1.13.0-rc.0

[oschwartz10612]

RC

A Release Candidate (RC) is a near-final software version, stable but undergoing last tests before official release. It has all features and no known bugs.

• Users: Use cautiously due to potential undiscovered bugs. Not for critical systems unless prepared for issues. Report bugs.
• Developers/Testers: Perform crucial final validation and thorough testing, especially of recent changes, to catch last-minute major issues.
• Backup: Always back up data before installing an RC to allow rollback if problems arise.
• Feedback: Provide feedback; it's vital for a robust final release. Participate in the discussion linked at the bottom

Warning

MIGRATIONS MAY BREAK BETWEEN RC VERSIONS

What's Changed

• Rename Clients to Machine Clients
• Rename Client Resources to Private Resources
• Rename Proxy Resources to Public Resources
• Add user-device clients that allow users to connect to private resources like a VPN
• Add Host and CIDR option to Private Resources
• Add “magic DNS” alias to Private Resources
• Add manage user devices modal to user profile dropdown
• Add ability to regenerate/rotate credentials on Sites, Clients, and Remote Nodes (EE)
• Add Request Analytics page with basic request statistics, request map, and graphs
• Add optional new version available notification to sidebar
• Add optional new features notification to sidebar
• Add support for Private Resources, Machine Clients, and User Devices in Blueprints
• Add SNI input field to health check form
• Add generate password reset code to users table in Server Admin page
• Add contact admin warning in forgot password page when SMTP not set up
• Add role to Badger passthrough header
• Add new access/audit log retention policy: keep until end of next year
• Add option to edit animal-themed identifier (niceId) on Sites, Resources, and Clients
• Fix broken inputs in edit health check form
• Fix custom branding login/signup page subtitle not displaying
• Fix empty path strip preventing create resource
• Fix custom healthy HTTP codes not respected
• Fix save resource overwrite custom headers input
• Fix various blueprint inconsistencies and annoyances
• Fix display of setup token after CrowdSec installation
• General UI enhancements

Breaking

Warning

This requires an update to Gerbil, Newt, Olm, and Pangolin.

Minimum Versions:

• Pangolin 1.13.0+
• Gerbil 1.3.0+
• Newt 1.7.0+
• Olm 1.2.0+

• Remove remote subnets from sites in favor of Private Resources
• Remove site:port proxy on Client Resources in favor of Private Resources
• Remove client to site associations in favor of Private Resources
• Remove --accept-clients flag from Newt; clients are on by default now with option to disable with --disable-clients
• Remove flag.enable_clients from Pangolin config
• Remove branding.favicon_path from private Pangolin config
  • To customize the icon, mount your favicon to /app/public/favicon.ico in the container
• Remove branding.login.title_text and branding.signup.title_text from private Pangolin config
  • Only subtitle customization is supported (there is no longer a title on these pages)

Note

We've done our best to migrate Client Resources and Clients to the new Private Resources and Machine Clients. All pre-existing clients are now Machine Clients, and all Client Resources are now Private Resources. We've also attempted to migrate all pre-existing site associations to Private Resource access controls, and remote subnets to CIDR Private Resources. However, please review your configuration after updating to ensure everything has been migrated correctly.

Full Changelog: 1.12.3...1.13.0-rc.0

How to Update

Important

Always back up your config app-data before updating. This will allow you to easily roll back if the update breaks your configuration. You will not be able to easily downgrade otherwise.

View documentation

Private Resources, User Devices, and Machine Clients

Note

This is still in beta. We will work towards getting out of beta by early 2026.

This release introduces a major evolution of Pangolin’s networking model enabling a far greater suite of remote access technologies. This update transforms it into a fully self‑hosted, open‑source alternative to Twingate using WireGuard under the hood. You can now create a secure, seamless private network that connects users, machines, and multiple sites under one unified access layer.

Overview

With the new Private Resources, Machine Clients, and User Devices, Pangolin now enables private network access across distributed environments without traditional VPN complexity.

• Newt still acts as your Site Connector, establishing a secure control and data plane over WireGuard.
• Private Resources define what’s accessible, like specific hosts on local networks or the entire local networks.
• Clients (human or machine) connect securely to the private network and gain access to defined resources using their familiar LAN‑style addresses.

This effectively “flattens” your internal topology: once connected, resources across all sites are accessible without manually connecting to each individual site.

Private Resources

Private Resources represent network targets reachable through your site connectors. These can be defined at different granularities:

• Host Resources: Point directly to an individual host (e.g., 192.168.1.210).
• CIDR Resources: Expose an entire subnet or range (e.g., 192.168.1.0/24).

When a client connects to the Pangolin network, they can access these Private Resources using the same LAN addresses without any port forwarding, route table setup, DNS configuration, VPN configuration, or proxy redirection needed.

