From fea1230e95850441cee9f3ad74a11dfad66c283b Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 7 Jul 2026 11:08:50 -0400 Subject: [PATCH 1/4] Remove the default dns for upstream and netstack --- cmd/up/client/client.go | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/cmd/up/client/client.go b/cmd/up/client/client.go index 1995995..b8cac33 100644 --- a/cmd/up/client/client.go +++ b/cmd/up/client/client.go @@ -29,7 +29,6 @@ import ( ) const ( - defaultDNSServer = "1.1.1.1" defaultEnableAPI = true defaultSocketPath = "/var/run/olm.sock" defaultAgent = olm.AgentName @@ -61,7 +60,7 @@ type ClientUpCmdOpts struct { func validateDNSIP(s, field string) error { s = strings.TrimSpace(s) if s == "" { - return fmt.Errorf("%s: DNS server cannot be empty", field) + return nil } host := s if strings.Contains(s, ":") { @@ -120,7 +119,7 @@ func ClientUpCmd() *cobra.Command { cmd.Flags().StringVar(&opts.OrgID, "org", "", "Organization ID (default: selected organization if logged in)") cmd.Flags().StringVar(&opts.Endpoint, "endpoint", "", "Client endpoint (required if not logged in)") cmd.Flags().IntVar(&opts.MTU, "mtu", 1280, "Maximum transmission unit") - cmd.Flags().StringVar(&opts.DNS, "netstack-dns", defaultDNSServer, "DNS `server` to use for Netstack. This handles DNS resolution outside of the upstream servers.") + cmd.Flags().StringVar(&opts.DNS, "netstack-dns", "", "DNS `server` to use for Netstack. This handles DNS resolution outside of the upstream servers.") cmd.Flags().StringVar(&opts.InterfaceName, "interface-name", "pangolin", "Interface `name`") cmd.Flags().StringVar(&opts.LogLevel, "log-level", "info", "Log level") cmd.Flags().StringVar(&opts.HTTPAddr, "http-addr", "", "HTTP address for API server") @@ -130,7 +129,7 @@ func ClientUpCmd() *cobra.Command { cmd.Flags().StringVar(&opts.TlsClientCert, "tls-client-cert", "", "TLS client certificate `path`") cmd.Flags().BoolVar(&opts.OverrideDNS, "override-dns", true, "When enabled, the client uses custom DNS servers to resolve internal resources and aliases. This overrides your system's default DNS settings. Queries that cannot be resolved as a Pangolin resource will be forwarded to your configured Upstream DNS Server.") cmd.Flags().BoolVar(&opts.TunnelDNS, "tunnel-dns", false, "When enabled, DNS queries are routed through the tunnel for remote resolution. To ensure queries are tunneled correctly, you must define the DNS server as a Pangolin resource and enter its address as an Upstream DNS Server.") - cmd.Flags().StringSliceVar(&opts.UpstreamDNS, "upstream-dns", []string{defaultDNSServer}, "List of DNS servers to use for external DNS resolution if overriding system DNS") + cmd.Flags().StringSliceVar(&opts.UpstreamDNS, "upstream-dns", []string{}, "List of DNS servers to use for external DNS resolution if overriding system DNS") cmd.Flags().BoolVar(&opts.Attached, "attach", false, "Run in attached (foreground) mode, (default: detached (background) mode)") cmd.Flags().BoolVar(&opts.Silent, "silent", false, "Disable TUI and run silently when detached") @@ -496,12 +495,6 @@ func clientUpMain(cmd *cobra.Command, opts *ClientUpCmdOpts, extraArgs []string) upstreamDNS = append(upstreamDNS, server) } - // If no DNS servers were provided, force using - // the default server again. - if len(upstreamDNS) == 0 { - upstreamDNS = []string{fmt.Sprintf("%s:53", defaultDNSServer)} - } - // Setup log file if specified if logFile != "" { if err := setupLogFile(cfg.LogFile); err != nil { From d47575108ec29466ba52e2219b52bb27c1fcb602 Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 7 Jul 2026 17:56:34 -0400 Subject: [PATCH 2/4] Update docs --- docs/pangolin_up.md | 4 ++-- docs/pangolin_up_client.md | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/docs/pangolin_up.md b/docs/pangolin_up.md index ba636c5..60a90a9 100644 --- a/docs/pangolin_up.md +++ b/docs/pangolin_up.md @@ -25,7 +25,6 @@ pangolin up [flags] --interface-name name Interface name (default "pangolin") --log-level