Skip to content
MangoDock

  • MangoFly

    A self-hosted WireGuard mesh. Devices connect straight to each other; the coordination server is one binary and a SQLite file, and never sees their traffic.

    ExploreDocsPricing
    encrypted WireGuard · peer to peerLaptopbehind home NATServerin a datacentrePhoneon mobile datacoordination serverone binary · one SQLite filecontrol plane only (TLS)keys · tunnel addresses · peer lists · sealed ICE candidatesholds no private keys · carries no traffic · cannot decryptdatacontrol

  • MangoDock

    Docker management with nothing on the hosts. Reaches each daemon over an ordinary SSH session — no agent to install, no port to open.

    ExploreDocsPricing
    The MangoDock dashboard showing three host cards with container state counts, CPU and memory gauges, a usage history and recent events

  • MangoWiFi

    A Wi-Fi 6/7/8 test bench. One binary runs as Console or Agent either side of the access point under test, measuring latency under real load.

    ExploreDocsPricing
    AP under testWi-Fi 6 / 6E / 7Agentstation side · real radioLAN receiveriperf3 -sConsoleUI · orchestrates · probes
  • Blog

  • Nothing phones home

    No telemetry, no analytics, no crash reporter, no account login. Check it with a packet capture on your own network.

    Download MangoSSH
  • Project
  • Download

    • Reference

    Environment variables

    Every variable the binary reads. There is no configuration file — these and the UI are the whole surface.

    Server

    VariableWhat it does
    MANGODOCK_PORTThe port inside the container. Not the published port — the left side of your -p mapping is what matters from outside.
    MANGODOCK_DATA_DIRWhere the database, the encryption key and the dial-in listener's identity live. Defaults to /app/data.
    MANGODOCK_DATABASE_URLA postgres:// URL, to use Postgres instead of the bundled SQLite.
    MANGODOCK_SECRET_KEYSupplies the credential-encryption key instead of reading secret.key from the data directory. If it changes between starts, MangoDock will not start.
    MANGODOCK_WEB_DIRServe the frontend from a directory instead of the one baked into the image.

    Backups

    VariableWhat it does
    MANGODOCK_BACKUP_IMAGEUse your own mirror of the backup helper image rather than the one on ghcr.io.
    MANGODOCK_BACKUP_TIMEOUT_HOURSHow long a single backup run may take before it is abandoned.

    Dial-in listener

    VariableWhat it does
    MANGODOCK_EDGE_ADDRThe address the dial-in listener binds.
    MANGODOCK_EDGE_PORTThe port the dial-in listener binds.
    MANGODOCK_EDGE_FINGERPRINTThe identity dial-in agents pin to. Preserved across a restore, so agents reconnect unchanged.

    Escape hatches

    VariableWhat it does
    MANGODOCK_ALLOW_PUBLIC_PLAINTEXTPermit an unencrypted tcp:// endpoint on a public address. A server setting rather than a checkbox, deliberately.
    MANGODOCK_DAEMON_SHARES_FILESYSTEMTell MangoDock the Docker host genuinely sees its data directory at the same path — for instance because you bind-mounted it identically — so relative stack paths are allowed.

    Air-gapped

    • None of these reach a network by themselves. MANGODOCK_BACKUP_IMAGE is the one that matters offline: point it at your internal mirror.
    ← SSO, LDAP and two-factorTroubleshooting →