Newt Blueprint Generator by rknall/claude-skills
npx skills add https://github.com/rknall/claude-skills --skill 'Newt Blueprint Generator'用于创建、验证和管理 Pangolin Newt 蓝图配置的专家级协助。
此技能应在以下情况触发:
Pangolin 蓝图是一种声明式配置,允许您以结构化格式定义资源及其设置。它们支持两种格式:
YAML 配置可以通过以下方式应用:
--blueprint-file /path/to/blueprint.yaml/org/{orgId}/blueprint 发送 POST 请求,请求体为 base64 编码的 JSONNewt 使用示例:
newt --blueprint-file /path/to/blueprint.yaml <other-args>
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
对于容器化应用程序,可以使用带有 pangolin. 前缀的 Docker 标签来定义蓝图。
启用 Docker 套接字访问:
newt --docker-socket /var/run/docker.sock <other-args>
或使用环境变量:
DOCKER_SOCKET=/var/run/docker.sock
代理资源通过 Pangolin 暴露 HTTP、TCP 或 UDP 服务。
proxy-resources:
resource-nice-id-uno:
name: this is a http resource
protocol: http
full-domain: uno.example.com
host-header: example.com
tls-server-name: example.com
headers:
- name: X-Example-Header
value: example-value
- name: X-Another-Header
value: another-value
rules:
- action: allow
match: ip
value: 1.1.1.1
- action: deny
match: cidr
value: 2.2.2.2/32
- action: pass
match: path
value: /admin
targets:
- site: lively-yosemite-toad
hostname: localhost
method: http
port: 8000
- site: slim-alpine-chipmunk
hostname: localhost
path: /admin
path-match: exact
method: https
port: 8001
proxy-resources:
resource-nice-id-dos:
name: this is a raw resource
protocol: tcp
proxy-port: 3000
targets:
- site: lively-yosemite-toad
hostname: localhost
port: 3000
仅包含目标配置的简化资源:
proxy-resources:
additional-targets:
targets:
- site: another-site
hostname: backend-server
method: https
port: 8443
- site: another-site
hostname: backup-server
method: http
port: 8080
注意:使用仅包含目标的资源时,不需要 name 和 protocol 字段。
客户端资源定义了可通过 Olm 客户端(SSH、RDP)访问的代理资源:
client-resources:
client-resource-nice-id-uno:
name: this is my resource
protocol: tcp
proxy-port: 3001
hostname: localhost
internal-port: 3000
site: lively-yosemite-toad
身份验证默认关闭。通过在 auth 部分添加字段来启用。
注意:身份验证仅允许在 HTTP 资源上使用,不允许在 TCP/UDP 资源上使用。
proxy-resources:
secure-resource:
name: Secured Resource
protocol: http
full-domain: secure.example.com
auth:
pincode: 123456
password: your-secure-password
basic-auth:
user: asdfa
password: sadf
sso-enabled: true
sso-roles:
- Member
- Admin
sso-users:
- user@example.com
whitelist-users:
- admin@example.com
services:
newt:
image: fosrl/newt
container_name: newt
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
- PANGOLIN_ENDPOINT=https://app.pangolin.net
- NEWT_ID=h1rbsgku89wf9z3
- NEWT_SECRET=z7g54mbcwkglpx1aau9gb8mzcccoof2fdbs97keoakg2pp5z
- DOCKER_SOCKET=/var/run/docker.sock
nginx1:
image: nginxdemos/hello
container_name: nginx1
labels:
# Proxy Resource Configuration
- pangolin.proxy-resources.nginx.name=nginx
- pangolin.proxy-resources.nginx.full-domain=nginx.fosrl.io
- pangolin.proxy-resources.nginx.protocol=http
- pangolin.proxy-resources.nginx.headers[0].name=X-Example-Header
- pangolin.proxy-resources.nginx.headers[0].value=example-value
# Target Configuration - port and hostname auto-detected
- pangolin.proxy-resources.nginx.targets[0].method=http
- pangolin.proxy-resources.nginx.targets[0].path=/path