string Log level (default "info") --mtu int Maximum transmission unit (default 1280) - --netstack-dns server DNS server to use for Netstack. This handles DNS resolution outside of the upstream servers. (default "1.1.1.1") --org string Organization ID (default: selected organization if logged in) --override-dns When enabled, the client uses custom DNS servers to resolve internal resources and aliases. This overrides your system's default DNS settings. Queries that cannot be resolved as a Pangolin resource will be forwarded to your configured Upstream DNS Server. (default true) --ping-interval interval Ping interval (default 5s) @@ -34,7 +33,8 @@ pangolin up [flags] --silent Disable TUI and run silently when detached --tls-client-cert path TLS client certificate path --tunnel-dns When enabled, DNS queries are routed through the tunnel for remote resolution. To ensure queries are tunneled correctly, you must define the DNS server as a Pangolin resource and enter its address as an Upstream DNS Server. - --upstream-dns strings List of DNS servers to use for external DNS resolution if overriding system DNS (default [1.1.1.1]) + --netstack-dns server DNS server to use for Netstack. This handles DNS resolution outside of the upstream servers + --upstream-dns strings List of DNS servers to use for external DNS resolution if overriding system DNS ``` ### SEE ALSO diff --git a/docs/pangolin_up_client.md b/docs/pangolin_up_client.md index b19a4a2..c14bb91 100644 --- a/docs/pangolin_up_client.md +++ b/docs/pangolin_up_client.md @@ -22,7 +22,6 @@ pangolin up client [flags] --interface-name name Interface name (default "pangolin") --log-level string Log level (default "info") --mtu int Maximum transmission unit (default 1280) - --netstack-dns server DNS server to use for Netstack. This handles DNS resolution outside of the upstream servers. (default "1.1.1.1") --org string Organization ID (default: selected organization if logged in) --override-dns When enabled, the client uses custom DNS servers to resolve internal resources and aliases. This overrides your system's default DNS settings. Queries that cannot be resolved as a Pangolin resource will be forwarded to your configured Upstream DNS Server. (default true) --ping-interval interval Ping interval (default 5s) @@ -31,10 +30,10 @@ pangolin up client [flags] --silent Disable TUI and run silently when detached --tls-client-cert path TLS client certificate path --tunnel-dns When enabled, DNS queries are routed through the tunnel for remote resolution. To ensure queries are tunneled correctly, you must define the DNS server as a Pangolin resource and enter its address as an Upstream DNS Server. - --upstream-dns strings List of DNS servers to use for external DNS resolution if overriding system DNS (default [1.1.1.1]) + --netstack-dns server DNS server to use for Netstack. This handles DNS resolution outside of the upstream servers if overriding using the system DNS + --upstream-dns strings List of DNS servers to use for external DNS resolution if overriding using the system DNS ``` ### SEE ALSO -* [pangolin up](pangolin_up.md) - Start a connection - +- [pangolin up](pangolin_up.md) - Start a connection From f38b8ff6817a7d55e1c38d26e5716697a8cf826a Mon Sep 17 00:00:00 2001 From: Owen Date: Wed, 8 Jul 2026 09:46:46 -0400 Subject: [PATCH 3/4] Update olm and newt --- go.mod | 22 +++++++++++----------- go.sum | 44 ++++++++++++++++++++++---------------------- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/go.mod b/go.mod index 099d98b..2d38a98 100644 --- a/go.mod +++ b/go.mod @@ -10,16 +10,16 @@ require ( github.com/charmbracelet/huh v0.8.0 github.com/charmbracelet/lipgloss v1.1.0 github.com/creack/pty v1.1.24 - github.com/fosrl/newt v1.13.0 - github.com/fosrl/olm v1.6.2 + github.com/fosrl/newt v1.14.0 + github.com/fosrl/olm v1.7.0 github.com/mattn/go-isatty v0.0.20 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c github.com/spf13/cobra v1.10.2 github.com/spf13/viper v1.21.0 go.yaml.in/yaml/v3 v3.0.4 - golang.org/x/crypto v0.52.0 - golang.org/x/sys v0.45.0 - golang.org/x/term v0.43.0 + golang.org/x/crypto v0.53.0 + golang.org/x/sys v0.46.0 + golang.org/x/term v0.44.0 ) require ( @@ -61,18 +61,18 @@ require ( github.com/vishvananda/netns v0.0.5 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 // indirect - golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.55.