Pangolin: Open-Source SASE That You Can Actually Self-Host

You've probably heard the pitch for SASE (Secure Access Service Edge) before: unify your networking and security into one platform, grant access per resource instead of per network, and stop treating your VPN and your firewall like two separate worlds. The idea is solid. The problem is that the platforms selling it—Cloudflare One, Zscaler, Prisma—are heavyweight, closed, and cloud-locked. If you want that model on your own infrastructure, you're usually out of luck. Pangolin is an open-source attempt to fix that, built on WireGuard and designed to stay small enough to run on a modest server.

What It Does

Pangolin is a self-hostable SASE platform. It bundles four things that usually live in separate products: a zero-trust VPN, a zero-trust reverse proxy, privileged access management, and an identity-aware AI gateway. The key detail is that all of these share one identity and policy model, so connecting users and protecting them are handled by the same system rather than stitched together from different vendors.

Underneath, it's built on WireGuard, and the platform ships with a lightweight user-space connector that you drop into your private networks. Access is granted per resource rather than per network, with identity provider integration, role-based access control, and audit logging built in from the start. You can self-host the Community Edition for free, move up to an Enterprise Edition for advanced features, or use Pangolin Cloud if you'd rather not run the infrastructure yourself.

Why It's Cool

The unification is the whole point. Legacy SASE platforms assembled their stacks over years of patchwork, and it shows. Pangolin's pitch is that sites, reverse proxy, client access, RBAC, and the AI gateway all share one policy model. That means you're not writing rules in five different consoles and hoping they agree with each other.

It's open, so you can see the decisions. With a closed cloud control plane, you trust the vendor's word about how your traffic is handled. Here the code is auditable—you can trace exactly how access decisions get made. For anyone running compliance-sensitive workloads, that's a meaningful difference.

Lightweight is a real constraint, not a slogan. The README is explicit that the platform is built to stay small and fast, easy to self-host on a small server, with a user-space connector for your private networks. That matters if you've ever tried to stand up an enterprise security appliance and discovered it wants a dedicated cluster.

Zero trust from day one. Per-resource access, IdP integration, RBAC, and full audit logging aren't add-ons here—they're the baseline. If you've been putting off moving away from network-level trust because the migration looked painful, a greenfield tool with these defaults is a lower-friction starting point.

You get to choose how to run it. Community Edition self-hosted, Enterprise Edition for the advanced stuff, or Cloud if you don't want to manage anything. That range is useful—you can start self-hosted, prove it out, and change your mind later without switching products.

How to Try It

The fastest path is Pangolin Cloud, which you can sign up for free at app.pangolin.net. But since this is a self-hosting project at heart, here's the self-hosted route:

1. Read the quick install guide in the docs. That's the canonical starting point for a self-hosted deployment.
2. If you'd rather not configure a server from scratch, deploy from a prebuilt image:
   • AWS: Community and Enterprise AMIs for x86 and Graviton, configurable at launch with user-data or CloudFormation.
   • DigitalOcean: install from the DigitalOcean marketplace.
3. For anything else, there's a Docker image at fosrl/pangolin on Docker Hub.

The repository is at github.com/fosrl/pangolin. If you get stuck, there's an active community on Discord and Slack (both linked in the README), plus a YouTube channel with walkthroughs.

Final Thoughts

Pangolin is aimed at the administrator who likes the SASE model but doesn't want to hand their control plane to a vendor or wrestle a legacy console. The combination of open code, a lightweight footprint, and a single policy model across VPN, proxy, PAM, and AI gateway is a genuinely useful shape for small teams and homelab-to-production setups alike. It's early enough that you should read the docs carefully and check what's in the Community versus Enterprise editions before committing—but if self-hosted zero trust has been on your list, this is a sensible place to start.

Follow @githubprojects for more developer tools and open source projects.