Pangolin Backup Strategy

Updated Updated: August 13, 2026

1 VPS BACKUP SYSTEM: Pangolin Docker#

Manual Backup Verification — 2026-10-02#

  • Triggered the existing backup script as vps-backup on VPSBackups LXC 102 (10.1.2.102) for RN-VPS (72.11.147.220); it completed successfully.
  • The current script stops the Pangolin stack, creates the archive on the VPS, restarts the stack, transfers the archive to LXC 102, and applies retention on both hosts.
  • Verified archive: /home/vps-backup/Backups/2026-10-02_08h27_PangolinBackup.tar.gz (313,781,104 bytes). The timestamp is the backup host’s local time.
  • The archive passed gzip -t; its file listing contains docker-compose.yml, config/db/db.sqlite, and config/traefik/traefik.yaml. A restore test was not performed.
  • All six Pangolin stack containers were running afterward; Pangolin and CrowdSec reported healthy. No component versions were changed.
  • Documentation discrepancy: /mnt/VPSBackups does not currently exist on LXC 102. The older storage and live-mirror references below have not been revalidated; the verified archive destination is /home/vps-backup/Backups/.

Target VPS: 72.11.147.220
VPS Provider: RackNerd (RN-VPS)
Backup LXC: Proxmox 102
Retention: 28 Files (14 Days)

Pangolin Tunnel - VPS Setup

Updated Updated: August 12, 2026

Pangolin Tunnel Setup Guide#

Current VPS and SSH Access (Verified 2026-08-12)#

The current Pangolin VPS is hosted by RackNerd:

  • VPS hostname: RN-VPS
  • VPS public IP: 72.11.147.220
  • Operating system: Ubuntu
  • SSH port: TCP 22
  • Current home public IP: 208.96.219.86 (may change when the ISP address changes)

SSH access is restricted by multiple layers:

  1. UFW: incoming traffic is denied by default; TCP port 22 is allowed only from the current home public IP.
  2. Fail2ban: the sshd jail has the current home public IP in ignoreip, so it is not accidentally banned. The value must also be present persistently in /etc/fail2ban/jail.local.
  3. CrowdSec: the Pangolin container can enforce decisions through the Ubuntu host firewall via the INPUT and DOCKER-USER iptables chains.

The backup LXC connects outbound to the VPS. It does not require an inbound connection from the VPS to the home network. If the ISP IP changes, update both UFW and Fail2ban before the next backup.