Hello everyone!

The headline feature is exit nodes: a device can now send its full internet traffic out through one or more sites you choose. The tunnel can also come up automatically instead of waiting for someone to open the app and connect. Windows and Mac got a major UI overhaul, and iOS and Android picked up a lot of new features.

Pangolin is an open-source, identity-aware remote access platform that simply and securely connects and authenticates your users to applications, infrastructure, and AI workloads.

GitHub: https://github.com/fosrl/pangolin

Exit Nodes

Pangolin is a split tunnel by default. Traffic between your sites and clients goes through Pangolin, and everything else stays on the device's normal internet connection. But now if you want a full tunnel, create a private resource, set the type to Exit Node, and attach one or more sites. A client that selects that resource sends its internet traffic out through one of those sites so the device appears to be on the site's network. If the resource has more than one site, the client picks the one with the lowest latency, highest throughput, and availability. This will finally let you build your own full-tunnel VPN!

Connect Automatically

Mac and iOS include on-demand support, so the system can bring the tunnel up when a network appears instead of waiting for you to open the app and tap Connect.

Windows has Start at Login plus Connect at Start, which together launch Pangolin and connect at sign-in. On Android, turn on Always-on VPN in the system VPN settings.

Improved Client Apps

Windows includes a major UI overhaul. It rebuilds the preferences window and system tray from scratch to match the Mac client. The Mac menu bar app also got a major UI overhaul and is more fluid and feature-rich.

iOS adds home screen widgets, a Control Center control, Shortcuts actions for connect, disconnect, and status (usable with Siri), and Dynamic Island and Lock Screen Live Activity status. Android brings a connection tile you can add to your quick actions to start the tunnel.

Subnet Router

A Linux machine client can now advertise a subnet, so devices on that network can reach Pangolin resources without running the client themselves. That is handy for a printer, a camera, or a VPC where you don't want to install software on every host.

Add --subnet-router when you start the machine client using Pangolin CLI.

Full Release Notes

Read the full article here: https://pangolin.net/news/1-24-release

Available for self-hosting via Community or Enterprise editions, or on Pangolin Cloud (Enterprise is free for personal use). If you haven't starred us on GitHub yet, it genuinely helps!

Hello everyone!

Pangolin 1.22 introduces a new resource type: AI Gateway. These resources are identity-aware proxies in front of both cloud model APIs and self-hosted model servers, so coding agents and AI clients call a Pangolin URL. A gateway resource can be keyless by authenticating via the Pangolin client or keyed by minting virtual API keys.

We're also moving SSH, RDP, VNC, and private HTTPS resources from Enterprise to Community Edition.

Pangolin is an open-source, identity-aware remote access platform that simply and securely authenticates your users to infrastructure, apps, and AI resources.

GitHub: https://github.com/fosrl/pangolin

New AI Gateway Resources

Attach cloud providers (OpenAI, Anthropic, Gemini, Bedrock, and others) or self-hosted models over a site connector (Ollama, vLLM, and others) to a Pangolin resource, and point your agents at it instead of the raw provider. Pangolin centralizes the upstream secrets, controls who can call what, enforces restrictions, and logs usage.

This is available entirely in the Community Edition.

• Public Gateway resources expose a public URL and authenticate with identity-scoped virtual API keys per user or service.
• Private Gateway resources are keyless, reachable only over the Pangolin client tunnel, so tools like Claude Code and Codex authenticate with zero key management (pangolin configure claude sets it up for you).
• Budgets, analytics, and session logs let you cap spend and see what ran, by provider, model, user, or key.

Docs: https://docs.pangolin.net/manage/ai/overview

SSH, RDP, VNC & Private HTTPS now in Community Edition

Browser-based SSH, RDP, and VNC (public resources) and SSH/HTTPS over the Pangolin client (private resources) were previously Enterprise-only since 1.19. Based on community feedback, we have moved them to the Community Edition.

Full announcement: https://pangolin.net/news/1-22-release

Available for self-hosting via Community or Enterprise editions (Enterprise is free for personal use) or on Pangolin Cloud. If you haven't starred us on GitHub yet, it genuinely helps!

Hello everyone!

Pangolin 1.20 is focused on how people find and reach their resources in the UI. Here's what's new:

Pangolin is an open-source, identity-based remote access platform that lets you securely expose your infrastructure to your team. It supports browser based remote access and a remote access VPN in one platform with strong authentication controls.

GitHub: https://github.com/fosrl/pangolin

Resource Launcher

The landing page non-admins see when they sign in now is vastly more capable. Resources are grouped by site or label, searchable, and filterable, with grid or list view. Save your setup as a personal default or a named view you can switch between. Admins can also save and set org-wide default views. The launcher is now visible to admins in addition to non-admins.

Command Palette

Admins get a global command palette. Hit ⌘K / Ctrl+K anywhere in the dashboard to jump straight to a page or search for a resource or site by name. No more digging through the sidebar to find something you already know the name of.

Private Resource Pages

Private resources moved out of the old pop-up modal and onto dedicated pages, matching the layout and navigation used everywhere else in the dashboard.

Labels Are Now Community Edition

All features above are in the CE.

Labels, introduced in 1.19, have moved from Enterprise Edition to Community Edition from community feedback.

As always, available for self-hosting via the Community or Enterprise Editions or on Pangolin Cloud. The Enterprise Edition is free for personal use.

Plus the usual round of general improvements and bug fixes.

Full release notes: https://pangolin.net/news/1-20-release

Hello everyone!

The goal of this repo is to make deploying common self-hosted apps like Grafana, Immich, or Nextcloud as easy as possible while ensuring they are securely exposed with Pangolin and SSO out of the box.

New GitHub Repo: https://github.com/fosrl/blueprints

What are Blueprints?

Blueprints have been in Pangolin for while now, but for those who don’t know:

Usually, when you want to expose a service, you have to go into a dashboard, set up the domain, configure the target, and handle the auth settings manually.

Blueprints are declarative. They use Docker Compose labels to tell Pangolin exactly how to configure the resource. You just bring the container up, and the resource (and its subdomains) automatically appears in your Pangolin dashboard, fully configured.

Quick Start

1. Clone the repo: git clone https://github.com/fosrl/blueprints
2. Set your domain: Update the root .env with your base domain and Pangolin site credentials.
3. Pick a service: Run ./bin/blueprint init immich (for example).
4. Deploy: Run ./bin/blueprint up immich.

That’s it. Your service is now live at immich.yourdomain.com with Single Sign-On enabled by default.

What should we add next?

Right now, the library is focused on the essentials, but we want to expand this to cover the full self-hosted spectrum. We’d love to hear from the community:

What are the must-have apps you think should be added to the repo next?

Let us know what you're running. Even better, if you already have a working Docker Compose setup for a service, please consider contributing it! We’ve included a scaffolding command (./bin/blueprint new <name>) to make it easy to format your setup into a blueprint and open a PR.