Anyone have Hawser Edge running on a Pangolin (VPS) server

[cryptonym64]

I am trying to add dockhand hawser (edge) to my VPS that runs my Pangolin environment.

All I get from Hawser is:
2026/08/09 21:53:24 [ERROR] Connection failed: WebSocket dial failed: websocket: bad handshake
That's with LOG_LEVEL=debug in the docker. Nothing to really go from.

I confirmed (even regenerated) the dockhand token.

I installed the machine client for the VPN access, along with Hawser set for Edge mode.

For the hawser and pangolin (machine) client it is:

  hawser:
    image: ghcr.io/finsys/hawser:latest
    container_name: hawser
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/hawser-stacks:/opt/hawser-stacks
    environment:
      - STACKS_DIR=/opt/hawser-stacks
      - DOCKHAND_SERVER_URL=wss://dockhand.foo.bar/api/hawser/connect
      - TOKEN=ycREDACTEDs4
      - LOG_LEVEL=debug
    depends_on:
      - pangolin-cli

  pangolin-cli:
    image: fosrl/pangolin-cli:latest
    container_name: pangolin-cli
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.foo.bar
      - CLIENT_ID=iREDACTED7x
      - CLIENT_SECRET=aREDACTEDwh
    depends_on:
      pangolin:
        condition: service_healthy     

I have published a private HTTP resource in Pangolin to the dockhand and granted access to the remote VPS Pangolin machine client.

Thinking it was a port issue, I created a second HOST entry in Pangolin with all ports UDP and TCP open to the VPS machine. No change.

Firewall on VPS is set to allow all outbounds.

On the VPS, I can
curl https://dockhand.foo.bar
and get a valid page. It resolves on 443 through pangolin (backed by Traefik) to the actual port of the dockhand instance.

My understanding is that Pangolin should automatically handle websockets.

I looked at the log on the dockhand server and not seeing anything looking like a connection attempt from the VPS Hawser.

Does anybody have a working Edge Hawser on their VPS via Pangolin? I think I've exhausted my ideas on things to try and places to look for breadcrumbs.

I would really love to use Dockhand to manage the VPS.

[cryptonym64]

What seems to work is to change
wss://dockhand.foo.bar/api/hawser/connect
to
ws://100.123.123.123:3000/api/hawser/connect

This is pointing to the pangolin assigned IP of the device and then into the port dockhand is running on. In doing so, it must also change from wss: to ws: as I am no longer going through traefik but direct. Tunnel is still fully encrypted, so probably safe.

I have no explaination on why regular means aren't working, unless maybe wss: is an alien concept to Pangolin. Judging by zero replies, I guess nobody else uses these in combination. Posting in hopes it helps someone one day or maybe a dev can explain why one works, one doesn't.

[DannyBoyKN]

This works for me:

docker-compose.yml extracts:

...
  pangolin-cli:
    image: fosrl/pangolin-cli
    container_name: pangolin-cli
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    depends_on:
      pangolin:
        condition: service_healthy
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.domain.com
      - CLIENT_ID=[REDACTED]
      - CLIENT_SECRET=[REDACTED]
      - TUNNEL_DNS=true
      - UPSTREAM_DNS=[REDACTED; put your home DNS resolver IP]

  hawser:
    image: ghcr.io/finsys/hawser:latest
    container_name: hawser
    network_mode: service:pangolin-cli
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data/hawser-stacks:/opt/hawser-stacks
    environment:
      - "STACKS_DIR=/opt/hawser-stacks"
      - "DOCKHAND_SERVER_URL=wss://dockhand.domain.com/api/hawser/connect"
      - "TOKEN=[REDACTED]"
      # hawser health is exposed on 2376, also in Edge Mode, so restrict only to localhost
      # else 2376 is expose on 0.0.0.0:2376 and :::2376
      - "BIND_ADDRESS=127.0.0.1"
    restart: unless-stopped
...

Not much different to yours, the crucial parts are TUNNEL_DNS and UPSTREAM_DNS for pangolin-cli and network_mode: service:pangolin-cli for hawser.
You will also need to create a private resource with alias 'dockhand.domain.com' pointing to your home's Dockhand-IP:Dockhand-Port.
The only thing not yet working - actually I don't understand the purpose yet - is 'data/hawser-stacks' but at home I open my Dockhand and can fully manage the containers on my VPS 😃

Let me know if you succeed.

[AstralDestiny]

Would only say not to have it on host for pangolin-cli and just restrict it to the docker network honestly. Though even on host aliases often fail when you do.. So no real upside to have it via host right now.

[DannyBoyKN]

I tried adding this to my compose file:

networks:
  default:
     driver: bridge
     name: pangolin
   internal_net:
     internal: true

and adding both to pangolin-cli service but pangolin-cli couldn't connect to endpoint:

...
pangolin-cli  | ERROR: 2026/09/16 10:19:50 websocket: Failed to get token with status code: 403, body:
pangolin-cli  | ERROR: 2026/09/16 10:19:50 Authentication failed: authentication error (status 403): . Terminating tunnel and retrying...
pangolin-cli  | ERROR: 2026/09/16 10:19:50 Authentication error (status 403): . Terminating tunnel.
pangolin-cli  | INFO: 2026/09/16 10:19:50 Cleared all network settings
pangolin-cli  | INFO: 2026/09/16 10:19:50 Released shared UDP bind
pangolin-cli  | INFO: 2026/09/16 10:19:50 Olm service stopped
pangolin-cli  | Client process terminated
pangolin-cli  | Received shutdown signal, stopping tunnel
pangolin-cli  | INFO: 2026/09/16 10:19:50 Olm service stopped
pangolin-cli  | INFO: 2026/09/16 10:19:50 Tunnel process context cancelled, cleaning up
pangolin-cli  | Authentication error: 403