[GH-ISSUE #555] Feature Request - Cloudflare Verification #8267

Closed
opened 2026-04-30 03:49:28 -05:00 by GiteaMirror · 3 comments
Owner

Originally created by @Dimtar on GitHub (Apr 21, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/555

Hi all.

I would love to see one day Pangolin support Cloudflare DNS verification. The idea behind this is so Pangolin could be used inside a tailnet etc. in replacement of Caddy/NPM to serve pages with legitmate SSL certs but not actually exposed to the internet.
I realize some may argue this goes against the design of Pangolin but here is the request.

Originally created by @Dimtar on GitHub (Apr 21, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/555 Hi all. I would love to see one day Pangolin support Cloudflare DNS verification. The idea behind this is so Pangolin could be used inside a tailnet etc. in replacement of Caddy/NPM to serve pages with legitmate SSL certs but not actually exposed to the internet. I realize some may argue this goes against the design of Pangolin but here is the request.
Author
Owner

@jacobalberty commented on GitHub (Apr 22, 2025):

https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs#wildcard-config-for-dns-01-challenge

I believe it does support it, the docs provide cloudflare as an example.

<!-- gh-comment-id:2819844056 --> @jacobalberty commented on GitHub (Apr 22, 2025): https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs#wildcard-config-for-dns-01-challenge I believe it does support it, the docs provide cloudflare as an example.
Author
Owner

@ex-aequo-et-bono commented on GitHub (Apr 22, 2025):

Confirming this does work, I have a Pangolin instance that is only exposed to my local network and I generate certificates using DNS challenges. Pangolin uses vanilla Traefik under the hood for non-tunneled connections (and uses Traefik in conjunction with the tunneling services if that's the setup intended) and Traefik fully supports DNS certificates without opening ports. It's a bit more non intuitive yaml configuration to get it set up when compared to Caddy or a NPM setup, but it is supported.

<!-- gh-comment-id:2820113070 --> @ex-aequo-et-bono commented on GitHub (Apr 22, 2025): Confirming this does work, I have a Pangolin instance that is only exposed to my local network and I generate certificates using DNS challenges. Pangolin uses vanilla Traefik under the hood for non-tunneled connections (and uses Traefik in conjunction with the tunneling services if that's the setup intended) and Traefik fully supports DNS certificates without opening ports. It's a bit more non intuitive yaml configuration to get it set up when compared to Caddy or a NPM setup, but it is supported.
Author
Owner

@Dimtar commented on GitHub (Apr 22, 2025):

Thank you everyone. This is working fantastically.
I hope one day Pangolin expose that as a toggle in the interface or an option in the installer but for now it wasn’t very hard and I’m very happy.

<!-- gh-comment-id:2820554882 --> @Dimtar commented on GitHub (Apr 22, 2025): Thank you everyone. This is working fantastically. I hope one day Pangolin expose that as a toggle in the interface or an option in the installer but for now it wasn’t very hard and I’m very happy.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#8267