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/text v0.37.0 // indirect + golang.org/x/mod v0.36.0 // indirect + golang.org/x/net v0.56.0 // indirect + golang.org/x/sync v0.21.0 // indirect + golang.org/x/text v0.38.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.44.0 // indirect + golang.org/x/tools v0.45.0 // indirect golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 // indirect golang.zx2c4.com/wireguard/windows v1.0.1 // indirect gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c // indirect - software.sslmate.com/src/go-pkcs12 v0.7.1 // indirect + software.sslmate.com/src/go-pkcs12 v0.7.3 // indirect ) // If changes to Olm or Newt are required, use these diff --git a/go.sum b/go.sum index f49d158..87e9625 100644 --- a/go.sum +++ b/go.sum @@ -50,10 +50,10 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM= -github.com/fosrl/newt v1.13.0 h1:XKpII/ijhXMb8WFN4X3rE0GTY/qCYb4iqNBGdNG5cMI= -github.com/fosrl/newt v1.13.0/go.mod h1:jUIZKuHyGFet/J0Op2AuJfp7U6+1Ip6MiSMC3BLT8mE= -github.com/fosrl/olm v1.6.2 h1:fxrIVQP1hfyfozdwQL0Y+mcJAyUO8YBHiowTKQJMC2U= -github.com/fosrl/olm v1.6.2/go.mod h1:m536TBDEy2kmltv73e0jwvm/apDRRTiGM4E1WGe/xNA= +github.com/fosrl/newt v1.14.0 h1:9jpyfCNAtsH7rPojyIGJwqOqnLZdxm8b+njY5ZuY/6c= +github.com/fosrl/newt v1.14.0/go.mod h1:l6kWoZPSaXT+ZRUjiyPgwflRqZWYaXpUj9oQ0sOPh4o= +github.com/fosrl/olm v1.7.0 h1:Om/wXKNcbNz1hN46olKrkwQd3bUknzqP2qxCYPDEyXI= +github.com/fosrl/olm v1.7.0/go.mod h1:6TXwb4EXb1DfqB3Ks2QPZotsOtg+aJsa/t4VWaMIPHI= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= @@ -132,31 +132,31 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= +golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 h1:zfMcR1Cs4KNuomFFgGefv5N0czO2XZpUbxGUy8i8ug0= golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6/go.mod h1:46edojNIoXTNOhySWIWdix628clX9ODXwPsQuG6hsK0= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= +golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= +golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= -golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= +golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= +golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= -golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= -golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= +golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg= golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI= golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A= @@ -172,5 +172,5 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI= gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g= -software.sslmate.com/src/go-pkcs12 v0.7.1 h1:bxkUPRsvTPNRBZa4M/aSX4PyMOEbq3V8I6hbkG4F4Q8= -software.sslmate.com/src/go-pkcs12 v0.7.1/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= +software.sslmate.com/src/go-pkcs12 v0.7.3 h1:JBQD3FDqYjTeyDAeZQklj2ar88ykBLtALloPJHyAauU= +software.sslmate.com/src/go-pkcs12 v0.7.3/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= From 172911d7f845143f0eddde4271aea28a7e370aef Mon Sep 17 00:00:00 2001 From: Owen Date: Wed, 8 Jul 2026 10:05:24 -0400 Subject: [PATCH 4/4] Update flake --- flake.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index a1d891a..64dc9b6 100644 --- a/flake.nix +++ b/flake.nix @@ -21,10 +21,10 @@ in rec { pangolin-cli = pkgs.buildGoModule { pname = "pangolin-cli"; - version = "0.1.0"; + version = "0.13.0"; src = ./.; - vendorHash = "sha256-T900orb3Zl1tG8vxCWk31unlIWO4ltKzQ+cNB+z3aQY="; + vendorHash = "sha256-yHU/xfO+I5YncycGkPkpKGUM11YyMrAkS17N/nAmUc0="; ldflags = [ "-s"