How to set up a Pangolin server using Hetzner

Links:
• Full guide:   / benjaminspowell  
• Pangolin: https://github.com/fosrl/pangolin
• Hetzner Cloud: https://www.hetzner.com/cloud
• Unriad: https://unraid.net/pricing?via=c2216a

This video shows how to self-host secure tunnels without relying on Cloudflare Tunnels, using Pangolin on a low-cost Hetzner Ubuntu VPS — then connecting your home server (Unraid) with NEWT and publishing services securely over HTTPS.

What you’ll learn (end-to-end):
• How to spin up a Hetzner VPS (Cost Optimised) for a public endpoint
• Install Pangolin (Enterprise edition is free for personal use / small revenue)
• Configure base domain + dashboard domain
• Enable Gerbil for tunneled connections
• Request Let’s Encrypt SSL certificates and troubleshoot when SSL doesn’t issue
• Configure DNS correctly (A record, no proxying) and use wildcard DNS for subdomains
• Finish initial setup (organisation, admin creation)
• Install NEWT on Unraid and connect it to Pangolin (endpoint, site ID, secret)
• Publish a Docker service from Unraid publicly via Pangolin (subdomain → host IP + port)
• Add basic protection: password/PIN, country blocking, allowlists, rules

Stack used:
• Pangolin (self-hosted tunnel + access control)
• Hetzner VPS (Ubuntu)
• Traefik (managed by Pangolin installer)
• NEWT agent (on Unraid)

DNS + SSL notes (important):
• Create an A record for your Pangolin dashboard subdomain pointing to the VPS IP
• If you want “any subdomain” later, add a wildcard A record (e.g. *.benlab.cc) to the VPS IP
• Do NOT enable proxying on that DNS record if you’re avoiding Cloudflare tunnel/traffic policies
• If SSL doesn’t show up after DNS is set: restart the Traefik container so it re-attempts Let’s Encrypt