- pangolin.proxy-resources.nginx.targets[0].path-match=prefix
nginx2:
image: nginxdemos/hello
container_name: nginx2
labels:
# Additional target with explicit hostname and port
- pangolin.proxy-resources.nginx.targets[1].method=http
- pangolin.proxy-resources.nginx.targets[1].hostname=nginx2
- pangolin.proxy-resources.nginx.targets[1].port=80
networks:
default:
name: pangolin_default
| 属性 | 类型 | 必需 | 描述 | 约束 |
|---|---|---|---|---|
name | string | 条件性 | 人类可读的名称 | 除非是仅包含目标的资源,否则必需 |
protocol | string | 条件性 | 协议类型(http、tcp、udp) | 除非是仅包含目标的资源,否则必需 |
full-domain | string | 仅限 HTTP | 完整域名 | HTTP 必需,必须唯一 |
proxy-port | number | 仅限 TCP/UDP | 原始 TCP/UDP 的端口 | TCP/UDP 必需,1-65535,必须唯一 |
ssl | boolean | 否 | 启用 SSL/TLS | - |
enabled | boolean | 否 | 资源是否启用 | 默认为 true |
host-header | string | 否 | 自定义 Host 头 | - |
tls-server-name | string | 否 | TLS 的 SNI 名称 | - |
headers | array | 否 | 自定义头部 | 每个都需要 name 和 value(至少 1 个字符) |
rules | array | 否 | 访问控制规则 | 参见规则部分 |
auth | object | 仅限 HTTP | 身份验证配置 | 参见身份验证部分 |
targets | array | 是 | 目标端点 | 参见目标部分 |
| 属性 | 类型 | 必需 | 描述 | 约束 |
|---|---|---|---|---|
site | string | 否 | 站点标识符 | - |
hostname | string | 是 | 目标主机名或 IP | - |
port | number | 是 | 目标端口 | 1-65535 |
method | string | 仅限 HTTP | 协议方法(http、https、h2c) | HTTP 必需 |
enabled | boolean | 否 | 目标是否启用 | 默认为 true |
internal-port | number | 否 | 内部端口映射 | 1-65535 |
path | string | 仅限 HTTP | 路径前缀、精确匹配或正则表达式 | - |
path-match | string | 仅限 HTTP | 路径匹配类型(prefix、exact、regex) | - |
不允许在 TCP/UDP 资源上使用。
| 属性 | 类型 | 必需 | 描述 | 约束 |
|---|---|---|---|---|
pincode | number | 否 | 6 位 PIN 码 | 必须恰好为 6 位数字 |
password | string | 否 | 访问密码 | - |
basic-auth | object | 否 | 基本身份验证配置 | 需要 user 和 password |
sso-enabled | boolean | 否 | 启用 SSO | 默认为 false |
sso-roles | array | 否 | 允许的 SSO 角色 | 不能包含 "Admin" 角色 |
sso-users | array | 否 | 允许的 SSO 用户邮箱 | 必须是有效的邮箱地址 |
whitelist-users | array | 否 | 白名单用户邮箱 | 必须是有效的邮箱地址 |
| 属性 | 类型 | 必需 | 描述 | 约束 |
|---|---|---|---|---|
action | string | 是 | 规则动作(allow、deny、pass) | - |
match | string | 是 | 匹配类型(cidr、path、ip、country) | - |
value | string | 是 | 要匹配的值 | 格式取决于匹配类型 |
| 属性 | 类型 | 必需 | 描述 | 约束 |
|---|---|---|---|---|
name | string | 是 | 人类可读的名称 | 2-100 个字符 |
protocol | string | 是 | 协议类型(tcp、udp) | - |
proxy-port | number | 是 | 客户端可访问的端口 | 1-65535,必须唯一 |
hostname | string | 是 | 目标主机名或 IP | 1-255 个字符 |
internal-port | number | 是 | 目标系统上的端口 | 1-65535 |
site | string | 否 | 站点标识符 | 2-100 个字符 |
enabled | boolean | 否 | 资源是否启用 | 默认为 true |
targets 字段,这使得 name 和 protocol 成为可选的full-domain,并且所有目标都必须有 method 字段proxy-port,并且目标不能有 method 字段auth 配置proxy-port 值在 proxy-resources 内必须唯一proxy-port 值在 client-resources 内必须唯一full-domain 值在所有代理资源中必须唯一http 时,所有非空目标都必须指定 methodAdmin 角色是保留的,不能包含在 sso-roles 数组中。
解决方案:从 sso-roles 数组中移除 "Admin"。
每个 full-domain 在所有代理资源中必须是唯一的。
解决方案:为多个资源使用不同的子域名或路径。
proxy-port 中的端口号在其资源类型内必须是唯一的。
解决方案:在 proxy-resources 和 client-resources 中分别分配唯一的端口号。
HTTP 代理资源中的所有目标都必须指定连接方法。
解决方案:为所有目标添加 method: http、method: https 或 method: h2c。
TCP 和 UDP 目标不应包含 method 字段。
解决方案:从 TCP/UDP 资源目标中移除 method 字段。
身份验证仅支持 HTTP 资源。
解决方案:从 TCP/UDP 资源中移除 auth 部分。
