Currently, the tunnels are unidirectional: Resources can be added to (newt or wireguard) Sites and exposed via the public Traefik reverse-proxy but as far as I can see no way for Sites to access other Sites via the Pangolin network.
We would like to have Sites able to securely access select Resources at other select Sites over the internal Wireguard network instead of having to go via the public network and the Traefik gateway.
Use-cases are for internal service-to-service access.
This would make it possible to use Pangolin like a service mesh.
One way I imagine this could be implemented would be adding configuration to newt such that it can open ports listening on localhost which would be proxied to a corresponding Resource.
Originally created by @3nprob on GitHub (Jun 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/849
Currently, the tunnels are unidirectional: Resources can be added to (newt or wireguard) Sites and exposed via the public Traefik reverse-proxy but as far as I can see no way for Sites to access other Sites via the Pangolin network.
We would like to have Sites able to securely access select Resources at other select Sites over the internal Wireguard network instead of having to go via the public network and the Traefik gateway.
Use-cases are for internal service-to-service access.
This would make it possible to use Pangolin like a service mesh.
One way I imagine this could be implemented would be adding configuration to newt such that it can open ports listening on `localhost` which would be proxied to a corresponding Resource.
Related:
- #771
@github-actions[bot] commented on GitHub (Jun 20, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:2989472891 -->
@github-actions[bot] commented on GitHub (Jun 20, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
Thanks, so this doesn't go stale again I'll convert this to a feature request discussion so others can upvote/continue the conversation
<!-- gh-comment-id:2994291924 -->
@miloschwartz commented on GitHub (Jun 22, 2025):
Thanks, so this doesn't go stale again I'll convert this to a feature request discussion so others can upvote/continue the conversation
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @3nprob on GitHub (Jun 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/849
Currently, the tunnels are unidirectional: Resources can be added to (newt or wireguard) Sites and exposed via the public Traefik reverse-proxy but as far as I can see no way for Sites to access other Sites via the Pangolin network.
We would like to have Sites able to securely access select Resources at other select Sites over the internal Wireguard network instead of having to go via the public network and the Traefik gateway.
Use-cases are for internal service-to-service access.
This would make it possible to use Pangolin like a service mesh.
One way I imagine this could be implemented would be adding configuration to newt such that it can open ports listening on
localhostwhich would be proxied to a corresponding Resource.Related:
@3nprob commented on GitHub (Jun 5, 2025):
Possibly duplicate of #345
@github-actions[bot] commented on GitHub (Jun 20, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@3nprob commented on GitHub (Jun 20, 2025):
not stale
@miloschwartz commented on GitHub (Jun 22, 2025):
Thanks, so this doesn't go stale again I'll convert this to a feature request discussion so others can upvote/continue the conversation