Quick Deployment Of Newt

[freedbygrace]

There is another package out there called Newt, which can be installed using a package manager and could confuse things down the line. I developed a shell script that will do all the heavy lifting to get your version of Newt configured with ease. I download the latest version automatically and rename the binary on the filesystem to "pangolin.newt" so there is never a chance for contention. I hope this helps streamline deployment! I kept it simple, but this could be made more sophisticated to check if the service exists, stop the service, update the binary, and start the service back up.

P.S. - This is a great product!

Quick question though, is there any way to show which clients are registered to a site? This would be fantastic!

#!/bin/bash

NEWTENDPOINTURL="https://YourPangolinDNSAddress"

NEWTID="YourNewtSiteID"
NEWTSECRET="YourNewtSiteSecret"

NEWTDOWNLOADURL="https://github.com/fosrl/newt/releases/latest/download/newt_linux_amd64"
NEWTDOWNLOADDIRECTORY="/usr/local/bin"
NEWTFILENAME="pangolin.newt"
NEWTFILEPATH="${NEWTDOWNLOADDIRECTORY}/${NEWTFILENAME}"
NEWTSERVICENAME="pangolin.newt.service"
NEWTSERVICEDEFINITIONPATH="/etc/systemd/system/${NEWTSERVICENAME}"

#Get Operating System Information
	shopt -s nocasematch

	. /etc/os-release

	source /etc/os-release

	echo "Operating System Type: ${OSTYPE}"
	echo "Operating System Name: ${NAME}"
	echo "Operating System Version: ${VERSION}"
	echo "Operating System Version CodeName: ${VERSION_CODENAME}"
	echo "Operating System Version ID: ${VERSION_ID}"

	case $NAME in
		"arch")
				#echo "This is Arch Linux!"
				;;

		"centos")
				#echo "This is CentOS!"
				;;

		"debian")
				#echo "This is Debian!"
				;;

		"ubuntu")
				#echo "This is Ubuntu!"
				;;

		*)
				#echo "This is an unknown distribution."
				;;
	esac

RUNNING="$(systemctl show -p SubState ${NEWTSERVICENAME} | cut -d'=' -f2)"

if [ "${RUNNING}" = "running" ]; then
	echo "Attempting to stop service '${NEWTSERVICENAME}'. Please Wait..."
	systemctl stop "${NEWTSERVICENAME}"
	sleep 2s
fi

if [[ -d "${NEWTDOWNLOADDIRECTORY}" ]]; then
	echo "Attempting to create directory '${NEWTDOWNLOADDIRECTORY}'. Please Wait..."
	mkdir -p "${NEWTDOWNLOADDIRECTORY}"
fi

if [[ -f "${NEWTFILEPATH}" ]]; then
	echo "Attempting to remove the existing '${NEWTFILENAME}' binary. Please Wait..."
	echo "Path: ${NEWTFILEPATH}"
	rm -f "${NEWTFILEPATH}"
fi

if [[ ! -f "${NEWTFILEPATH}" ]]; then
	echo "Attempting to download the '${NEWTFILENAME}' binary. Please Wait..."
	echo "Download URL: ${NEWTDOWNLOADURL}"
	echo "Download Path: ${NEWTFILEPATH}"
	wget -q -O "${NEWTFILEPATH}" "${NEWTDOWNLOADURL}"
	sleep 2s
	echo "Attempting to set executable permission on '${NEWTFILEPATH}'. Please Wait..."
	chmod +x "${NEWTFILEPATH}"
fi

if [[ -f "${NEWTSERVICEDEFINITIONPATH}" ]]; then	
		echo "Attempting to remove the current service definition for '${NEWTSERVICENAME}'. Please Wait..."
		echo "Path: ${NEWTSERVICEDEFINITIONPATH}"
		rm -f "${NEWTSERVICEDEFINITIONPATH}"
		sleep 2s
fi

if [[ ! -f "${NEWTSERVICEDEFINITIONPATH}" ]]; then	
		
		echo "Attempting to create a new service definition for '${NEWTSERVICENAME}'. Please Wait..."
		
		echo "Path: ${NEWTSERVICEDEFINITIONPATH}"
		
		cat > "${NEWTSERVICEDEFINITIONPATH}" << EOF
[Unit]
Description=Pangolin Newt VPN Client
After=network.target

[Service]
ExecStart=$NEWTFILEPATH --id $NEWTID --secret $NEWTSECRET --endpoint $NEWTENDPOINTURL
Restart=always
User=root

[Install]
WantedBy=multi-user.target
EOF

sleep 2s
fi
	
echo "Attempting to enable service '${NEWTSERVICENAME}'. Please Wait..."
systemctl enable "${NEWTSERVICENAME}"
		
echo "Attempting to start service '${NEWTSERVICENAME}'. Please Wait..."
systemctl start "${NEWTSERVICENAME}"
		
echo "Attempting to show service status for '${NEWTSERVICENAME}'. Please Wait..."
systemctl -l --no-pager status "${NEWTSERVICENAME}"