资源必须是仅包含目标的资源,或者是完整的资源定义。
解决方案:要么只提供 targets 字段,要么同时包含 name 和 protocol 字段。
当用户请求 Pangolin Newt 蓝图配置时:
收集需求:
选择格式:
验证配置:
full-domain(HTTP)或 proxy-port(TCP/UDP)的唯一性method 字段method 字段生成配置:
提供使用说明:
web-app-prod、database-backup)siteprefix 进行广泛匹配,使用 exact 进行特定端点匹配需求:通过 HTTPS 在 app.example.com 上暴露运行在 localhost:8080 的 Web 应用程序
proxy-resources:
web-app:
name: Web Application
protocol: http
full-domain: app.example.com
targets:
- hostname: localhost
port: 8080
method: https
需求:在端口 5432 上暴露 PostgreSQL 数据库
proxy-resources:
postgres-db:
name: PostgreSQL Database
protocol: tcp
proxy-port: 5432
targets:
- hostname: localhost
port: 5432
需求:同一域名的多个后端服务器
proxy-resources:
api-service:
name: API Service
protocol: http
full-domain: api.example.com
targets:
- site: site-01
hostname: backend-01
port: 8080
method: http
- site: site-02
hostname: backend-02
port: 8080
method: http
需求:带有 SSO 身份验证的 Web 应用程序
proxy-resources:
secure-app:
name: Secure Application
protocol: http
full-domain: secure.example.com
auth:
sso-enabled: true
sso-roles:
- Member
- Developer
sso-users:
- admin@example.com
targets:
- hostname: localhost
port: 3000
method: https
生成蓝图时:
每周安装次数
–
代码仓库
GitHub 星标数
33
首次出现时间
–
安全审计
Expert assistance for creating, validating, and managing Pangolin Newt blueprint configurations.
This skill should be triggered when:
Pangolin Blueprints are declarative configurations that allow you to define resources and their settings in a structured format. They support two formats:
YAML configs can be applied using:
--blueprint-file /path/to/blueprint.yaml/org/{orgId}/blueprint with base64-encoded JSON bodyExample Newt usage:
newt --blueprint-file /path/to/blueprint.yaml <other-args>
For containerized applications, blueprints can be defined using Docker labels with the pangolin. prefix.
Enable Docker socket access:
newt --docker-socket /var/run/docker.sock <other-args>
Or use environment variable:
DOCKER_SOCKET=/var/run/docker.sock
Proxy resources expose HTTP, TCP, or UDP services through Pangolin.
proxy-resources:
resource-nice-id-uno:
name: this is a http resource
protocol: http
full-domain: uno.example.com
host-header: example.com
tls-server-name: example.com
headers:
- name: X-Example-Header
value: example-value
- name: X-Another-Header
value: another-value
rules:
- action: allow
match: ip
value: 1.1.1.1
- action: deny
match: cidr
value: 2.2.2.2/32
- action: pass
match: path
value: /admin
targets:
- site: lively-yosemite-toad
hostname: localhost
method: http
port: 8000
- site: slim-alpine-chipmunk
hostname: localhost
path: /admin
path-match: exact
method: https
port: 8001
proxy-resources:
resource-nice-id-dos:
name: this is a raw resource
protocol: tcp
proxy-port: 3000
targets:
- site: lively-yosemite-toad
hostname: localhost
port: 3000
Simplified resources containing only target configurations:
proxy-resources:
additional-targets:
targets:
- site: another-site
hostname: backend-server
method: https
port: 8443
- site: another-site
hostname: backup-server
method: http
port: 8080
Note : When using targets-only resources, name and protocol fields are not required.
