fosrl/pangolin

Features

• WireGuard Management - Provides a centralized control plane for deploying and managing encrypted WireGuard tunnels across distributed sites.
• Tunnel Managers - Orchestrates WireGuard-based tunneling parameters including subnets and exit node configurations.
• Identity-Aware Web Exposure - Publishes internal web services with automatic SSL certificates and identity-aware access controls including SSO and MFA.
• Private Network Security - Provides secure, zero-trust access to internal network resources via managed tunnels.
• Secure Remote Access - Connects remote devices and automated systems to private network resources through secure VPN tunnels.
• Zero Trust Access - Provides secure, identity-aware access to private network resources without exposing them to the public internet.
• Control Planes - Provides a centralized control plane for managing global configuration, authentication, and telemetry across distributed network sites.
• Network Controllers - Orchestrates secure connectivity, traffic routing, and access policies as a cloud-native network controller.
• Declarative Infrastructure Reconciliation - Synchronizes network state and access policies using a declarative infrastructure model with continuous reconciliation.
• Resource Access Control Layers - Intercepts incoming requests to verify user identity and permissions before granting access to protected services.
• Identity and Access Management Servers - Manages user identities, access policies, and system configuration through a centralized dashboard and programmatic interface.
• Identity-Aware Proxies - Acts as a secure proxy enforcing authentication and access policies for internal services with automated TLS management.
• Identity Providers - Verifies user identity through internal or external providers to control access to network resources.
• Policy-Based Access Control - Applies identity-based authentication and context-aware rules to control user access to network resources.
• Private Network Tunnels - Creates zero-trust connections that route traffic to specific hosts or subnets after user authentication.
• Secure Proxy Exposure - Publishes internal web applications and APIs to the public internet via an authenticated reverse proxy with automated TLS certificate management.
• Network Access Connectors - Configures and deploys network access connectors within clusters using automated reconciliation tools.
• GitOps Controllers - Synchronizes infrastructure state by reconciling cluster resources from a repository to ensure the cluster matches desired configuration.
• Infrastructure Reconciliation Controllers - The platform manages cluster resources through a controller that supports both namespace-scoped and cluster-wide operation with configurable access permissions.
• Infrastructure as Code - Manages network resources and access policies through version-controlled configuration files for repeatable, declarative infrastructure deployments.
• Ingress Controllers - Directs incoming traffic to internal services by dynamically mapping domain names and paths to healthy backend endpoints.
• Multi-Cluster Deployment Managers - Coordinates the installation and lifecycle of services across multiple clusters to maintain consistent network policies.
• Kubernetes Application Deployments - Orchestrates application releases and configurations through declarative workflows for simplified cluster installations.
• NAT Traversal Mechanisms - Coordinates direct encrypted connections between nodes by discovering and punching through restrictive firewall configurations.
• Network Tunnels - Establishes secure, persistent point-to-point connections between geographically dispersed sites using WireGuard.
• Remote Access - Delivers terminal, desktop, and display sessions through a web interface with integrated authentication.
• Remote Access Clients - Provides browser-based access to internal services and remote desktops without requiring local client software.
• Service Exposure - Maps private network services to public subdomains through secure tunnels for authenticated access.
• Authenticated Proxy Exposure - Proxies web traffic to internal services via domain names while enforcing authentication and access policies directly within the browser.
• Traffic Routing - Routes traffic to specific internal hosts and subnets over encrypted tunnels while enforcing granular access policies.
• Traffic Routing Controllers - Orchestrates traffic routing and site-to-server tunnels using integrated reverse proxies and Kubernetes-native controllers.
• Device Posture Validation - Evaluates device configuration and security posture to ensure compliance before granting access.
• Network Access Control - Manages WireGuard tunnel connectivity and ingress routing through integrated controller support.
• OIDC Identity Integrations - Integrates external identity providers using OpenID Connect to verify user credentials and manage access.
• Secure SSH Access - Connects users to remote hosts via terminal over a private tunnel using friendly aliases.
• Secure Tunneling - Establishes and maintains encrypted connections between edge networks and the central server using cryptographic protocols.
• Tunneling and Proxying - Self-hostable reverse proxy with dashboard and automated SSL management.
• High Availability Clusters - Deploys multiple server nodes to enable horizontal scaling and high availability through automatic traffic failover.
• Infrastructure as Code - Automates network access component configuration and lifecycle management using version-controlled manifests.
• Infrastructure Deployment - Installs and configures network bridge software on local infrastructure to establish secure tunnels.
