# Enhancing Your Pangolin Deployment with Middleware Manager

**URL:** <https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324>\
**Category:** Networking\
**Tags:** middleware-manager, traefik, pangolin\
**Created:** [April 13, 2025, 7:09pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324 "2025-04-13T19:09:48Z")\
**Posts on this page:** 16\
**Page:** 5

<div class="post-metadata">

**Author:** ![po\_tato](https://forum.hhf.technology/user_avatar/forum.hhf.technology/po_tato/32/675_2.png) [@po\_tato](https://forum.hhf.technology/u/po_tato)\
**Post date:** [September 21, 2025, 3:39pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/84 "2025-09-21T15:39:54Z")

</div>

The protection status in MM only has to do with MM. Something not being protected in MM shows as not protected meaning no middleware has been added. The protection status in MM doesn’t reflect Pangolin’s SSO protection.

---

<div class="post-metadata">

**Author:** ![irdet2](https://forum.hhf.technology/user_avatar/forum.hhf.technology/irdet2/32/3383_2.png) [@irdet2](https://forum.hhf.technology/u/irdet2)\
**Post date:** [September 22, 2025, 9:41pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/85 "2025-09-22T21:41:54Z")

</div>

The thing that I don’t get is why when changing the protection in Pangolin shows as “protected” in MM? I am not doing anything in MM, so it should remain unprotected, right?

---

<div class="post-metadata">

**Author:** ![vk3r](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/v/ea666f/32.png) [@vk3r](https://forum.hhf.technology/u/vk3r)\
**Post date:** [September 26, 2025, 1:23am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/86 "2025-09-26T01:23:06Z")

</div>

Is there a way to implement OIDC for use with Pocket-ID?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [September 26, 2025, 2:48am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/87 "2025-09-26T02:48:13Z")

</div>

Do you mean via Middleware-manager?

---

<div class="post-metadata">

**Author:** ![vk3r](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/v/ea666f/32.png) [@vk3r](https://forum.hhf.technology/u/vk3r)\
**Post date:** [September 26, 2025, 3:09am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/88 "2025-09-26T03:09:54Z")

</div>

Don’t listen to me. I messed up the Traefik implementation and my Pangolin is dead. I haven’t been able to correctly configure the official version of Pangolin + Crowdsec, adding the Middleware Manager. I think the rules directory is causing problems. Any thoughts?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [September 26, 2025, 6:36am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/89 "2025-09-26T06:36:00Z")

</div>

ping on crowdsec channel on cord, [HHF Technology](https://discord.gg/HDCt9MjyMJ) i will walk you through

---

<div class="post-metadata">

**Author:** ![Selovert](https://forum.hhf.technology/user_avatar/forum.hhf.technology/selovert/32/3573_2.png) [@Selovert](https://forum.hhf.technology/u/Selovert)\
**Post date:** [October 17, 2025, 4:58am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/90 "2025-10-17T04:58:14Z")

</div>

Heya, what do you mean by “the proxy”? I’m running a very similar setup to @arcanazen and getting the same issue.

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [October 17, 2025, 5:41am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/91 "2025-10-17T05:41:05Z")

</div>

Hi and welcome. What issue? Explain a little more and we will try to help

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [October 17, 2025, 5:42am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/92 "2025-10-17T05:42:23Z")

</div>

There’s a guide on that here

> [@Direct OAuth2 Authentication with PocketID and Traefik OIDC Plugin](https://forum.hhf.technology/t/direct-oauth2-authentication-with-pocketid-and-traefik-oidc-plugin/1956):
>
> This guide demonstrates how to implement seamless OAuth2 authentication for your Pangolin resources using PocketID and the Traefik OIDC plugin. Unlike traditional setups that require users to navigate through multiple login pages, this approach redirects users directly to PocketID’s login page where they can authenticate with passkeys. sparkles Why This Matters Traditional authentication flows often require users to: Visit your application Get redirected to Pangolin’s…

---

<div class="post-metadata">

**Author:** ![Selovert](https://forum.hhf.technology/user_avatar/forum.hhf.technology/selovert/32/3573_2.png) [@Selovert](https://forum.hhf.technology/u/Selovert)\
**Post date:** [October 18, 2025, 5:05pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/93 "2025-10-18T17:05:59Z")

</div>

Here’s my setup and results

# Containers

- _VPS_
  - Pangolin
  - Traefik
  - Middleware-manager
  - Gerbil

- _Local server_
  - Newt
  - Authentik
  - Services

# Configs

### Pangolin

Service and Authentik configs are done thru docker labels

```yaml
labels:
  - pangolin.proxy-resources.authentik.name=Authentik
  - pangolin.proxy-resources.authentik.full-domain=auth.my_domain.com
  - pangolin.proxy-resources.authentik.protocol=http
  - pangolin.proxy-resources.authentik.auth.enabled=false
  - pangolin.proxy-resources.authentik.targets[0].method=http
  - pangolin.proxy-resources.authentik.targets[0].port=9000

