For about a year, the knock on Pangolin was simple and fair: a genuinely good self-hosted edge proxy with a single-point-of-failure-shaped hole in the middle. Clustering existed, but it sat behind an enterprise engagement, a proprietary external DNS server, and a separate cert manager — three things no home lab wants to run. Brandon Lee’s walkthrough of Pangolin 1.23 shows that era is over: high-availability clustering is now a self-service configuration with published reference architecture. That’s real progress. The catch just isn’t in the release notes.
What actually changed
The structural change is that DNS resolution and certificate management now live inside the main Pangolin container. Nodes coordinate certificate issuance, storage, and distribution among themselves, and the project publishes reference documentation for standing up a two-node cluster on your own hardware. Before 1.23, this plumbing required Pangolin’s Enterprise Edition plus a contract engagement to wire up external components. Now it’s something a competent self-hoster can reproduce over a weekend — which changes who this feature belongs to.
The architecture, briefly
A Pangolin cluster is not one binary with a flag. The reference architecture is:
- Pangolin instances — the web UI, API, auth, DNS, cert management, and cluster coordination
- PostgreSQL — the persistent source of truth: users, sites, resources, policies, TLS certs
- Valkey or Redis — real-time state sync and caching between nodes
- Traefik — one per node, terminating SSL and routing to your backends
- Gerbil — the WireGuard tunnel manager connecting your remote Sites
- An external load balancer — health checking and traffic distribution, which is yours to provide
Read that list again: five moving parts, plus a load balancer you build yourself. That’s not a complaint — HA is never a toggle — but it is a budgeting note. This is a project with a parts list, not a checkbox.
The load balancer is still your problem
This is the fine print that matters most. Pangolin exposes a /ping health endpoint so your load balancer can tell which nodes are healthy, but choosing where traffic goes remains entirely your job. Put a single non-redundant load balancer in front of a beautifully redundant two-node cluster and you haven’t removed the single point of failure — you’ve relocated it to a box that’s now the most important thing you run. The standard answers are a Keepalived pair with a floating virtual IP, or a managed cloud load balancer if you’d rather pay a few dollars a month than fiddle with VRRP. Pangolin at least being transparent about the dependency in its docs is to its credit.
Failure domains or the whole exercise is theater
Before you deploy anything, decide where things fail. Two Pangolin nodes on the same Proxmox host, sharing one UPS, are availability cosplay — the cluster will happily survive failures that never happen while dying instantly to the ones that do. A layout that respects failure domains looks like this: node one on pvehost01, node two on pvehost02, PostgreSQL on a third host, with negative affinity rules in Proxmox keeping the Docker-host VMs physically apart and the two Keepalived load balancers split across those same hosts. And notice what just happened to importance ranking: your database node is now the crown jewels of the edge. Replicate it, back it up, and — the part everyone skips — restore from that backup once to prove it works.
Build it in stages
Standing the whole thing up at once is how you end up troubleshooting five layers at 1am. Staged, each layer has one job to verify:
| Stage | Deploy | Verify before moving on |
|---|---|---|
| 1 | PostgreSQL + Valkey | Both future Pangolin nodes connect cleanly to both services |
| 2 | First Pangolin node (Pangolin, Gerbil, Traefik) | Dashboard access, DNS delegation, cert issuance, one test resource served |
| 3 | Second node | Connects to shared services and picks up expected cluster state |
| 4 | HA load balancer pair | Health checks work, failover actually fails over, both directions |
Each stage has a rollback that’s just “delete what I built since the last stage.” That property is worth more than any single config choice.
The licensing footnote that matters
Clustering is an Enterprise Edition feature, which sounds like a door slamming — except Pangolin’s EE is free for personal use and for organizations under $100,000 in gross annual revenue. That covers essentially every home lab and a large share of the small businesses reading this. Do verify the current terms before you build anything load-bearing on it; licensing footnotes have a way of changing.
So is it worth it? Cluster the edge — the reverse proxy is the one machine whose failure takes your entire lab off the internet, so it’s the one thing HA actually buys you. Don’t cluster services you can rebuild from git in ten minutes; that’s complexity cosplaying as reliability. Pangolin 1.23 made the first half attainable. Knowing the difference is still your job.