Pangolin 1.25: Redirects, mTLS, and Machine Roles
Hello everyone!
Pangolin 1.25 is here with two highly requested features from this community: HTTP redirects and mutual TLS (mTLS) for public resources. It also includes roles for machine clients and more!
Pangolin is an open-source, identity-aware remote access platform that simply and securely connects and authenticates your users to applications, infrastructure, and AI workloads.
GitHub: fosrl/pangolin
Redirects
Redirects can be attached to a public resource and share its hostname, so you can send traffic from one path to another at the proxy level. You can also create redirects on any domain or subdomain that Pangolin controls, even if there is no resource behind it.
Each redirect uses one of three matching rules. Exact matches a single path, prefix matches everything under a path, and regex lets you write a pattern for more complex cases.
Mutual TLS (mTLS) for Public Resources
Public HTTP resources can now require clients to present a TLS certificate signed by a CA you trust. Normally, anyone with the URL can reach the authentication page. With mTLS, the connection fails unless the client has a valid certificate from your CA, so unknown devices are blocked before they reach your resource.
Machine Client Roles
Machine clients can now be assigned roles just like your users. This way, servers and automation can share the same private resource access as a group of users. Their access is the union of direct grants and roles. You can still assign machines directly to resources.
Full Release Notes
Read the full article here: pangolin.net
Available for self-hosting via Community or Enterprise editions, or on Pangolin Cloud (Enterprise is free for personal use). If you haven't starred us on GitHub yet, it genuinely helps!
123 points · 20 comments
Mentions
Pangolin - CVE-2026-111497 - Node2Shell: Node.js Brotli vulnerability allows remote code execution Node.js released security fixes on Oct 21, including CVE-2026-111497, a Brotli decoder bug rated High with possible RCE. Pangolin 1.25.2 (and current main) still pins node:24.18.1-slim, so the current image looks affected. Has anyone heard when a patched release is planned? I’ve shut down my Pangolin instance for now. Update: Linked PR: pangolin#3970
Pangolin 1.25: Redirects, mTLS, and Machine Roles Hello everyone! Pangolin 1.25 is here with two highly requested features from this community: HTTP redirects and mutual TLS (mTLS) for public resources. It also includes roles for machine clients and more! Pangolin is an open-source, identity-aware remote access platform that simply and securely connects and authenticates your users to applications, infrastructure, and AI workloads. GitHub: fosrl/pangolin Redirects Redirects can be attached to a public resource and share its hostname, so you can send traffic from one path to another at the proxy level. You can also create redirects on any domain or subdomain that Pangolin controls, even if there is no resource behind it. Each redirect uses one of three matching rules. Exact matches a single path, prefix matches everything under a path, and regex lets you write a pattern for more complex cases. Mutual TLS (mTLS) for Public Resources Public HTTP resources can now require clients to present a TLS certificate signed by a CA you trust. Normally, anyone with the URL can reach the authentication page. With mTLS, the connection fails unless the client has a valid certificate from your CA, so unknown devices are blocked before they reach your resource. Machine Client Roles Machine clients can now be assigned roles just like your users. This way, servers and automation can share the same private resource access as a group of users. Their access is the union of direct grants and roles. You can still assign machines directly to resources. Full Release Notes Read the full article here: pangolin.net Available for self-hosting via Community or Enterprise editions, or on Pangolin Cloud (Enterprise is free for personal use). If you haven't starred us on GitHub yet, it genuinely helps!
In my case Pangolin as a secured gateway to my homelab services. fosrl/pangolin