```

```yaml
labels:
  - pangolin.proxy-resources.service_a.name=Service_a
  - pangolin.proxy-resources.service_a.full-domain=service_a.my_domain.com
  - pangolin.proxy-resources.service_a.protocol=http
  - pangolin.proxy-resources.service_a.auth.enabled=false
  - pangolin.proxy-resources.service_a.targets[0].method=http
  - pangolin.proxy-resources.service_a.targets[0].port=8080

```

No other modifications have been made to the resources in the Pangolin webui

### Middleware-manager

the JSON config is a bit of a mix of @hhf.technoloy’s comment above and discussion `Help with authentik #20` on github (I can’t link it due to permissions)

```json
{
  "address": "http://auth.my_domain.com/outpost.goauthentik.io/auth/traefik",
  "authResponseHeaders": [
    "X-authentik-username",
    "X-authentik-groups",
    "X-authentik-email",
    "X-authentik-name",
    "X-authentik-uid",
    "X-authentik-jwt",
    "X-authentik-meta-jwks",
    "X-authentik-meta-outpost",
    "X-authentik-meta-provider",
    "X-authentik-meta-app",
    "X-authentik-meta-version"
  ],
  "trustForwardHeader": true
}

```

This middleware is applied to the resource “service\_a”

### Authentik

Service is configured as follows

```plaintext
Name: service_a
Slug: service_a
Provider: Provider for service_a
Launch URL: https://service_a.my_domain.com

(all other settings left unchanged)

```

Here is the provider config

```plaintext
Name: Provider for service_a
Assigned to application: service_a
Mode: Forward auth (domain-level)
External Host: https://auth.my_domain.com
Internal Host: https://service_a.my_domain.com
Cookie domain: my_domain.com

(all other settings left unchanged)

```

The outpost

```plaintext
Name: authentik Embedded Outpost
Providers: ['Provider for service_a',]
Health: Last seen < 10sec ago

```

# Workflow

1. Go to https://service\_a.my\_domain.com
2. I am redirected to “Welcome to authentik!” page with login
3. Log in to authentik
4. I am redirected a few times in rapid succession, ending up back at “Welcome to authentik!”
5. Log in to authentik a second time
6. I am redirected to https://auth.my\_domain.com
7. Trying to go to https://service\_a.my\_domain.com at this point downloads a file called `traefik`

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [October 18, 2025, 7:55pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/94 "2025-10-18T19:55:00Z")

</div>

Did you include the authentek “outpost” proxy in your docker compose. Authentik won’t work if on a different vps the traefik unless you have included the proxy

Have a look at this

> **[GitHub - oidebrett/auth-servers-on-aws-ec2: Cloudformation Templates to quickly set up Auth...](https://github.com/oidebrett/auth-servers-on-aws-ec2?tab=readme-ov-file#special-configuration-for-authentik-on-a-separate-host)**
>
> Cloudformation Templates to quickly set up Auth Servers on AWS EC2

---

<div class="post-metadata">

**Author:** ![Selovert](https://forum.hhf.technology/user_avatar/forum.hhf.technology/selovert/32/3573_2.png) [@Selovert](https://forum.hhf.technology/u/Selovert)\
**Post date:** [October 21, 2025, 5:57am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/95 "2025-10-21T05:57:58Z")

</div>

Perfect, thank you!

Had to make some changes, but going to put the whole thing below for interested parties.

# Containers

- _VPS_
  - Pangolin
  - Traefik
  - Middleware-manager
  - Gerbil
  - Authentik outpost ❗ **new** ❗

- _Local server_
  - Newt
  - Authentik
  - Services

# Configs

### Pangolin

Service and Authentik configs are done thru docker labels

```yaml
labels:
  - pangolin.proxy-resources.authentik.name=Authentik
  - pangolin.proxy-resources.authentik.full-domain=auth.my_domain.com
  - pangolin.proxy-resources.authentik.protocol=http
  - pangolin.proxy-resources.authentik.auth.enabled=false
  - pangolin.proxy-resources.authentik.targets[0].method=http
  - pangolin.proxy-resources.authentik.targets[0].port=9000

```

```yaml
labels:
  - pangolin.proxy-resources.service_a.name=Service_a
  - pangolin.proxy-resources.service_a.full-domain=service_a.my_domain.com
  - pangolin.proxy-resources.service_a.protocol=http
  - pangolin.proxy-resources.service_a.auth.enabled=false
  - pangolin.proxy-resources.service_a.targets[0].method=http
  - pangolin.proxy-resources.service_a.targets[0].port=8080

