The first service worth standing up in a home lab isn’t a dashboard or a media server — it’s the front door. The reverse proxy is the one box every future service has to pass through: it terminates TLS, hands out friendly names, and quietly decides how much friction each new container will cost you. So which one would I hang today, starting from zero? Brandon Lee’s answer at Virtualization Howto is Pangolin, and having run the alternatives across different labs, I agree. Not because Pangolin is the simplest tool on the list — it isn’t — but because it’s the only one whose growth path doesn’t begin with “migrate”.
What each candidate actually optimizes for
Every popular proxy is good at something specific, and the marketing rarely says what:
- Nginx Proxy Manager optimizes for the first hour: point, click, done. It’s a single-node GUI over Nginx, and it stays simple right up until that one container is the dependency for every friendly name you own.
- Traefik optimizes for infrastructure-as-code: labels on containers, config that lives with the workload, nothing to drift out of sync. Inside a Kubernetes shop it’s close to a default; standalone, it’s more ceremony than a small lab needs.
- Caddy optimizes for minimal machinery: a two-line file, automatic HTTPS, done. Lovely for a static site. Not a platform.
- Pangolin optimizes for a different question entirely — not “how do I terminate TLS” but “how do I reach my stuff safely, from anywhere, as it grows”: proxying plus user access, tunneling, DNS coordination and clustering behind one dashboard.
That last bullet is the tell. Most home labs answer the TLS question first and discover the access question two years later — usually the week someone needs to reach a service from another country. Pick the tool that answers the second question without a migration.
The quick setup is genuinely quick
Pangolin’s installer collapses install, DNS and certificate issuance into one flow instead of three tools duct-taped together:
curl -fsSL https://digpangolin.com/get-installer.sh | bash
./installerAnswer the wizard — say no to the cloud-managed beta node if you want a purely local, NPM-style experience — then adopt the node in the dashboard using the ID and secret the installer printed. Three containers come up: traefik for HTTP/HTTPS routing, pangolin as the control plane and API, and gerbil for WireGuard ingress. From there the mental model is three objects: a site (a network location), a domain (NS delegation for a whole zone, or a CNAME for a single name), and a resource (a hostname plus the backend it forwards to). Create a resource and the Let’s Encrypt certificate goes from pending to valid on its own.
What’s worth appreciating isn’t the speed — it’s that the DNS record, the cert and the proxy rule are one integrated object instead of three config stores that can silently disagree with each other. Most “the proxy is down” incidents are really “two of those three drifted”.
Newt is the feature that changes your architecture
A Newt is a small agent you run on a machine in some other network — a VPS, a relative’s house, a client site behind consumer NAT — and it tunnels back to your Pangolin. You can publish a service from behind that NAT without opening a single port on its router. If you’ve used Cloudflare Tunnel or a Tailscale funnel, you know the shape; the difference is that the edge, the policy and the logs sit on your box, not a vendor’s. For a small business that’s the whole pitch: remote access with vendor-shaped ergonomics and self-hosted ownership. And if all you ever wanted was NPM-style proxying inside the lab, you can simply never install a Newt — the simple case stays simple.
The trade-offs to walk in knowing
- It’s a platform, not a proxy. Cloud coordination, DNS handling and failover run through a fossorial.io account (the dashboard at pangolin.fossorial.io). Local-only mode covers the NPM-style case, but read the coordination terms before you delegate a zone you care about.
- It’s young. Traefik and Nginx have decades of production scar tissue; Pangolin is still earning its calluses. Pin versions and treat upgrades as events, not chores.
- More moving parts than NPM. Three containers before you’ve configured anything — and if you later chase high availability, the parts list grows again: PostgreSQL, Valkey, and a load balancer you provide yourself. Clustering went self-service in 1.23, and that build has its own real costs — it’s a weekend project, not a checkbox.
When I’d still pick something else
- Everything already runs in Kubernetes — use Traefik. Its CRDs and label-based discovery are the native answer there, and a second proxy in front of an ingress is just noise.
- You need exactly one public site with automatic HTTPS and nothing else — Caddy is less machinery to own.
- Everything is strictly LAN-side and you want a GUI — NPM is lighter than a platform, and “never tunnels, never clusters” is a perfectly fine constraint to hold.
The default answer has changed because the question changed. Remote access and per-user control stopped being exotic the moment other people started depending on your services. The front door is the last component you want to replace under load — pick one you won’t have to. For a fresh build today, that’s Pangolin.