

The Traefik entrypoint name for HTTPS traffic.

Example: websecure

The default certificate resolver for domains created through the UI.

Example: letsencrypt

Whether to prefer wildcard certificates for UI-created domains.

Example: true

Additional Traefik middlewares to apply to resource routers.

Example: ["middleware1", "middleware2"]

Path where SSL certificates are stored. This is used only with managed Pangolin deployments.

Example: /var/certificates

Default: /var/certificates

Interval in milliseconds for monitoring configuration changes.

Example: 5000

Default: 5000

Path to the dynamic certificate configuration file. This is used only with managed Pangolin deployments.

Example: /var/dynamic/cert_config.yml

Default: /var/dynamic/cert_config.yml

Path to the dynamic router configuration file.

Example: /var/dynamic/router_config.yml

Default: /var/dynamic/router_config.yml

Additional fully-qualified domains that are always included in the list sent to the SNI proxy, alongside domains discovered from resources.

Example: ["static.example.com"]

Default: []

Supported site types for Traefik configuration.

Example: ["newt", "wireguard", "local"]

Default: ["newt", "wireguard", "local"]

Whether Traefik generates routes for raw TCP/UDP (non-HTTP) resources.

Default: true

Whether to use file-based configuration mode for Traefik.

Example: false

Default: false

Prefix used for transport-related configurations. References servers transport config in dynamic Traefik file.

Example: pp-transport-v

Default: pp-transport-v

Rate limit settings for the browser gateway Traefik middleware.

Domain name included in WireGuard configuration for tunnel connections.

Example: pangolin.example.com

Name of the exit node record that identifies this server's own Gerbil exit node.

Starting port for WireGuard tunnels. When changing, a full stack restart including sites and clients is required.

Example: 51820

Starting port for client WireGuard relay and hole punch port. When changing, a full stack restart including sites and clients is required.

Example: 21820

IP address CIDR range for Gerbil exit node subnets.

Default: 100.89.137.0/20

Block size for Gerbil exit node CIDR ranges.

Default: 24

Block size for site CIDR ranges connected to Gerbil.

Default: 30

Block size for organization CIDR ranges.

Default: 24

IP address CIDR range for organization subnets.

Default: 100.90.128.0/20

Example: 100.90.128.0/20

IP address CIDR range for utility subnets used by organizations.

Default: 100.96.128.0/20

Global rate limit settings for all external API requests.

Rate limit settings specifically for authentication endpoints.

SMTP server hostname.

Example: smtp.gmail.com

SMTP server port.

Example: 587 (TLS) or 465 (SSL)

SMTP username.

Environment Variable: EMAIL_SMTP_USER (or EMAIL_SMTP_USER_FILE to read the value from a file — see Reading secrets from a file)

Example: no-reply@example.com

SMTP password.

Environment Variable: EMAIL_SMTP_PASS (or EMAIL_SMTP_PASS_FILE to read the value from a file — see Reading secrets from a file)

Whether to use secure connection (SSL/TLS).

Default: false

From address for sent emails.

Example: no-reply@example.com

Whether to fail on invalid server certificates.

Default: true

Whether to require email verification for new users.

Default: false

Enable automatic synchronization of ACME certificates for TLS termination on private resources.

flags:
  enable_acme_cert_sync: true

Whether to disable public user registration.

Default: false

Whether to prevent users from creating organizations.

Default: false

Whether to allow raw TCP/UDP resource creation.

Default: true

Whether to enable the integration API.

Default: false

Whether to disable local site creation and management.

Default: false

Whether to disable basic WireGuard site functionality.

Default: false

Whether to disable product help banners in the UI at the top of screens.

Default: false

Whether to disable domains managed through the configuration file.

Default: false

Whether to disable features that are only available in the Enterprise Edition from showing in the UI.

Default: false

When set to true Pangolin will not generate publicly facing placeholder pages for private HTTP resources. This can impact the ability for Pangolin to generate nessicary certificates.

Default: false

Whether to hide the virtual API keys UI.

Default: false

PostgreSQL connection string.

Environment Variable: POSTGRES_CONNECTION_STRING (or POSTGRES_CONNECTION_STRING_FILE to read the value from a file — see Reading secrets from a file)

Example: postgresql://user:password@host:port/database

Read-only replica database configurations for load balancing.

Environment Variable: POSTGRES_REPLICA_CONNECTION_STRINGS, a comma-separated list of connection strings (or POSTGRES_REPLICA_CONNECTION_STRINGS_FILE to read the same comma-separated list from a file — see Reading secrets from a file)

Database connection pool settings.

Connection string for the dedicated logs database.

Environment Variable: POSTGRES_LOGS_CONNECTION_STRING (or POSTGRES_LOGS_CONNECTION_STRING_FILE to read the value from a file — see Reading secrets from a file)

Example: postgresql://user:password@host:port/logs_database

Read-only replica configurations for the logs database.

Environment Variable: POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS, a comma-separated list of connection strings (or POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS_FILE to read the same comma-separated list from a file — see Reading secrets from a file)

Connection pool settings for the logs database. Falls back to postgres.pool values when omitted.

Path to the acme.json file or a directory containing more than one acme json file produced by Traefik (or another ACME client). Pangolin reads this file to extract certificates for synchronization and will look for all files in the specified directory if a directory is provided. The file must be in the format produced by Traefik's ACME integration. This file is typically mounted as a volume from your ACME client container.

acme:
  acme_json_path: "config/letsencrypt/acme.json"

Interval in milliseconds at which Pangolin polls the acme.json file for certificate changes.

acme:
  sync_interval_ms: 5000

HTTP endpoint where Pangolin can pull SSL certificates from to load into the database. Provided in the following format:

[
    {
        "wildcard": false,
        "altName": "subdomain.example.com",
        "certName": "subdomain.example.com",
        "commonName": "subdomain.example.com",
        "certFile": "",
        "keyFile": ""
    }
]

acme:
  acme_http_endpoint: "http://controller-api.pangolin.svc.cluster.local/api/v1/certificates"

Where Pangolin loads the model catalog from, and how often it refreshes.

ai:
  model_catalog:
    upstream_url: "https://api.fossorial.io/api/v1/models"

ai:
  model_catalog:
    file: "config/ai-models.json"

ai:
  model_catalog:
    merge_file: "config/ai-models-extra.json"