# Bypass Rules

Rules allow you to either "allow" and bypass the Pangolin auth system (no pin, login, password), or "deny" and fully reject the request. After you create a resource you can select the "Rules" tab on the sidebar and enable rules.

## Rules for Specific Mobile Apps

This table compiles paths that need to be allowed for various apps to work with Pangolin authentication.

| App                              | Required Bypass Rules                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Media Management**             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Radarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Sonarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Lidarr                           | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Jellyfin (iOS)                   | `/system/info/public`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Jellyfin (Roku)                  | `/System/Info/Public`<br />`/Users/AuthenticateByName`<br />`/Users/Public`<br />`/QuickConnect/Initiate`<br />`/QuickConnect/Connect`<br />`/Users/AuthenticateWithQuickConnect`                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| **Management & Monitoring**      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Tautulli                         | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Harbour                          | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Hoarder App                      | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Uptime Kuma Manager              | `/api/*`<br />`/socket.io/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| MeshCentral                      | `/api/*`<br />`/meshrelay.ashx`<br />`/agent.ashx`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| **Security & Privacy**           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| AdGuard Home                     | `/api/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Vaultwarden/Bitwarden            | `/api/*`<br />`/identity/*`<br />`/wl/*`<br />Always Deny - Path - `/admin/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Cloud & Sync**                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Nextcloud                        | `/` (Main interface)<br />`/index.php` (Core handler)<br />`/remote.php` (Remote access)<br />`/status.php` (Status checks)<br />`/ocs` (Collaboration Services API)<br />`/apps` (Applications)<br />`/remote.php/webdav` (WebDAV endpoint)<br />`/remote.php/dav` (CalDAV/CardDAV)<br />`/remote.php/caldav` (Calendar sync)<br />`/remote.php/carddav` (Contacts sync)<br />`/ocs/v1.php` (API endpoints)<br />`/ocs/v2.php` (API v2 endpoints)<br />`/login` (Authentication)<br />`/.well-known/*` (Service discovery)<br />`/.well-known/webfinger` (WebFinger protocol)<br />`/s/*` (Shared files/folders) |
| **Photo Management**             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Immich                           | `/api/*`<br />`/.well-known/immich`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **File Management**              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Filebrowser                      | `/static/*`<br />`/share/*` <br/> `/api/public/dl/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| **Notes & Knowledge Management** |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Joplin Notes Server              | `/api/*`<br />`/shares/*`<br />`/css/*`<br />`/images/*`<br />Always Deny - Path - `/login/*` (optional)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Erugo                            | `/api/*`<br />`/shares/*`<br />`/build/*`<br />`/get-logo`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| **Communication**                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Matrix/Synapse (Clients)         | `/_matrix/*`<br />`/_synapse/client/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Matrix/Synapse (Federation)      | `/_matrix/*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| **Notifications**                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Gotify                           | `/version`<br />`/message`<br />`/application`<br />`/client`<br />`/stream`<br />`/plugin`<br />`/health`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

## Types of Rules

Rule are processed from top to bottom in order of their priority. This means you can have multiple rules to bypass auth and to just flat deny users at the end.

Right now you can match on the following items:

### Path

Path match rules allow URL patterns defined with plain text and wildcards (`*`) that match any characters. Patterns and URLs are split into segments (using `/`), and **each segment is matched individually**.

#### Examples:
- `blog/posts`  
  Matches the exact path `/blog/posts`.

- `blog/*`  
  Matches any path under `/blog` (e.g., `/blog/travel`).

- `*/2023/*`  
  Matches paths with `/2023/` as a middle segment (e.g., `/news/2023/summary`).

- `article*`  
  Matches **segments** starting with "article" (e.g., `/article-123`).

- `*admin*`  
  Matches **segments** containing "admin" (e.g., `/my-admin-panel`).

- `personal-*/*`  
  Matches paths where the first segment starts with `blog-` and is followed by any segment (e.g., `/personal-blog/post`).

#### Segment-by-Segment Matching
- **Normalization:**  
  Both patterns and URLs are split into segments. For example, `/blog/journal/entry` becomes `["blog", "journal", "entry"]`, while `/blog*` becomes `["blog*"]`.

- **Validation:**  
  Each pattern segment must correspond to a URL segment, and wildcards match zero or more characters within that segment. A pattern like `/blog*` only matches the first segment, so URLs with extra segments require additional placeholders (e.g., `/blog*/*`).




### CIDR

CIDR (Classless Inter-Domain Routing) notation specifies IP address ranges using an IP address and a network prefix length. The format is [IP address]/[prefix length].
Examples:

- `144.234.11.22/24` - Matches all 256 IPs from 192.168.1.0 to 192.168.1.255
- `10.0.0.0/8` - Matches any IP starting with 10 (16.7 million addresses)
- `2001:db8::/32` - Matches a range of IPv6 addresses
- `0.0.0.0/0` - Matches all IPv4 addresses

The prefix length (1-32 for IPv4, 1-128 for IPv6) determines how many bits from the left are fixed. Smaller prefix numbers match larger ranges. Valid CIDR notation requires a properly formatted IP address followed by a slash and a valid prefix length.

### IP

Pretty simple: you can match on simply a IP address like your home IP to bypass auth. This is the same as entering a /32 CIDR.
Examples:

- `23.234.134.32`
- `34.45.245.64`
- `192.168.1.1`
