Setup Pangolin with exisiting traefik instance

[Checker8763]

Hey to everybody interested in the topic or trying to achieve the same thing.

Setup:
I have an existing server setup with docker and traefik and other services.

• Pangolin is setup with docker (-compose)
• Pangolin can talk to gerbil.
• Pangolin can push configuration to traefik via HTTP provider
• Gerbil is accessible and can accept newt connections.
• Traefik has the badger plugin installed (and configured via pangolins HTTP provider)

pangolin is full functional and accessible but my traefik instance is not able to route the VPN IPs of gerbil to the gerbil container.

And that seems to be not easily accomplished...

Any help hint or tips appreciated!

[hhftechnology]

Hey to everybody interested in the topic or trying to achieve the same thing.

Setup: I have an existing server setup with docker and traefik and other services.

• Pangolin is setup with docker (-compose)
• Pangolin can talk to gerbil.
• Pangolin can push configuration to traefik via HTTP provider
• Gerbil is accessible and can accept newt connections.
• Traefik has the badger plugin installed (and configured via pangolins HTTP provider)

pangolin is full functional and accessible but my traefik instance is not able to route the VPN IPs of gerbil to the gerbil container.

And that seems to be not easily accomplished...

Any help hint or tips appreciated!

traefik should exit through gerbil if you want a tunnel.

  gerbil:
    image: fosrl/gerbil:1.0.0
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 443:443 # Port for traefik because of the network_mode
      - 80:80 # Port for traefik because of the network_mode

  traefik:
    image: traefik:v3.3.3
    container_name: traefik
    restart: unless-stopped

    network_mode: service:gerbil # Ports appear on the gerbil service

    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs

[hhftechnology]

it will break stuff, that's for sure. you will have to navigate with setting up routers and services for the apps which will not use pangolin. and you will be fine. traefik is traefik, pangolin developers have not altered traefik image, so all the principles remain the same.

[Checker8763]

When I make my existing and only traefik instance routed through gerbil container, then all my other service not only depend on traefiks stability but on gerbils to, because if the container stops all traffic is dropped, even tho traefik does not have any problems.

That is why can not consider this a stable solution...

---

My motivation to have that setup is not having to buy another server solely to run pangolin,,,

[hhftechnology]

i am running pangolin with Cloudflared tunnels and tailescale without any issues. no gerbil needed if that's what you are looking for.

[gtbdf1]

So it essentially binds Traefik's entire network stack to Gerbil's container? If Gerbil dies, Traefik dies with it. If WireGuard fails or stalls, all of Traefik’s traffic halts — not just Pangolin-related routing. Your entire external-facing access to everything routed through Traefik becomes fragile. That's a big red flag in terms of high availability, fault tolerance, and modularity.

[K-MeLeOn]

Very interesting, that's a question I'm actually asking myself.
@hhftechnology, you mention that you use a Cloudflare tunnel in front of your Pangolin instance, isn't that what Pangolin is trying to solve ?
@gtbdf1, Gerbil needs to be in front of the external endpoint to manage the VPN (obfuscable via port 443 probably), maybe a Gerbil cluster is needed.
For now, I think if you want protection against attacks that can bring down your Gerbil instance is a LB and a mitiger in front of your host. Achievable via Cloudflare perhaps. But if you want HA, how about a mirror server?

[Checker8763]

So I think I might have a solution, this will still have two traefik instances running but hopefully with as less frictions as possible:

• Set up main instance to forward everything of a specific subdomain to the pangolins traefik instance.
  • traefik.http.router.rule: HostRegex(`sub.main.tld`)
• Configure pangolin as always with that subdomain

This way pangolin should receive any traefik to that subdomain and can then handle its own routing without the need to configure every subdomain by hand.

That would split pangolin from my main traefik instance and also allow for more fine-grain permissions/networking (like creating its own pangolin network).

Pleas let me know of any concerns or tips or infos.

Anyways, I will try it later this day...

[scmanjarrez]

But then all exposed services through pangolin will be under sub.main.tld?

[Checker8763]

Yes I have it currently setup with just my existing traefik instance that I installed tge Badger Plugin and configured to use and put it behind the VPN Service( forgot the name something with G)

Currently with just this one traefik instance I have configured it to use the proxy.main.tld with the services being available under service.proxy.main.tld.

But I find it undesirable just because if the vpn service crashes my other services that are not depent on pangoline will go down.

[renolation]

i have same wonder, anyone made it work?

[daniel-san05]

I would go for setting up HAProxy on the VPS as TCP loadbalancer in front of both Traefik containers like the blogger LinuxBabe is describing it in a sample post at:
https://www.linuxbabe.com/linux-server/run-apache-nginx-haproxy-on-same-server-debian-ubuntu-centos
In the dynamic configuration files of both Traefik containers the trustedip config option needs to be set in the entrypoints section for getting the real client‘s ip address from HAProxy.
Never had done that by myself so far but in theory it should work and would save a second extra VPS.