Overview
Pangolin is a self-hosted tunneling reverse proxy that uses WireGuard under the hood to securely expose internal services without opening firewall ports. It includes an identity-aware access control layer, a web dashboard for managing tunnels and users, and serves as an open-source alternative to Cloudflare Tunnel and Tailscale. Services can be made accessible via subdomains with granular per-service authentication policies. Deploys via Docker Compose.
Where it falls short of Heroku
- Requires a publicly accessible VPS to act as the tunnel endpoint, adding infrastructure overhead
- No managed global edge network; latency depends on your VPS location
- Ecosystem and third-party integrations are much smaller than Cloudflare Tunnel or Tailscale
- Mobile client support and device management are limited compared to Tailscale
We list the gaps honestly so you can decide if the trade-off is worth owning your data.
Tags
Claim this listing to keep it accurate, add a deploy template, or feature it on relevant pages.
Embed the Pangolin difficulty badge in your README — it links back here.
[](https://openreplace.com/pangolin)Similar open-source projects
Other self-hostable tools in the same space worth comparing.
Automatic HTTPS web server and reverse proxy with zero config TLS
Cloud-native HTTP reverse proxy and load balancer for microservices
Self-hostable Heroku/Netlify alternative for apps, databases, and services
Modern Linux server and web-app management panel with app store deploys