The Pangolin container includes a CLI tool called pangctl that provides commands to help you manage your Pangolin instance.
Accessing the CLI
Run the following command on the host where the Pangolin container is running:
Available Commands
To see all available commands:
Set Admin Credentials
Set or reset admin credentials for your Pangolin instance:
Use a strong password and keep your admin credentials secure.
Set Server Admin
Add or remove server admin status for a user by email address:
To remove server admin status:
Options
--email (required): User email address--remove (optional, default: false): Remove server admin status from the user
At least one server admin must always exist. The command fails if you try to remove server admin status from the last remaining server admin.
Clear Exit Nodes
Clear all exit nodes from the database:
This command permanently deletes all exit nodes from the database. This action cannot be undone.
Reset User Security Keys
Reset a user’s security keys (passkeys) by deleting all their webauthn credentials:
This command permanently deletes all security keys for the specified user. The user will need to re-register their security keys to use passkey authentication again.
Disable User 2FA
Disable two-factor authentication for a user by email address. Sets twoFactorEnabled to false and clears the user’s 2FA secret:
Options
--email (required): User email address
This command disables 2FA for the specified user and clears their stored 2FA secret. The user can re-enable 2FA from their account settings after signing in.
Rotate Server Secret
Rotate the server secret by decrypting all encrypted values with the old secret and re-encrypting with a new secret. This command updates OIDC IdP configurations and license keys in the database, as well as the config file.
Options
--old-secret (required): The current server secret (for verification)--new-secret (required): The new server secret to use (must be at least 8 characters long)--force (optional): Force rotation even if the old secret doesn’t match the config file. Use this if you know the old secret is correct but the config file is out of sync.
This command performs a critical operation that affects all encrypted data in your database. Ensure you have a backup before running this command.Important considerations:
- The new secret must be at least 8 characters long
- The new secret must be different from the old secret
- The command verifies the old secret matches the config file (unless
--force is used)
- After rotation, you must restart the server for the new secret to take effect
- Using
--force with an incorrect old secret will cause the rotation to fail or corrupt encrypted data
Clear License Keys
Clear all license keys from the database:
This command permanently deletes all license keys from the database. This action cannot be undone.
Delete Client
Delete a client and all associated data (OLMs, current fingerprint, userClients, approvals). Snapshots are preserved.
Options
--orgId (required): The organization ID--niceId (required): The client niceId (identifier)
This command permanently deletes the client and its associated data:
- All OLMs (One-time Login Mechanisms) associated with the client
- Current fingerprint entries
- Approval records
- UserClient associations
Note: Snapshots are preserved and will not be deleted.This action cannot be undone. Ensure you have backups if needed. Generate Org CA Keys
Generate an SSH CA public/private key pair for an organization and store them in the database. The private key is encrypted with the server secret.
Clear Certificates
Clear all certificates from the database to be reinserted by the server when syncing from acme.json files or using Pangolin DNS.
Options
--orgId (required): The organization ID--secret (optional): Server secret used to encrypt the CA private key. If omitted, the secret is read from the config file (config.yml or config.yaml in the config directory).--force (optional, default: false): Overwrite existing CA keys for the organization if they already exist
If the organization already has CA keys, the command fails unless you pass --force. Using --force overwrites the existing keys; ensure you have a backup or understand the impact before overwriting.
