Pangolin Site (CLI)

Deploys a Pangolin Site as a dedicated LXC using the official Pangolin CLI (pangolin up site — Newt embedded in the CLI, the recommended replacement for Newt). Connects outbound to your Pangolin control plane to expose private resources without port forwarding.

Site ↗ Documentation ↗ Voir le code du script ↗

Installer

bash -c "$(curl -fsSL https://raw.githubusercontent.com/oraad/proxmox-scripts/main/ct/pangolin-site.sh)"

bash -c "$(curl -fsSL https://raw.githubusercontent.com/oraad/proxmox-scripts/main/ct/pangolin-site.sh)"

Dans le shell du nœud Proxmox. Exécutez cette commande dans le shell du nœud Proxmox, pas dans une VM. Lisez le script d'abord.

À savoir

• Create a site in the Pangolin dashboard first, then copy the Site ID, secret, and endpoint. You will be prompted for these during install.
• Newt is being phased out in favor of the Pangolin CLI. This LXC runs the site tunnel as pangolin up site, which accepts the same flags and environment variables as the standalone newt binary. Existing standalone Newt LXCs are migrated in place on their next /usr/bin/update run.
• Primary updates: the Pangolin dashboard keeps the embedded Newt engine updated. The CLI binary itself is updated with /usr/bin/update inside the LXC (or pct exec <CTID> -- update).
• Manual fallback: run update inside the LXC, or pct exec <CTID> -- update from the Proxmox host. Also works with the PVE LXC Apps Updater (dry-run supported via check_for_gh_release).
• Pangolin Site has no local web UI — it only maintains an outbound tunnel to Pangolin. Check status with systemctl status pangolin-site (Debian) or rc-service pangolin-site status (Alpine).
• TUN device passthrough, nesting, and keyctl are enabled by default for tunnel routing (override with var_tun=no, var_nesting=0, etc.). Site mode itself is userspace WireGuard. Prefer this dedicated LXC over host install for isolation.
• IPv4 forwarding and NAT masquerade (iptables -t nat -A POSTROUTING -j MASQUERADE) are configured inside the container and persist across reboots. Add host/LAN routes to this CT's IP for bidirectional tunnel routing.
• Unattended: var_pangolin_endpoint=https://pangolin.example.com var_site_id=ID var_site_secret=SECRET bash -c "$(curl -fsSL https://raw.githubusercontent.com/oraad/proxmox-scripts/main/ct/pangolin-site.sh)"
• Alpine template: run pveam update, then pveam available --section system | grep alpine-3.24. Download if missing: pveam download local alpine-3.24-default_20260116_amd64.tar.xz (use the exact name from pveam available on your arch). Fallback: var_version=3.22 if 3.24 is not listed on an older Proxmox host.
• To install on the Proxmox host or an existing LXC instead, use the Pangolin Addon (site mode).
• This is the site tunnel agent (expose resources to Pangolin). To join a host or LXC into the Pangolin network as a machine client, use the Pangolin Addon (client mode).