# Installing and Setting Up Pangolin and Middleware Manager

**URL:** <https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255>\
**Category:** Guides & Tutorials\
**Tags:** middleware-manager, traefik, pangolin\
**Created:** [May 27, 2025, 6:00pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255 "2025-05-27T18:00:32Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [May 27, 2025, 6:00pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/1 "2025-05-27T18:00:33Z")

</div>

# 🚀 Installing and Setting Up Pangolin and Middleware Manager

This guide walks you through installing and configuring **Pangolin** and the **Middleware Manager** from scratch on a Linux VPS, setting up your reverse proxy and authentication system with confidence.

## Why use the Middleware Manager?

The Middleware Manager monitors resources from your chosen data source (either a Pangolin API or a direct Traefik API connection) and provides a web UI to:

- **Define and manage custom Traefik middlewares.**
- **Attach these middlewares to your resources** with specific priorities.
- **Configure advanced router settings** for each resource, including entrypoints, TLS Subject Alternative Names (SANs), TCP SNI routing rules, custom request headers, and router priority.
- **Create, update, and delete custom Traefik services** (LoadBalancer, Weighted, Mirroring, Failover).
- **Assign these custom services to your resources** , overriding default service behavior.
- **Discover, install, and manage Traefik plugins** directly from the UI.

 ![dashboardV3](https://forum-cdn.hhf.technology/original/2X/6/621532d722649be557ec08cd452e4b25b5941a34.jpeg)  
 ![plugin_hubV3](https://forum-cdn.hhf.technology/original/2X/e/ec2f5ea8c28700cdd41a28415beef622ef51b725.jpeg)

## See the Middleware Manager [github repo](https://github.com/hhftechnology/middleware-manager) for more details

## 🔧 Prerequisites

- A Linux system with root access (Ubuntu or Debian recommended)
- A domain name pointing to your server’s public IP address
- Ports **80 (TCP), 443 (TCP)**, and **51820 (UDP)** open to the world
- A working email for Let’s Encrypt certificates

> ⚠ **Important:** Docker publishes all defined ports on all interfaces. Misconfigurations can expose services unintentionally. Always check firewall rules.

## ⚡ Step 1: VPS & Domain Setup

Choose any major cloud provider or VPS host, and ensure your domain’s DNS points to your VPS’s public IP.

## 🚧 Step 2: Run the Pangolin Installer

Navigate to your desired install directory and run:

```bash
wget -O installer "https://github.com/fosrl/pangolin/releases/download/1.4.0/installer_linux_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')" && chmod +x ./installer
sudo ./installer

```

The installer will ask for:

```auto
=== Basic Configuration ===
Enter your base domain (e.g., example.com): yourdomain.com
Enter dashboard domain (e.g., dashboard.yourdomain.com): dashboard.yourdomain.com
Let's Encrypt Email: admin@yourdomain.com
Use Gerbil for tunnels? (yes/no): yes

=== Admin Setup ===
Admin Email: admin@yourdomain.com
Admin Password: ********

=== Security Settings ===
Disable signup without invite? (yes/no): yes
Disable org creation? (yes/no): no
Enable email functionality? (yes/no): no

=== Start Installation ===
Start containers now? (yes/no): yes

```

 ![PangolinLogin](https://forum-cdn.hhf.technology/original/2X/b/bcf9c3bba8d0ad3f4a1ba001258c1c0468d1b7c6.png)

> 📷 **Screenshot Pangolin login page**

## 🚨 Step 3: Secure Your Server with `ufw`

```bash
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 3456/tcp
sudo ufw allow 9000/tcp
sudo ufw allow 22/tcp
sudo ufw deny 8000/tcp
sudo ufw enable

```

Check status:

```bash
ufw status

```

## ⚖ Step 4: Connect Your First Site

In Pangolin:

- Create a new **Site**
- Copy the command provided, which looks like:

```bash
./newt --id ABC123 --secret XYZ456 --endpoint https://dashboard.yourdomain.com

```

After a few seconds, the status of your site in Pangolin should turn **Online**.