• Network Coordination Planes - Centralizes configuration, authentication, and connection management across distributed sites.
• Platform Settings - Configures core operational settings including dashboard URLs, logging levels, and telemetry for the platform instance.
• Peer-to-Peer Networking - Coordinates network address discovery to create direct tunnels that bypass central servers.
• Private Networks - Routes traffic from connected clients to specific machines on a remote network using secure tunnels.
• Remote Desktop Clients - Renders an interactive VNC client directly in the browser for remote display control.
• Subnet Routing - Assigns non-conflicting private IP ranges to sites and clients to prevent network address collisions.
• Traffic Routing Policies - Manages traffic routing and security rules for web services through a visual interface.
• Ephemeral Credential Issuers - Generates short-lived cryptographic keys for secure access to remote resources, eliminating long-term credential management.
• Device Access Policies - Revokes network permissions for specific devices identified as compromised or lost.
• Mutual TLS Authentication - Establishes secure connections using mutual TLS for identity verification.
• Resource Access Policies - Manages granular access policies for applications, hosts, and network ranges to ensure authorized service reachability.
• Identity Provider Integrations - Integrates with Microsoft identity services for organizational credential-based authentication.
• Multi-Factor Authentication - Mandates secondary identity verification during login to enhance organizational account security.
• Google OAuth Providers - Integrates Google as an identity provider for secure access to network resources.
• Remote Service Authentication - Registers and verifies remote nodes with a central server using unique identifiers and secrets.
• Hostname Aliasing - The platform maps raw destination IP addresses to human-readable hostnames to simplify user connections and resolve overlapping network conflicts.
• Remote Desktop Environments - Renders interactive desktop sessions directly in a web browser by proxying traffic to a host.
• System Audit Trails - Maintains a comprehensive audit trail of all configuration changes and management operations.
• Domain Configuration Tools - Maps wildcard subdomains and root domains to central server addresses to enable routing for remote network resources.
• Automated Deployment Pipelines - Synchronizes network access components with version control repositories to ensure consistent, version-controlled deployments.
• Rolling Update Controllers - Manages the gradual replacement of old application instances with new versions to ensure zero-downtime updates.
• Control Plane Deployment Tools - Installs core application, API, and authentication services within a cluster to manage remote access infrastructure.
• Helm Chart Management - Deploys and updates platform components using standardized Helm package templates.
• Release Lifecycle Management - Supports version upgrades, release history tracking, and automated rollbacks to ensure cluster stability.
• Gateway Deployment - Hosts private network gateways on local infrastructure to manage traffic and tunnel connections.
• Resource Definitions - Configures access to remote services by specifying destinations via IP addresses, CIDR ranges, or domain names.
• SSL Termination Proxies - Handles HTTPS certificate management and encryption at the edge to secure traffic before backend routing.
• DNS Resolution - Directs DNS queries through secure tunnels to upstream servers for internal name resolution.
• Load Balancers - Distributes incoming requests across multiple upstream targets and sites to ensure high availability.
• Network Addressing - Maps conflicting IP addresses or hostnames to specific sites using aliases to ensure unambiguous routing.
• Failover Proxies - Configures multiple site connectors for a single IP range to enable automatic path selection and failover.
• Automated Traffic Routing - Distributes network traffic across multiple available site connectors to ensure resilient access and automatic failover.
• Connection and Session Management - Records TCP and UDP traffic details including user identity and connection volume for auditing.
• Custom Domains - Maps custom domains and subdomains to internal network resources to simplify service access and resolution.
• Secure Tunnels - Configures network tunnels using domain names and port ranges for encrypted communication.
• Traffic Tunneling - Routes network traffic through central nodes when direct peer-to-peer connections are unavailable.
• Certificate Authority Management - Manages organization-specific certificate authority keys for secure communication.
• Device Approval Workflows - Requires administrative review and approval for new devices before granting network access.
• Identity Provider Group Mappings - Automates organization assignment based on identity provider group memberships and email domains.
• Network Access Controls - Applies ranked policies to permit or deny traffic based on IP, geolocation, or URL paths.
• Role-Based Access Control - Groups users into custom roles to manage permissions and control access to network resources based on organizational requirements.
• SSH Key Management - Generates and signs short-lived cryptographic keys for auditable, passwordless access to network resources.
• Wildcard Certificate Management - Automates wildcard TLS certificate provisioning using DNS-01 challenges.
• Failover Strategies - Maintains service connectivity during site-wide outages by routing traffic to backup targets in distinct network sites.
• Authentication Requirements - Enforces additional security checks like PINs or one-time passwords before accessing protected resources.
