Guard Connector

Guard Connector runs the official pinned Newt binary and establishes an outbound Pangolin tunnel for a Guard location.

First release

Create a Newt site provisioning key in Pangolin and configure:

Option	Description
endpoint	Pangolin HTTPS origin without /api.
provisioning_key	One-time site key; clear it after enrollment.
site_name	Name assigned during first provisioning.
log_level	DEBUG, INFO, WARN, or ERROR.

The future Guard enrollment-code exchange is not yet wired in this first package. Use a Pangolin provisioning key directly.

The exchanged Newt ID and secret persist in a mode-0600 file under app /data. The app requests no Home Assistant, Supervisor, Docker, host-network, admin, or full-access permissions. Its health check follows the actual Newt tunnel ping, not merely the container process. Downstream Pangolin Client/VPN forwarding and Newt SSH/auth-daemon modes are disabled. The main site tunnel still serves configured public resources. Private-resource/VPN support is a future explicit opt-in rather than part of this least-privilege first release.

See the complete app documentation.