## 🔎 Step 5: Enable the Traefik Dashboard

Follow [this guide](https://forum.hhf.technology/t/traefik-dashboard-a-vital-prerequisite-for-debugging-pangolin-and-middleware-manager/2208) in order to set up the Traefik dashboard as it will be essential in debugging any issues.

## 📂 Step 6: Prepare Traefik Folder for Middleware Manager

Its important to change the folder structure for Traefik configuration before the middleware-manager will work. Lets do that now.

### Current Folder for Traefik Dynamic Config:

```auto
config/traefik/dynamic_config.yml

```

### Rules is the Target Folder for Traefik Dynamic Config:

```auto
config/traefik/rules/dynamic_config.yml

```

Run:

```bash
mkdir -p ./config/traefik/rules
mv ./config/traefik/dynamic_config.yml ./config/traefik/rules/

```

Your config directory structure should now look like this:

```auto
config/
├── config.yml
│ ├── config.yaml
├── db
│ └── db.sqlite
├── key
├── letsencrypt
│ └── acme.json
├── logs
└── traefik
    ├── logs
    ├── rules
    │ └── dynamic_config.yml
    └── traefik_config.yml

```

Update `traefik_config.yml`:

```yaml
providers:
  http:
    endpoint: "http://pangolin:3001/api/v1/traefik-config"
    pollInterval: "5s"
  file:
    directory: /rules
    watch: true

```

Update `docker-compose.yml` for the traefik container:

```yaml
volumes:
  - ./config/traefik/rules:/rules

```

Restart stack:

```bash
docker compose down
docker compose up -d --force-recreate

```

Check logs:

```bash
docker logs traefik

```

## 🔄 Step 7: Install Middleware Manager

Append to `docker-compose.yml`:

```yaml
middleware-manager:
  image: hhftechnology/middleware-manager:v3.0.1
  container_name: middleware-manager
  restart: unless-stopped
  volumes:
    - ./data:/data
    - ./config/traefik/rules:/conf
    - ./config/middleware-manager:/app/config
    - ./config/traefik:/etc/traefik
  environment:
    - PANGOLIN_API_URL=http://pangolin:3001/api/v1
    - TRAEFIK_CONF_DIR=/conf
    - DB_PATH=/data/middleware.db
    - PORT=3456
    - ACTIVE_DATA_SOURCE=pangolin
    - TRAEFIK_STATIC_CONFIG_PATH=/etc/traefik/traefik_config.yml
    - PLUGINS_JSON_URL=https://raw.githubusercontent.com/hhftechnology/middleware-manager/traefik-int/plugin/plugins.json
  ports:
    - "3456:3456"

```

Restart:

```bash
docker compose down
docker compose up -d --force-recreate

```

Check:

```bash
docker logs middleware-manager

```

Navigate to: `http://your_server_ip:3456/`

 ![UnprotectedMiddlewareManager](https://forum-cdn.hhf.technology/original/2X/3/36b820b1e5e410adfac121b7d560cd9e649c5120.png)

> 📷 **Screenshot of Middleware manager**

## 🏠 Step 8: Secure the Middleware Manager

1. In Pangolin, create a new **Resource** :

 ![PangolResourceForMiddlewareManager](https://forum-cdn.hhf.technology/original/2X/9/9ecc5cca5153f3e1cecde1f8958839a527105aa3.png)  
 ![TargetForMiddlewareManager](https://forum-cdn.hhf.technology/original/2X/5/51dd4a5f193c73f7b94b095f69e802df2595e6e8.png)

> 📷 **Screenshot Resource config pointing to middleware-manager**

### Restrict Direct Access to the IPAddress:port

```bash
sudo ufw deny 3456/tcp

```

Remove `ports` from the middleware service in `docker-compose.yml`:

```yaml
# REMOVE:
# ports:
# - "3456:3456"