Client resources define proxied resources accessible via Olm client (SSH, RDP):
client-resources:
client-resource-nice-id-uno:
name: this is my resource
protocol: tcp
proxy-port: 3001
hostname: localhost
internal-port: 3000
site: lively-yosemite-toad
Authentication is off by default. Enable by adding fields in the auth section.
Note : Authentication is only allowed on HTTP resources, not TCP/UDP.
proxy-resources:
secure-resource:
name: Secured Resource
protocol: http
full-domain: secure.example.com
auth:
pincode: 123456
password: your-secure-password
basic-auth:
user: asdfa
password: sadf
sso-enabled: true
sso-roles:
- Member
- Admin
sso-users:
- user@example.com
whitelist-users:
- admin@example.com
services:
newt:
image: fosrl/newt
container_name: newt
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
- PANGOLIN_ENDPOINT=https://app.pangolin.net
- NEWT_ID=h1rbsgku89wf9z3
- NEWT_SECRET=z7g54mbcwkglpx1aau9gb8mzcccoof2fdbs97keoakg2pp5z
- DOCKER_SOCKET=/var/run/docker.sock
nginx1:
image: nginxdemos/hello
container_name: nginx1
labels:
# Proxy Resource Configuration
- pangolin.proxy-resources.nginx.name=nginx
- pangolin.proxy-resources.nginx.full-domain=nginx.fosrl.io
- pangolin.proxy-resources.nginx.protocol=http
- pangolin.proxy-resources.nginx.headers[0].name=X-Example-Header
- pangolin.proxy-resources.nginx.headers[0].value=example-value
# Target Configuration - port and hostname auto-detected
- pangolin.proxy-resources.nginx.targets[0].method=http
- pangolin.proxy-resources.nginx.targets[0].path=/path
- pangolin.proxy-resources.nginx.targets[0].path-match=prefix
nginx2:
image: nginxdemos/hello
container_name: nginx2
labels:
# Additional target with explicit hostname and port
- pangolin.proxy-resources.nginx.targets[1].method=http
- pangolin.proxy-resources.nginx.targets[1].hostname=nginx2
- pangolin.proxy-resources.nginx.targets[1].port=80
networks:
default:
name: pangolin_default
| Property | Type | Required | Description | Constraints |
|---|---|---|---|---|
name | string | Conditional | Human-readable name | Required unless targets-only |
protocol | string | Conditional | Protocol type (http, tcp, udp) | Required unless targets-only |
full-domain |
| Property | Type | Required | Description | Constraints |
|---|---|---|---|---|
site | string | No | Site identifier | - |
hostname | string | Yes | Target hostname or IP | - |
port | number | Yes | Target port | 1-65535 |
method | string |
Not allowed on TCP/UDP resources.
| Property | Type | Required | Description | Constraints |
|---|---|---|---|---|
pincode | number | No | 6-digit PIN | Must be exactly 6 digits |
password | string | No | Password for access | - |
basic-auth | object | No | Basic auth config | Requires user and password |
| Property | Type | Required | Description | Constraints |
|---|---|---|---|---|
action | string | Yes | Rule action (allow, deny, pass) | - |
match | string | Yes | Match type (cidr, path, , ) |
| Property | Type | Required | Description | Constraints |
|---|---|---|---|---|
name | string | Yes | Human-readable name | 2-100 characters |
protocol | string | Yes | Protocol type (tcp, udp) | - |
proxy-port | number | Yes | Port accessible to clients |
targets field, making name and protocol optionalfull-domain and all targets must have method fieldproxy-port and targets must NOT have method fieldauth configurationThe Admin role is reserved and cannot be included in the sso-roles array.
