Pangolin 1.25: Redirects, mTLS, and Machine Roles

Pangolin 1.25 is here. The headline features are HTTP redirects, mutual TLS on public resources, and roles on machine clients. This release also adds configurable load balancing strategies, blueprint export from every resource, client identity headers on private HTTP, and credential regeneration for sites, machine clients, and remote nodes on Community Edition.

Release Highlights

Redirects

Redirects forward matching HTTP requests to another URL. They can be used to retire an old hostname, move a path on an existing resource, or send traffic from one origin to another without standing up a separate proxy just for the hop.

A redirect attaches to a domain hostname (independent of any resource) or a public resource (tied to that resource's hostname and lifecycle). Then, you match on host plus path and optionally rewrite the path before the browser sends the request to the destination. Among redirects on the same host, higher priority wins, and a matching redirect always runs before the resource, including before authentication.

1 / 3

You can manage redirects from Settings → Redirects. The setup details are in the redirects docs.

Redirects work on older versions of Badger. Permanent redirects need Badger v1.8.0 or greater. The automatic migration updates Badger automatically when it can find the Traefik config in the standard location; otherwise you need to update Badger manually.

mTLS for Public Resources

Public resources can now require a client certificate at the TLS handshake. You enable mTLS as an additional authentication method under the authentication tab of the resource. There, you can upload one or more trusted CA certificates. Then, clients must present a cert signed by one of those CAs before PIN, SSO, or any other auth method runs.

Clients without a valid certificate fail the handshake and see a connection error instead of the Pangolin login page. That makes mTLS a good fit for APIs and internal tools where only provisioned devices should reach the edge at all. After the handshake succeeds, your other auth methods still apply. Verified certificate details are forwarded upstream in the X-Forwarded-Tls-Client-Cert-Info header.

This is separate from the site-to-control-plane mTLS. Configuration and behavior are covered in the mTLS docs.

Roles on Machine Clients

Machine clients can be assigned the same roles you use for users. The machine then inherits every private resource those roles can reach, and access is the union of assigned roles and any direct grants on individual resources. That lets CI runners, daemons, and other long-lived systems share a role with a team instead of maintaining a separate grant list per machine.

1 / 2

See granting access on machine clients.

Load Balancing Strategy

When an HTTP or HTTPS public resource has more than one eligible target in the same routing group, you can choose how Pangolin spreads requests across them. You set the strategy on the resource Proxy tab, or with load-balancing-strategy in a blueprint.

For every load balancing option to work, your stack needs Traefik 3.6 or greater. You need to manually update Traefik accordingly.

Details and notes are in the targets docs.

Export Resources as Blueprints

You can export any public or private resource from the dashboard as YAML. Open the resources table, click the ⋯ menu on a row, and choose Export as Blueprint. Then, copy or download the file, then apply it through the dashboard, API, CLI, or a site blueprint. You can use this when you configured something in the UI and want it in version control or as a starting point for GitOps.

Read more under exporting resources.

Client Identities on Private HTTP

Private HTTP resources already identify the caller from the connected Pangolin client. Now, sites can forward that identity to the upstream app as Remote-User, Remote-Email, Remote-Name, and Remote-Role which are the same headers public resources use for forwarded identity. That lets internal apps behind a private reverse proxy see who is calling and trust the identity of the Pangolin client without a separate login hop at the application layer.

See private HTTP and forwarded headers.

Credential Regeneration on Community Edition

Sites, machine clients, and remote nodes can regenerate credentials from the dashboard on Community Edition. Open the entity's Credentials tab and choose Regenerate or Regenerate and Disconnect.

Regenerate issues a new ID and secret and invalidates the old ones; the connection stays up until you restart with the new values. Regenerate and Disconnect does the same and drops the live session immediately. You can use this when a secret was lost, rotated on a schedule, or needs to be replaced without deleting and recreating the site, machine, or node.

See site credentials and machine client credential rotation.

General Improvements and Bug Fixes

As always, this release also includes various UI improvements and bug fixes throughout the product.