```

Again restart for the port changes to take affect:

```bash
docker compose down
docker compose up -d --force-recreate

```

## 📆 Step 9: Test Middleware (IP Whitelist)

In Middleware Manager:

1. Select the **Traefik Dashboard** resource

2. Apply the `ipwhitelist` middleware

3. Try accessing: `https://traefik.yourdomain.com`

4. Add your IP to the middleware config:

```json
{
  "sourceRange": [
    "YOUR_IP_ADDRESS_HERE/32",
    "192.168.1.0/24",
    "10.0.0.0/8"
  ]
}

```

1. Retry accessing Traefik dashboard

> ⚠ **Warning:** Misconfiguring IP whitelists can lock you out! Always confirm via Traefik dashboard after changes.

## 🎉 You’re All Set!

You now have:

- Pangolin + Middleware Manager installed
- Traefik configured correctly
- The Traefik Dashboard available
- Middleware protection tested and live

Happy deploying! 🚀

---

<div class="post-metadata">

**Author:** ![noe6172](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/919ad9/32.png) [@noe6172](https://forum.hhf.technology/u/noe6172)\
**Post date:** [May 27, 2025, 8:15pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/2 "2025-05-27T20:15:52Z")

</div>

Great job. Thanks. I’ll test you guide

---

<div class="post-metadata">

**Author:** ![ptweety](https://forum.hhf.technology/user_avatar/forum.hhf.technology/ptweety/32/1403_2.png) [@ptweety](https://forum.hhf.technology/u/ptweety)\
**Post date:** [May 28, 2025, 6:02am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/3 "2025-05-28T06:02:37Z")

</div>

> [@Mattercoder](#):
>
> Check status:
> 
> ```auto
> ufw status
> 
> ```

Hi there, are the known issues with ufw and docker resolved?

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [May 28, 2025, 6:34am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/4 "2025-05-28T06:34:22Z")

</div>

Hi, i think its working for me now. I am able to block direct port access to the middleware manager and use the Pangolin resource target to access my middleware manager. I am not overly familiar with the ufw docker issue.

---

<div class="post-metadata">

**Author:** ![noe6172](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/919ad9/32.png) [@noe6172](https://forum.hhf.technology/u/noe6172)\
**Post date:** [May 29, 2025, 3:30pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/5 "2025-05-29T15:30:24Z")

</div>

Hello, everything works very well for me.

But I have a question. Maybe you can help me. When I check the security headers in my pangolin panel: [pangolin.my-domain.com](http://pangolin.my-domain.com), I have a terrible result. Is it worrying?

 ![Screenshot From 2025-05-28 17-18-58](https://forum-cdn.hhf.technology/original/2X/e/e55937786092ffa4744c8f0856a34a76b365fad5.png)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [May 29, 2025, 3:31pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/6 "2025-05-29T15:31:54Z")

</div>

headers are not on pangolin UI domain but on its resources. check any resource domain you have created after adding headers.

---

<div class="post-metadata">

**Author:** ![carlyman](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/c/9fc29f/32.png) [@carlyman](https://forum.hhf.technology/u/carlyman)\
**Post date:** [June 1, 2025, 2:19am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/7 "2025-06-01T02:19:36Z")

</div>

Should `TRAEFIK_STATIC_CONFIG_PATH=` be set to `/etc/traefik/traefik_config.yml` or `/etc/traefik/traefik.yml` – I’ve seen both (this post, github, and with the MM dashboard seem inconsistent)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 1, 2025, 3:44am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/8 "2025-06-01T03:44:11Z")

</div>

> [@carlyman](#):
>
> etc/traefik/traefik\_config.yml

The correct one /etc/traefik/traefik\_config.yml

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 1, 2025, 6:44am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/9 "2025-06-01T06:44:28Z")

</div>

I’ve set the environment variable to  
`TRAEFIK_STATIC_CONFIG_PATH=/etc/traefik/traefik_config.yml`

and also mapped traefik volume in order to work and load plugins  
`- ${CONFIGDIR}/traefik:/etc/traefik`