```

No other modifications have been made to the resources in the Pangolin webui

### Traefik **\*new\***

Ended up having to add forwarded headers on my https traffic

```json
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    forwardedHeaders:
      trustedIPs:
        - "127.0.0.1/32" # Localhost
        - "172.16.0.0/12" # Docker networks

```

`/outpost.goauthentik.io/` paths also needed to be forwarded to authentik

```yaml
    authentik-outpost-callback:
      entryPoints:
        - websecure
      rule: "HostRegexp(`{subdomain:[a-z0-9-]+}.my_domain.com`) && PathPrefix(`/outpost.goauthentik.io/`)"
      service: "authentik-outpost-service"
      priority: 500 # Very high priority to catch before other routes
      tls:
        certResolver: "letsencrypt"

    authentik-outpost-service:
      loadBalancer:
        servers:
          - url: "http://authentik_outpost:9000"

```

### Middleware-manager

the JSON config is a bit of a mix of @hhf.technoloy’s comment above and discussion `Help with authentik #20` on github (I can’t link it due to permissions)

❗ **X-authentik-entitlements new** ❗

```json
{
  "address": "http://auth.my_domain.com/outpost.goauthentik.io/auth/traefik",
  "authResponseHeaders": [
    "X-authentik-username",
    "X-authentik-groups",
    "X-authentik-entitlements",
    "X-authentik-email",
    "X-authentik-name",
    "X-authentik-uid",
    "X-authentik-jwt",
    "X-authentik-meta-jwks",
    "X-authentik-meta-outpost",
    "X-authentik-meta-provider",
    "X-authentik-meta-app",
    "X-authentik-meta-version"
  ],
  "trustForwardHeader": true
}

```

This middleware is applied to the resource “service\_a”

### Authentik

Service is configured as follows

```plaintext
Name: service_a
Slug: service_a
Provider: Provider for service_a
Launch URL: https://service_a.my_domain.com

(all other settings left unchanged)

```

Here is the provider config

❗ **External host updated** ❗

```plaintext
Name: Provider for service_a
Assigned to application: service_a
Mode: Forward auth (domain-level)
External Host: https://service_a.my_domain.com
Internal Host: https://service_a.my_domain.com
Cookie domain: service_a.my_domain.com

(all other settings left unchanged)

```

The outpost

```auto
Name: pangolin-outpost
Providers: ['Provider for service_a',]
Health: Last seen < 10sec ago

```

# Workflow **\*updated\***

1. Go to https://service\_a.my\_domain.com
2. I am redirected to “Welcome to authentik!” page with login
3. Log in to authentik
4. Redirected to site successfully

# Notes **\*new\***

It’s weird that I had to set my Authentication URL / External Host for the Domain-level Forward Auth to `https://service_a.my_domain.com`.

Per Authentik,

> The external URL you’ll authenticate at. The authentik core server should be reachable under this URL.

Setting this to `https://auth.my_domain.com` brought me to an authentik page with a redirect error, though.

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [October 21, 2025, 11:13am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/96 "2025-10-21T11:13:36Z")

</div>

Thankyou so much bro

---

<div class="post-metadata">

**Author:** ![nghialele](https://forum.hhf.technology/user_avatar/forum.hhf.technology/nghialele/32/3904_2.png) [@nghialele](https://forum.hhf.technology/u/nghialele)\
**Post date:** [November 6, 2025, 2:20pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/97 "2025-11-06T14:20:49Z")

</div>

Xin chao! 🇻🇳

Thanks for all the discussion so far!

Today I have just add **Middleware Manager** to my remote Pangolin server, I see a few issues at the moment. Posting here to discuss further.

### First

I get this one in log, not come from `middleware-manager`, just posted here to see if someone have any ideas of it. I’ve already searched for it and saw a closed issue on Pangolin’s GitHub which is `not-solved` and still need to investigate further.

```auto
{"level":"error","providerName":"http","error":"cannot fetch configuration data: do fetch request: Get \"http://pangolin:3001/api/v1/traefik-config\": dial tcp 172.18.0.6:3001: connect: connection refused","time":"2025-11-06T04:05:08Z","message":"Provider error, retrying in 6.364415927s"}

```

### Second

Now my `middleware-manager` can easily access from `my-pangolin-domain.tld:3456`. (_Thanks to the bypass UFW of Docker, I do acknowledge that there are solutions, I just not implemented yet_)

My question is how to secure the `middleware-manager` too.

I have tried to add a `Local Site` on Pangolin host to try to have `middleware-manager` access as a Pangolin resource (enable SSO) but not successful.

### Third

In my `middleware-manager` dashboard, the data sources are like this. I could not really get the `traefik` to ever `Success`. Tried with `http://traefik:8080` as suggested, get the same result.