Solution : Remove "Admin" from the sso-roles array.
Each full-domain must be unique across all proxy resources.
Solution : Use different subdomains or paths for multiple resources.
Port numbers in proxy-port must be unique within their resource type.
Solution : Assign unique port numbers within proxy-resources and client-resources separately.
All targets in HTTP proxy resources must specify the connection method.
Solution : Add method: http, method: https, or method: h2c to all targets.
TCP and UDP targets should not include the method field.
Solution : Remove the method field from TCP/UDP resource targets.
Authentication is only supported for HTTP resources.
Solution : Remove the auth section from TCP/UDP resources.
Resources must be either targets-only or complete resource definitions.
Solution : Either provide only targets field, or include both name and protocol fields.
When a user requests a Pangolin Newt blueprint configuration:
Gather Requirements :
Select Format :
Validate Configuration :
full-domain (HTTP) or proxy-port (TCP/UDP)method fieldmethod field:
web-app-prod, database-backup)site for multi-site deploymentsprefix for broad matches, exact for specific endpointsRequirements : Expose a web app running on localhost:8080 via HTTPS at app.example.com
proxy-resources:
web-app:
name: Web Application
protocol: http
full-domain: app.example.com
targets:
- hostname: localhost
port: 8080
method: https
Requirements : Expose PostgreSQL database on port 5432
proxy-resources:
postgres-db:
name: PostgreSQL Database
protocol: tcp
proxy-port: 5432
targets:
- hostname: localhost
port: 5432
Requirements : Multiple backend servers for the same domain
proxy-resources:
api-service:
name: API Service
protocol: http
full-domain: api.example.com
targets:
- site: site-01
hostname: backend-01
port: 8080
method: http
- site: site-02
hostname: backend-02
port: 8080
method: http
Requirements : Web app with SSO authentication
proxy-resources:
secure-app:
name: Secure Application
protocol: http
full-domain: secure.example.com
auth:
sso-enabled: true
sso-roles:
- Member
- Developer
sso-users:
- admin@example.com
targets:
- hostname: localhost
port: 3000
method: https
When generating blueprints:
Weekly Installs
–
Repository
GitHub Stars
33
First Seen
–
Security Audits
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
114,200 周安装
| string |
| HTTP only |
| Full domain name |
| Required for HTTP, must be unique |
proxy-port | number | TCP/UDP only | Port for raw TCP/UDP | Required for TCP/UDP, 1-65535, must be unique |
ssl | boolean | No | Enable SSL/TLS | - |
enabled | boolean | No | Whether resource is enabled | Defaults to true |
host-header | string | No | Custom Host header | - |
tls-server-name | string | No | SNI name for TLS | - |
headers | array | No | Custom headers | Each requires name and value (min 1 char) |
rules | array | No | Access control rules | See Rules section |
auth | object | HTTP only | Authentication config | See Authentication section |
targets | array | Yes | Target endpoints | See Targets section |
| HTTP only |
Protocol method (http, https, h2c) |
| Required for HTTP |
enabled | boolean | No | Whether target is enabled | Defaults to true |
internal-port | number | No | Internal port mapping | 1-65535 |
path | string | HTTP only | Path prefix, exact, or regex | - |
path-match | string | HTTP only | Path matching type (prefix, exact, regex) | - |
sso-enabled | boolean | No | Enable SSO | Defaults to false |
sso-roles | array | No | Allowed SSO roles | Cannot include "Admin" role |
sso-users | array | No | Allowed SSO user emails | Must be valid emails |
whitelist-users | array | No | Whitelisted user emails | Must be valid emails |
ipcountry| - |
value | string | Yes | Value to match | Format depends on match type |
| 1-65535, must be unique |
hostname | string | Yes | Target hostname or IP | 1-255 characters |
internal-port | number | Yes | Port on target system | 1-65535 |
site | string | No | Site identifier | 2-100 characters |
enabled | boolean | No | Whether resource is enabled | Defaults to true |
proxy-port values must be unique within proxy-resourcesproxy-port values must be unique within client-resourcesfull-domain values must be unique across all proxy resourceshttp, all non-null targets must specify a methodProvide Usage Instructions :