Speaking of [Ability to disable log · Issue #49 · hhftechnology/middleware-manager · GitHub](https://github.com/hhftechnology/middleware-manager/issues/49)  
can you please also code a variable such as `HEALTHCHECKS_INTERVAL` or `HEALTHCHECKS_ENABLE` ?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 1, 2025, 7:59am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/10 "2025-06-01T07:59:46Z")

</div>

Middleware manager is a generator. You don’t have to keep it running,once configuration is generated you can bring the container down when again required to add a middleware you can bring it up. Scanning logs are necessary while it’s running.

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 1, 2025, 2:02pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/11 "2025-06-01T14:02:52Z")

</div>

Is there a way to silence the middleware manager spam log?  
As it is, at every 10 seconds it prints (in my case) around 200 rows of logs.  
I’d like to silence this, can you please find a way to at least reduce this?

 ![Clipboard01](https://forum-cdn.hhf.technology/original/2X/c/c29e867136d42aab54a3b20a4b418142dcb58bbc.png)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 1, 2025, 2:04pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/12 "2025-06-01T14:04:05Z")

</div>

Did you read my above comment. ?

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 1, 2025, 6:04pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/13 "2025-06-01T18:04:37Z")

</div>

Hello, thank you, that makes perfect sense now 🙂  
Somehow I did not read your comment.  
All good now, I configured everything perfectly, thanks for your guides, my crowdsec and security measures are amazingly tight now.

Have a great day!

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 3, 2025, 6:06pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/14 "2025-06-03T18:06:54Z")

</div>



---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 3, 2025, 6:10pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/15 "2025-06-03T18:10:05Z")

</div>



---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 3, 2025, 6:10pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/16 "2025-06-03T18:10:11Z")

</div>



---

<div class="post-metadata">

**Author:** ![radiogen](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/r/bc8723/32.png) [@radiogen](https://forum.hhf.technology/u/radiogen)\
**Post date:** [June 10, 2025, 1:45pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/17 "2025-06-10T13:45:23Z")

</div>

after I have added Middleware Manager to `docker-compose.yml` and docker compose down; docker compose up -d --force-recreate

getting the error: (root) Additional property middleware-manager is not allowed

how to solve it?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 10, 2025, 1:58pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/18 "2025-06-10T13:58:51Z")

</div>

share your compose file on hhf cord. [HHF Technology](https://discord.gg/HDCt9MjyMJ)

---

<div class="post-metadata">

**Author:** ![BlackrazorNZ](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/b/ecc23a/32.png) [@BlackrazorNZ](https://forum.hhf.technology/u/BlackrazorNZ)\
**Post date:** [June 29, 2025, 3:58am UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/19 "2025-06-29T03:58:26Z")

</div>

I realise this one is probably resolved, but I had the same issue initially. The cause was that the code snippet linked above under step 7 (the docker-compose.yml addition) when copy-pasted into docker-compose.yml, needs to be indented by 1 tier more than the tier it appears at when copy-pasted. If using VS Code to edit this, you can just select the entire pasted code block and press TAB once.

---

<div class="post-metadata">

**Author:** ![madcar86](https://forum.hhf.technology/user_avatar/forum.hhf.technology/madcar86/32/1948_2.png) [@madcar86](https://forum.hhf.technology/u/madcar86)\
**Post date:** [July 14, 2025, 6:48pm UTC](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/20 "2025-07-14T18:48:06Z")

</div>

I’ve successfully installed everything, but I’m stuck on configuring the IP Whitelist. I’ve added every IP address I know, but I still can’t re-enable the Traefik Manager.

My Pangolin setup is on an Oracle VPS, and I’ve already added the necessary ports to the Oracle security rules. I’ve tried using the VPS public IP, my public IP, my LAN IP, and the VPS Tailscale IP, but none of them have worked.

Could you please let me know where I can find the correct IP address to configure the whitelist?

[Next page](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255.md?page=2)