Sample SystemCTL Output

● pangolin.newt.service - Pangolin Newt VPN Client
     Loaded: loaded (/etc/systemd/system/pangolin.newt.service; enabled; preset: enabled)
     Active: active (running) since Tue 2025-03-11 02:18:25 UTC; 9h ago
   Main PID: 21905 (pangolin.newt)
      Tasks: 10 (limit: 9432)
     Memory: 7.1M (peak: 7.9M)
        CPU: 3.387s
     CGroup: /system.slice/pangolin.newt.service
             └─21905 /usr/local/bin/pangolin.newt --id YourNewtSiteID --secret YourNewtSiteSecret --endpoint https://YourPangolinDNSAddress

[miloschwartz]

This is cool, thanks! I was not aware of the other package called Newt haha

[freedbygrace]

Yea, nor was I, kind of a random discovery. In any case, glad to contribute. I extended the script a bit more to be able to run multiple times and account for the gotchas. This will basically "In-Place-Upgrade" now as well as do initial installation/configuration.

[oschwartz10612]

I think right now there is not a easy way to know who is accessing resources on a site. Maybe this is something we could add in the future.

[freedbygrace]

OK understood! I meant more like the clients/servers/agents/gerbils that are registered with the site and not so much the clients accessing resources. Sorry if that is what you meant already, I just wanted to be sure.

[Esa-mimbias]

Hi

A bit late because I'm a recent Pangolin user....

Thank you ! It's well written and very useful !

A few changes for my setup :

• external credentials
• adding docker socket option

  - NEWTENDPOINTURL="https://YourPangolinDNSAddress"
  - NEWTID="YourNewtSiteID"
  - NEWTSECRET="YourNewtSiteSecret"
  + source /etc/pangolin.newt.conf
  + if [ -z "${NEWTENDPOINTURL}" ] || [ -z "${NEWTID}" ] || [ -z "${NEWTSECRET}" ]
  + then
  +        echo "please set variables in /etc/pangolin.newt.conf"
  +        echo "mandatory : NEWTENDPOINTURL, NEWTID, NEWTSECRET"
  +        echo "optional  : NEWTOPTIONS"
  +        exit 1
  + fi 

    NEWTSERVICEDEFINITIONPATH="/etc/systemd/system/${NEWTSERVICENAME}"

    [Service]
    - ExecStart=$NEWTFILEPATH --id $NEWTID --secret $NEWTSECRET --endpoint $NEWTENDPOINTURL
    +ExecStart=$NEWTFILEPATH --id $NEWTID --secret $NEWTSECRET --endpoint $NEWTENDPOINTURL $NEWTOPTIONS
    Restart=always

/etc/pangolin.newt.conf indeed contains:

NEWTENDPOINTURL="https://YourPangolinDNSAddress"
NEWTID="YourNewtSiteID"
NEWTSECRET="YourNewtSiteSecret"
NEWTOPTIONS="--docker-socket /var/run/docker.sock"

[taking]

"I am using it like this.

Download the newt binary

sudo sh -c 'curl -L -o /usr/local/bin/newt "https://github.com/fosrl/newt/releases/download/1.4.2/newt_linux_amd64" && chmod +x /usr/local/bin/newt'

Create a systemd service

NEWT_ID=
NEWT_SECRET=
NEWT_ENDPOINT=https://domain.example.com
USER=

sudo tee /etc/systemd/system/newt.service > /dev/null <<EOF
[Unit]
Description=Newt client
After=network.target

[Service]
ExecStart=/usr/local/bin/newt \
  --id ${NEWT_ID} \
  --secret ${NEWT_SECRET} \
  --endpoint ${NEWT_ENDPOINT}
Restart=always
RestartSec=5
User=${USER}

[Install]
WantedBy=multi-user.target
EOF

Register and start the systemd service

sudo systemctl daemon-reload
sudo systemctl enable --now newt.service

In Kubernetes

NEWT_ID=
NEWT_SECRET=
NEWT_ENDPOINT=https://domain.example.com

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: newt-config
data:
  NEWT_ID: ${NEWT_ID}
  NEWT_SECRET: ${NEWT_SECRET}
  PANGOLIN_ENDPOINT: ${NEWT_ENDPOINT}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: newt
  labels:
    app: newt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: newt
  template:
    metadata:
      labels:
        app: newt
    spec:
      containers:
        - name: newt
          image: fosrl/newt
          env:
            - name: NEWT_ID
              valueFrom:
                configMapKeyRef:
                  name: newt-config
                  key: NEWT_ID
            - name: NEWT_SECRET
              valueFrom:
                configMapKeyRef:
                  name: newt-config
                  key: NEWT_SECRET
            - name: PANGOLIN_ENDPOINT
              valueFrom:
                configMapKeyRef:
                  name: newt-config
                  key: PANGOLIN_ENDPOINT