nixos/pangolin: init

[jackrosenberg]

Init Pangolin module for NixOS: pangolin

Depends on

• fosrl-pangolin: init at 1.2.0 #414976
• fosrl-pangolin: 1.2.0 -> 1.8.0 #419533

Related to:

• nixos/newt: init #414337
• fosrl-gerbil: init at 1.0.0 #414975
• fosrl-olm: init at 1.0.0 #429561
• nixos/traefik: refactor, add plugins option, add documentation #437073

To test:
must reboot after initial setup on remote server
otherwise Newt will give Ping attempt 1 failed: failed to read ICMP packet: i/o timeout
fixed

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 24.11 and 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 24.11 and 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[SigmaSquadron]

• Modules don't have versioning; drop the version information from the module's commit title.

An additional question on upstream support: does pangolin make any distinction between non-breaking and breaking updates? Will all updates be backwards and forward compatible? If the answer to the latter question is no, then we might need to package several Pangolin versions and gate them behind stateVersion in the module.

[SigmaSquadron]

Please add a release note under "new modules" in the NixOS 25.11 release notes.

Like with newt, do a final pass through the option descriptions and examples to ensure everything is properly capitalised, punctuated and the examples make sense.

[jackrosenberg]

@NickCao this is ready for review again, it would be much appreciated if you could take another look :)

[jackrosenberg]

Test WIP, waiting on upstream for a way to make an API key.

[jackrosenberg]

For anyone wondering the apiKey fields in the test are not actually my apiKeys.... anymore :)

[SigmaSquadron]

@ofborg eval

[jackrosenberg]

@SigmaSquadron, waiting for upstream to enable a comprehensive test will likely take quite a bit, so for now i'm pushing this back to the basic test. Ready for review again

[SigmaSquadron]

Final nits, promise.

Module looks good to me.

[SigmaSquadron]

@ofborg test pangolin

[jackrosenberg]

@ofborg test pangolin

[SigmaSquadron]

I've reproduced a working configuration of Pangolin. It's not the prettiest (the service intentionally fails once and then restarts correctly), but this is very much upstream's issue with the wg0 interface. The module is good enough for the basic features of 1.10. A lot of TODOs still, but they can be fixed during the 26.05 release cycle, as several of them are already being worked on in separate PRs.

Congratulations once more on sticking it through to the end, despite the 200+ comments during the review process. Building NixOS modules for four separate micro-services is a massive achievement. This can be merged once the OfBorg tests pass.

[SigmaSquadron]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 416148 --package nixosTests.pangolin
Commit: d3676c73e5b77dbb2eacf03b810f50efbe23b3a5

---

x86_64-linux

✅ 1 test built:

• nixosTests.pangolin

[jackrosenberg]

Wow, this has been one hell of a ride. This started as a package request, and grew into a monster of a module, with many dependencies. I am truly thankful for the community, many of whom answered my insane questions and corrected my logic. This would not have been possible without @SigmaSquadron. Thanks to your unconditional support, and patient teachings, I can finally answer the question that has been burning in the back of my mind these past months: How many microservices do you need to make Bad Tailscale?

6 :)