• Health Monitoring - Monitors the health of network targets and automatically excludes unresponsive endpoints from routing.
• Service Uptime Monitors - Probes network targets to verify availability and automatically remove unreachable endpoints from traffic rotation.
• Persistent Tunnel Services - Configures persistent network tunnels as system services to ensure continuous access without manual intervention.
• Enterprise Licensing - Enables enterprise-grade features and advanced capabilities through license key activation and container deployment.
• Persistent Storage Management - Manages persistent storage configurations to support both lightweight development and scalable production database backends.
• Storage Backend Adapters - Supports multiple database backends including PostgreSQL and SQLite for flexible storage configuration.
• Network Request Loggers - Records detailed metadata for HTTP requests to provide visibility into network activity.
• Multi-Environment Configuration Systems - Defines environment-specific settings and resource scaling within a unified configuration to streamline deployment stages.
• Docker Socket Orchestrators - Queries container metadata and network configurations from the Docker socket for service visibility.
• Containerized Deployments - Runs network connectivity agents within isolated container environments with necessary host-level permissions.
• Deployment Automation - Supports standard package-based installations and automated reconciliation workflows for consistent environment management.
• Native Installers - Deploys native graphical or command-line software to user devices to establish secure, authenticated connections.
• Git-Based Deployment Automations - Integrates with continuous delivery controllers to reconcile infrastructure state directly from version control.
• Production Cluster Deployers - Configures and installs platform components into a cluster using standard packaging tools.
• Manifest-Based Deployments - Manages infrastructure configurations by rendering manifests from templates and applying environment-specific patches.
• Service Deployment - Automates the setup and exposure of common applications using predefined resource labels and configuration structures.
• Remote Access Proxies - Exposes local applications to remote users via secure reverse proxy tunnels.
• Network Port Configuration - Opens specific communication channels for web traffic, SSL verification, and encrypted tunnels.
• Proxy Integrations - Integrates with third-party proxy services to route traffic while maintaining secure SSL/TLS connections and client identity.
• Proxy Routing Services - Connects internal containerized applications and host-based services to the remote access platform using internal hostnames.
• Subdomain Routing Gateways - Routes all hostnames under a specific subdomain through a single tunnel for centralized management.
• Client Configuration Settings - Distributes standardized client-side connection settings and behavior overrides to ensure consistent network access across devices.
• Traffic Proxying - Routes traffic for specific hostnames through remote sites to enable egress from controlled network locations.
• Traffic Distribution - Distributes traffic across multiple geographically dispersed nodes to reduce latency and improve throughput.
• Access Provisioning - Automates user authentication and identity propagation for private terminal sessions to eliminate manual key distribution.
• Bot Blocking - Integrates threat intelligence engines to identify and automatically block abusive IP addresses and bot activity in real time.
• Audit Logging - Exports system activity records to object storage for long-term retention and compliance.
• Authentication Security - Supports passwordless login using physical security keys to improve authentication security.
• Automated Secret Rotation - Updates master encryption keys by re-encrypting stored sensitive data and configuration values.
• Security Infrastructure - Extends traffic filtering to system-level services by integrating firewall bouncers with detection engines.
• API Key Scopes - Limits the scope of API keys to specific actions and resources to enforce least privilege.
• Customizable Login Interfaces - Provides branded login portals for users to select identity providers.
• Identity Provider Role Mapping - Assigns internal roles to users based on identity provider attributes using fixed assignments or custom logic.
• Intrusion Detection Systems - Analyzes incoming traffic patterns using a collaborative detection engine to identify and block potential security threats.
• Network Access Restrictions - Filters network traffic based on the physical location of the request origin.
• Autonomous System Restrictions - Blocks or permits network traffic based on the visitor's Autonomous System Number.
• Path-Based Access Rules - Matches URL patterns using wildcards to apply access rules to specific endpoints.
• Network Security Policies - Enforces communication boundaries between internal components using managed network policies.
• Identity Header Injections - Injects authenticated user metadata into HTTP headers for seamless backend integration.
• Configuration Manifests - Applies environment-specific patches and overlays to rendered manifests to manage infrastructure configurations.
• Custom Middleware Implementations - Injects custom processing logic into the request pipeline to modify or secure traffic for specific network resources.
• Real-Time Monitoring Dashboards - Provides centralized dashboards for visualizing real-time request metrics and server performance.
• System Activity Monitoring - Records successful and failed access attempts by users and API keys for security auditing.
• Path-Based Routers - Directs traffic to different backend services based on URL path prefixes.

Star history