 ![Screenshot](https://forum-cdn.hhf.technology/original/2X/d/d96d26c8a664e0bbab324d6ba90045494dbbed38.png)

Please advise further and,

### Thank you for reading!

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [December 17, 2025, 11:32am UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/98 "2025-12-17T11:32:35Z")

</div>

I have a question. In my traefik\_config I have:

```yaml

experimental:
    plugins:
        badger:
            moduleName: github.com/fosrl/badger
            version: v1.2.1
        crowdsec:
            moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
            version: v1.4.6
        geoblock:
            moduleName: github.com/PascalMinder/geoblock
            version: v0.3.4
        traefik-oidc-auth:
            moduleName: github.com/sevensolutions/traefik-oidc-auth
            version: v0.17.0

```

but in my **Traefik Plugin Hub** page, only geoblock appears as installed.  
Should I press install plugin for the crowdsec bouncer (though it’s already installed I assume.

 ![{39557F25-6241-4A41-9037-F526306F2DEC}](https://forum-cdn.hhf.technology/original/2X/1/17e7324cd219ffd105d25b6bd62be33c6dd070fc.png)

my compose:

```yaml
 
  traefik:
    image: traefik:v3
    container_name: traefik
    profiles:
      - pangolin
    networks: ['pangolin', 'net', 'monitor', 'server', 'apps', 'arrs', 'socket-internal', 'vps']
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    depends_on:
      # crowdsec:
      # condition: service_healthy
      pangolin:
        condition: service_healthy
    environment:
      CLOUDFLARE_DNS_API_TOKEN: ${TRAEFIK_CLOUDFLARE_DNS_API_TOKEN}
    ports:
      - 443:443
      # - 80:80 - DNS challenge (does not need http)
      - 51830:51830/udp ## wg-easy
      # - 53213:53213 ## qBittorrent
    volumes:
      - ${CONFIGDIR}/.pangolin/traefik:/etc/traefik:ro
      - ${CONFIGDIR}/.pangolin/traefik/conf/captcha.html:/etc/traefik/conf/captcha.html:ro
      - ${CONFIGDIR}/.pangolin/letsencrypt:/letsencrypt
      - ${CONFIGDIR}/.pangolin/traefik/logs:/var/log/traefik
      - ${CONFIGDIR}/.pangolin/traefik/rules:/rules
    security_opt:
      - apparmor:unconfined
    restart: unless-stopped

  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    profiles:
      - pangolin
    networks:
      - pangolin
    command: -t
    environment:
      #ACQUIRE_FILES: /var/log/traefik/*.log
      COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
      ENROLL_INSTANCE_NAME: pangolin-crowdsec-pve
      ENROLL_TAGS: docker
      GID: ${PGID}
      PARSERS: crowdsecurity/whitelists
      POSTOVERFLOWS: "crowdsecurity/rdns"
      CUSTOM_HOSTNAME: pve
    labels:
      - traefik.enable=false
    ports:
      - 6060:6060
    volumes:
      - ${CONFIGDIR}/.pangolin/crowdsec:/etc/crowdsec
      - ${CONFIGDIR}/.pangolin/crowdsec/db:/var/lib/crowdsec/data
      - ${CONFIGDIR}/.pangolin/traefik/logs:/var/log/traefik
    healthcheck:
      interval: 10s
      retries: 15
      timeout: 10s
      test: ["CMD", "cscli", "capi", "status"]
    security_opt:
      - apparmor:unconfined
    restart: unless-stopped

  middleware-manager:
    image: hhftechnology/middleware-manager:latest
    container_name: middleware-manager
    profiles:
      - ondemand
    networks:
      - pangolin
    volumes:
      - ${CONFIGDIR}/.pangolin/data:/data
      - ${CONFIGDIR}/.pangolin/traefik/rules:/conf
      - ${CONFIGDIR}/.pangolin/traefik:/etc/traefik
      - ${CONFIGDIR}/.pangolin/middleware-manager/templates.yaml:/app/config/templates.yaml
    environment:
      - PANGOLIN_API_URL=http://pangolin:3001/api/v1
      - TRAEFIK_CONF_DIR=/conf
      - TRAEFIK_STATIC_CONFIG_PATH=/etc/traefik/traefik_config.yml
      - DB_PATH=/data/middleware.db
      - PORT=3456
    expose:
      - 3456
    security_opt:
      - apparmor:unconfined
    restart: unless-stopped

```

---

<div class="post-metadata">

**Author:** ![ovizii](https://forum.hhf.technology/user_avatar/forum.hhf.technology/ovizii/32/3371_2.png) [@ovizii](https://forum.hhf.technology/u/ovizii)\
**Post date:** [March 22, 2026, 4:37pm UTC](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324/99 "2026-03-22T16:37:05Z")

</div>

## Use Template as much as possible dont use dashboard unless you know how to use json format for the same.

What exactly does that mean? Can someone please explain?

[Previous page](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324.md?page=4)