Pangolin, an open-source, self-hostable tunneled reverse proxy and secure access platform built on WireGuard, has released version 1.25.
One notable addition is HTTP redirect support, allowing administrators to redirect requests between domains or paths directly through Pangolin without configuring a separate reverse proxy, available in the Settings > Redirects section of the dashboard.
Redirects can be attached either to a domain hostname or to a specific public resource. Administrators can define hostname and path matching rules, rewrite URL paths, and configure permanent or temporary redirects.
Another major improvement is mutual TLS authentication for public resources, which allows administrators to require clients to present a valid TLS certificate before accessing a protected service.
To configure this, administrators upload one or more trusted certificate authority certificates through the resource’s authentication settings. Clients must then provide a certificate signed by one of those authorities during the TLS handshake.
The release also introduces role assignments for machine clients, extending Pangolin’s existing role-based access management beyond individual users.
Machine clients can inherit permissions from assigned roles instead of requiring administrators to configure access to every private resource individually. Effective permissions combine role-based grants with any permissions assigned directly to the machine client.
On the traffic management side, Pangolin 1.25 introduces four configurable load balancing strategies for HTTP and HTTPS public resources with multiple eligible targets within the same routing group.
The available options are:
- Round Robin – Distributes requests evenly across available targets.
- Power of Two Choices – Selects the less busy of two randomly chosen targets.
- Client IP Hash – Consistently directs clients to the same target.
- Least Response Time – Favors faster targets with fewer active connections.
Note that full support for these load-balancing strategies requires Traefik 3.6 or newer, which must be updated manually.
Another useful addition lets you export public and private resources as YAML blueprints directly from the dashboard, so administrators can reuse existing resource configurations through Pangolin’s dashboard, API, CLI, or site blueprints.
Furthermore, private HTTP resources can now forward authenticated client identities to upstream applications using the Remote-User, Remote-Email, Remote-Name, and Remote-Role headers.
Finally, Pangolin 1.25 brings credential regeneration to Community Edition users. Administrators can regenerate credentials for sites, machine clients, and remote nodes directly from the dashboard.
Two options are available: Regenerate, which replaces the existing credentials while keeping the active connection running, and Regenerate and Disconnect, which also terminates the current session immediately.
Apart from these additions, the release includes various interface improvements and bug fixes.
For more information, see the Pangolin 1.25 release announcement.
For users upgrading existing installations, one more compatibility detail is worth mentioning. Permanent HTTP redirects require Badger 1.8 or newer. Pangolin’s automatic migration can update Badger when it finds the Traefik configuration in its standard location; otherwise, a manual update is necessary.