Each Private Resource also supports a “magic DNS” alias, allowing friendly hostnames like mynas.internal to resolve automatically when connected. This simplifies navigation and behaves naturally across operating systems and clients.

Fine‑grained access control allows admins to assign which users, roles, and machine clients can access each Private Resource.

Machine Clients

All existing “Clients” have now been migrated and renamed to Machine Clients.
Machine Clients are designed for servers, services, and automated systems (like CICD runners, monitoring, or backups) that need ongoing access to Private Resources.

They authenticate using familiar ID and secret credentials, and retain full compatibility with pre‑existing integrations while benefiting from the unified Private Resource model.

User Devices

User Devices bring private network access directly to end users. These authenticated clients connect securely through Pangolin and gain access to permitted Private Resources just like a corporate zero‑trust VPN.

• Native GUI clients are available for macOS and Windows.
• CLI clients are available for Linux and macOS, with Windows CLI support coming soon.
• All clients support the full feature set including WireGuard‑based encryption, NAT traversal, DNS alias, and peer‑to‑peer connections when possible for direct networking.
• Mobile apps for Android and iOS will be coming in 2026.

Windows Client	Mac Client

---

This discussion was created from the release 1.13.0-rc.0.

[d0mmi]

Are there already any plans for Android clients?

[oschwartz10612]

Yep! Android and iOS apps planned! Probably early next year.

[d0mmi]

Nice to hear. Thanks for the good work and this great tool 🙂

[Aloe-recite]

I just installed EE RC but am a bit lost. Where did OIDC setting page go? It used to be above “ sites” at the top of the sidebar but it’s nowhere to be seen?
Also. I installed newt 1.7.0 RC but in pangolin shows that my site is running an “ version_replaceme” of Newt, is that to be expected?
I can’t wait to see how things will develop in the upcoming months, this is going to be huge!!!

[miloschwartz]

The missing newt version is fixable but it's because this is a release candidate so CICD never set the version. Won't be an issue on the official build.

As for the OIDC settings page, this shouldn't have moved. It should still be under the Server Admin menu. When logged in as your root user, there should be "Server Admin" link on the sidebar at the very top.

[manuel-rw]

Awesome release, thank you!
I know Linux is not a high priority, but do you have plans to add native GUI clients for Linux as well? It's about 3% of the market share.

[oschwartz10612]

Yes at some point! Working on functionality everywhere first then will come to linux and probably build a gtk app.

[manuel-rw]

No worries, it's low priority. Appreciate your work and happy to test gtk app if available.

[iconoclasthero]

Is there a draft migration guide somewhere?

• Remove remote subnets from sites in favor of Private Resources
• Remove site:port proxy on Client Resources in favor of Private Resources
• Remove client to site associations in favor of Private Resources
• Remove --enable-clients flag from Newt; clients are on by default now with option to disable with --disable-clients
• Remove flag.enable_clients from Pangolin config
• Remove branding.favicon_path from private Pangolin config
  • To customize the icon, mount your favicon to /app/public/favicon.ico in the container
• Remove branding.login.title_text and branding.signup.title_text from private Pangolin config
  • Only subtitle customization is supported (there is no longer a title on these pages)

I'm unclear which of these are manual migration steps. It seems to me that I'd need to do something about my newt config for the 4th one above, but I don't presently have any clients so I'm unclear what I need to do.

[oschwartz10612]

Good point to call this out. We will try to make this more clear in the official release notes.

Good news is if you do not have any existing clients you do not need to do any manual migrations steps! You can just update everything, install one of the client apps, create a private resource, and test away!

If you were previously using --accept-clients on newt you can just remove that flag now. Otherwise there are no new steps and those are just a list of things we changed.

[iconoclasthero]

As I was dealing with the replaceme version (didn't play well with my auto upgrade script) for newt 1.7.0-rc.0 and the full release of 1.7.0, I noticed that this hasn't been fixed in 1.7:

$ newt --version
INFO: 2025/12/12 12:53:30 Starting metrics server on 127.0.0.1:2112
Newt version 1.7.0

You'd said that you were going to address that in the Issue I raised a week or two ago. Does this need a separate issue or...?

I've addressed it I just wanted to mention it as a reminder.

instdver="$(newt --version 2>/dev/null)" || instdver="0.0.0"
#[[ "$instdver" =~ ([0-9]+\.[0-9]+\.[0-9]+) ]] && instdver="${BASH_REMATCH[1]}"
if [[ "$instdver" =~ [Vv]ersion[[:space:]]*([0-9]+\.[0-9]+\.[0-9]+) ]]; then
    instdver="${BASH_REMATCH[1]}"
else
    instdver="0.0.0"
fi
readarray -td . instdarr <<<"$instdver"

[oschwartz10612]

Yep sorry will be fixed in the next release by the new 44470abd5457ba22b7cddf4fd434a2df79bfcdad