Expose Home Services

How Pangolin Resources Work

A resource in Pangolin maps a public subdomain to a private service on your home network. When you create a resource, you specify:

• • Name: A human-readable label (e.g., "Jellyfin").
• • Site: Which Newt tunnel site has LAN access to the service.
• • Subdomain: The public-facing URL (e.g., jellyfin.tunnel.yourdomain.com).
• • Target: The internal IP and port of the service (e.g., 192.168.1.50:8096).
• • SSL: Whether to use HTTPS between Traefik and the backend (usually left off for local services).
• • Auth Policy: Platform SSO, Public, or Shareable Link.

Service 1: Jellyfin (Media Streaming)

Jellyfin is the most popular open-source media server in the homelab community. Exposing it through Pangolin gives you Netflix-like access to your media library from anywhere.

Create the Resource

1. In the Pangolin dashboard, navigate to Resources → Add Resource.
2. Name: Jellyfin
3. Site: Select your Home Lab site.
4. Domain: jellyfin.tunnel.yourdomain.com
5. Target: http://192.168.1.50:8096 (replace with your Jellyfin server's LAN IP and port).
6. SSL to backend: Off (Jellyfin runs HTTP locally).
7. Authentication: Platform SSO – All Members

Configure Jellyfin for Reverse Proxy

Jellyfin needs to know it's behind a reverse proxy to generate correct URLs. In Jellyfin's admin dashboard:

1. Go to Administration → Networking.
2. Set Base URL to empty (leave blank).
3. Under Known Proxies, add the IP of your Newt container or the Docker bridge gateway (typically 172.17.0.1).
4. Ensure Allow remote connections is enabled.

Service 2: Home Assistant (Smart Home Control)

Home Assistant controls your entire smart home, which makes it both incredibly useful to access remotely and critically important to secure. Pangolin's identity-aware proxy is a natural fit.

Create the Resource

1. Name: Home Assistant
2. Domain: ha.tunnel.yourdomain.com
3. Target: http://192.168.1.60:8123
4. Authentication: Platform SSO – Admin Only

Critical: WebSocket Support

Home Assistant relies heavily on WebSocket connections for its real-time dashboard. Pangolin and Traefik handle WebSocket upgrades automatically, so no additional configuration is needed on the Pangolin side. However, you must verify that Home Assistant's configuration.yaml trusts the proxy:

# In Home Assistant's configuration.yaml
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.17.0.0/16      # Docker bridge network
    - 10.0.0.0/8         # WireGuard tunnel range
    - 192.168.1.0/24     # Local LAN

Restart Home Assistant after making this change. Without trusted_proxies, Home Assistant will reject forwarded requests and you'll see 400 Bad Request errors.

Service 3: Nextcloud (File Sync and Collaboration)

Nextcloud is a comprehensive file hosting, calendar, contacts, and collaboration platform. It's the most configuration-sensitive of our three services because it strictly validates the domains it will respond to.

Create the Resource

1. Name: Nextcloud
2. Domain: cloud.tunnel.yourdomain.com
3. Target: http://192.168.1.70:8080
4. Authentication: Platform SSO – All Members

Configure Nextcloud Trusted Domains and Proxy

Nextcloud will refuse to serve pages if the incoming hostname isn't in its trusted_domains list.

// In Nextcloud's config/config.php
'trusted_domains' => array(
  0 => '192.168.1.70:8080',
  1 => 'cloud.tunnel.yourdomain.com',
),
'trusted_proxies' => array(
  0 => '172.17.0.0/16',
  1 => '10.0.0.0/8',
),
'overwriteprotocol' => 'https',
'overwritehost'     => 'cloud.tunnel.yourdomain.com',
'overwrite.cli.url' => 'https://cloud.tunnel.yourdomain.com',

The overwriteprotocol and overwritehost settings ensure Nextcloud generates correct HTTPS URLs even though it receives plain HTTP from the tunnel. Without these, you'll get mixed content warnings and broken redirects.

Adding More Services

The pattern is the same for any service you want to expose. Here are quick-reference configurations for other popular homelab applications:

Wildcard Domains and Automatic Routing

If you set up the wildcard DNS record (*.tunnel.yourdomain.com) in Part 1, adding new services is frictionless. Just create a resource in Pangolin with any subdomain and it immediately resolves and gets an SSL certificate via Let's Encrypt. No DNS changes needed.

Pangolin and Traefik handle certificate issuance and renewal automatically. Certificates are stored in the letsencrypt/acme.json file and renewed before expiration with no manual intervention.

Performance Considerations

Running all traffic through a VPS adds latency compared to direct LAN access. Here are some tips to minimize the impact:

What's Next