[GH-ISSUE #398] Feature Request: "Master gateway VM" including Netbird or Headscale self-hosted capabilities alongside Pango #1430

New Issue

2026-04-16T08:04:20-05:00

GiteaMirror commented

2026-04-16 08:04:20 -05:00

Originally created by @TheLinuxGuy on GitHub (Mar 24, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/398

This FR is asking for an "All-in-one" self-hosting solution docker-compose stack that could be installed on a single VM instance. The proposal is:

Extend the installation script with an additional module for nerdbird self-hosted.

This would enable users to acquire a single VM from Racknerd or another provider and with a single stack installation on that unique public IP VM host both a reverse proxy (pangolin stack) + zero-trust VPN for device-to-device communications. This would make it "a killer all-in-one solution"™️

The current version of pangolin depends on the following network ports: 80, 443, 51820, 6060 (crowdsec) - running netbird docker-compose alongside the pangolin stack will require some changes as there are conflicts.

Netbird self-hosted requires: TCP ports 80, 443, 33073, 10000 and 33080; and UDP ports: 3478, 49152-65535.

There is a conflict with ports 80 and 443 because both netbird and pangolin stack require both to work. This FR is raised in the hopes of a recommended well-lit path, such as a Netbird module in pangolin is added to the install.

Originally created by @TheLinuxGuy on GitHub (Mar 24, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/398 This FR is asking for an "All-in-one" self-hosting solution docker-compose stack that could be installed on a single VM instance. The proposal is: - Extend the installation script with an additional module for [nerdbird self-hosted](https://docs.netbird.io/selfhosted/selfhosted-quickstart). This would enable users to acquire a single VM from Racknerd or another provider and with a single stack installation on that unique public IP VM host both a reverse proxy (pangolin stack) + zero-trust VPN for device-to-device communications. This would make it "a killer all-in-one solution"™️ The current version of pangolin depends on the following network ports: 80, 443, 51820, 6060 (crowdsec) - running netbird docker-compose alongside the pangolin stack will require some changes as there are conflicts. Netbird self-hosted requires: TCP ports 80, 443, 33073, 10000 and 33080; and UDP ports: 3478, 49152-65535. There is a conflict with ports 80 and 443 because both netbird and pangolin stack require both to work. This FR is raised in the hopes of a recommended well-lit path, such as a Netbird module in pangolin is added to the install.

GiteaMirror closed this issue

2026-04-16 08:04:20 -05:00

GiteaMirror commented

2026-04-16 08:04:21 -05:00

@oschwartz10612 commented on GitHub (Mar 24, 2025):

Hi!

Thank you for your feature request and your time submitting this idea. We appreciate your interest in the project.

Unfortunately while I think this is a interesting idea it would be outside of the scope of our project because it involves other solutions and projects. I could see this being a tutorial or in a separate repo but not tightly integrated.

We also plan to have some sort of tunneling client solution integrated into pangolin in the coming months which would hopefully not require netbird to be involved.

I am going to close this for now but feel free to repost this in the discussion if you feel strongly and maybe other users could voice support there.

@oschwartz10612 commented on GitHub (Mar 24, 2025): Hi! Thank you for your feature request and your time submitting this idea. We appreciate your interest in the project. Unfortunately while I think this is a interesting idea it would be outside of the scope of our project because it involves other solutions and projects. I could see this being a tutorial or in a separate repo but not tightly integrated. We also plan to have some sort of tunneling client solution integrated into pangolin in the coming months which would hopefully not require netbird to be involved. I am going to close this for now but feel free to repost this in the discussion if you feel strongly and maybe other users could voice support there.