Pangolin Worker

Allows users to self-service adding their current IP to the allowlist for a resource protected by Pangolin.

If you have a resource being proxied by Pangolin where you're allowing access via IP address, this is a Cloudflare Worker that can be used with Cloudflare Access to allow users to self-service adding an IP to the resource's allowlist.

This is useful in situations where you're running a service like Jellyfin where some users access via web browser and can go through the Pangolin authentication flow, but others access from smart TVs or other non-browser apps which can't easily do that. This way you can allow users who you've listed in Cloudflare Access to access this Worker and get their IPs allowed into the service without the Pangolin authentication flow.

User Experience

Users will go to the address of this Worker and click Allow my IP with the IPv4 address being automtically detected.

Prerequisites

1. Create a Cloudflare account and enable Workers (free tier is likely fine)
2. If you're using the Community Edition of Pangolin you'll need to enable the Integration API
3. Create an Organization API Key and keep it handy until installation is done. The key should have at least the following permissions.
   1. List Resources
   2. Create Resource Rule
   3. List Resource Rules
4. Get the resourceId for your service. You can get a list of your resouces with id with curl -H "Authorization: Bearer $YOUR_API_KEY" https://api.YOURDOMAIN.com/v1/org/$ORGID/resources | jq '.data.resources[] | {name, resourceId, niceId}'

Installation

To use this yourself you'll need to either fork this to your own repo and set it up in Cloudflare's web interface, or use wrangler. For wrangler you'll need to do:

1. npm create cloudflare@latest -- --template=eldridgea/pangolin-worker
2. cd into the directory this creates
3. Uncomment and edit the vars section in wranger.jsonc to fit your setup
4. To use a custom domain connected to your Cloudflare account also uncomment and edit the routes section in wranger.jsonc
5. Run npx wrangler secret put PANGOLIN_API_KEY and when prompted enter your Pangolin api key
6. If your Pangolin API is proxied by Pangolin and needs authentication:
   1. In the Pangolin admin dashboard create a Shareable Link for the API resource and get the Token and Token ID values
   2. In wrangler.jsonc put the Token value in the P_ACCESS_TOKEN_ID variable
   3. Run npx wrangler secret put P_ACCESS_TOKEN and when prompted enter the Token ID values
7. Run npx wrangler deploy

Todo

• Add logic so that when adding a new resource rule it uses a unique priority value each time

Notes

This is most suited to situations where you have some degree of trust in the authentication stack of the application you're running but don't want to expose it to the Internet. Having users authenticate before adding an IP greatly reduces the potential attack surface of the application itself.

If the application you're hosting doesn't have an authentication stack or doesn't have one you trust you probably shouldn't use this. IP addressed-based security shouldn't generally be used as the only security control for accessing something, but can be a good addition to a defense-in-depth approach.