Traefik: do not use dynamic config using docker provider; user hostmode networking
This commit is contained in:
@@ -1,8 +1,8 @@
|
||||
# onyx - Container Server of nbit Informatik GmbH
|
||||
|
||||
In this directory (/home/containers/onyx_pods), you will find all configuration files to run the containers (with Podman and Kubernetes YAML files)
|
||||
onyx.nbit.ch is used to run rootless Podman containers, using Traefik as a Reverse Proxy
|
||||
|
||||
Persistent data is stored in /data
|
||||
In this directory (/home/containers/onyx_pods), you will find all configuration files to run the containers (with Podman and Kubernetes YAML files)
|
||||
|
||||
Specs:
|
||||
- Rocky Linux 9
|
||||
@@ -11,6 +11,8 @@ Specs:
|
||||
- 8 GB RAM
|
||||
- 80 GB Disk
|
||||
|
||||
Persistent data is stored in /data
|
||||
|
||||
## Create Server
|
||||
|
||||
Name: onyx.nbit.ch
|
||||
@@ -35,7 +37,11 @@ enable EPEL Repo:
|
||||
```bash
|
||||
# dnf install firewalld
|
||||
# firewall-cmd --add-service={http,https} --permanent
|
||||
# TODO
|
||||
# firewall-cmd --remove-service=cockpit --permanent
|
||||
# firewall-cmd --reload
|
||||
|
||||
List Rules:
|
||||
# firewall-cmd --list-all
|
||||
```
|
||||
|
||||
## fail2ban on Host for ssh
|
||||
@@ -53,7 +59,6 @@ command to check who is banned:
|
||||
# fail2ban-client status sshd
|
||||
```
|
||||
|
||||
|
||||
## Install Software
|
||||
|
||||
```bash
|
||||
@@ -126,7 +131,7 @@ Restic Script:
|
||||
#
|
||||
PATH=$PATH:/usr/local/bin
|
||||
export RESTIC_PASSWORD="$(hostname --short)7355"
|
||||
restic backup --quiet --repo /backup-restic/restic-repo-$(hostname --short) /home /etc /var /opt /var/lib/docker/volumes /usr/local/bin /backup --exclude=/var/log --exclude=/var/lib/docker/overlay2
|
||||
restic backup --quiet --repo /backup-restic/restic-repo-$(hostname --short) /home /etc /var /opt /data /usr/local/bin /backup --exclude=/var/log
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
restic forget --quiet --repo /backup-restic/restic-repo-$(hostname --short) --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 20 --prune
|
||||
@@ -199,9 +204,50 @@ for dnsserver in ns1.nbit.ch ns2.nbit.ch ; do
|
||||
done
|
||||
```
|
||||
|
||||
### Setup Env for Podman
|
||||
|
||||
we use /data/<podname> for persitent data:
|
||||
```bash
|
||||
# mkdir /data
|
||||
# chown containers:containers /data
|
||||
|
||||
Set Defaults:
|
||||
|
||||
containers$ cat ~/.config/containers/containers.conf
|
||||
[network]
|
||||
network_backend = "netavark"
|
||||
```
|
||||
|
||||
### Setup Traefik
|
||||
|
||||
see https://gerov.eu/posts/traefik-for-podman/
|
||||
Traefik will be started with podman play kube (with yaml file) and attach to HostNetwork (hostNetwork: true in yaml).
|
||||
Backends will map there port and will be accessed on localhost:<port>
|
||||
|
||||
we do not use the dynamic config using docker provider, but rather the file provider (one file per backend)
|
||||
```bash
|
||||
Example Backend Service File:
|
||||
|
||||
[containers@onyx onyx_pods]$ cat traefik/configuration/nbitwebsite.yml
|
||||
http:
|
||||
routers:
|
||||
nbitwebsite:
|
||||
entrypoints:
|
||||
- websecure
|
||||
tls:
|
||||
certresolver: "myresolver"
|
||||
domains:
|
||||
- main: "www.linux-freelancer.ch"
|
||||
sans: "linux-freelancer.ch"
|
||||
rule: "Host(`linux-freelancer.ch`,`www.linux-freelancer.ch`)"
|
||||
service: nbitwebsite
|
||||
|
||||
services:
|
||||
nbitwebsite:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://127.0.0.1:9000/
|
||||
passHostHeader: false
|
||||
```
|
||||
|
||||
```bash
|
||||
# echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.d/containers.conf
|
||||
@@ -209,60 +255,29 @@ see https://gerov.eu/posts/traefik-for-podman/
|
||||
# The following fixes "Failed to connect to bus: No medium found"
|
||||
export XDG_RUNTIME_DIR=/run/user/$(id -u)
|
||||
containers$ systemctl --user enable --now podman.socket
|
||||
containers$ podman network create web
|
||||
containers$ touch acme.json
|
||||
containers$ chmod 0600 acme.json
|
||||
|
||||
containers$ podman run --name=traefik -d \
|
||||
--security-opt label=type:container_runtime_t \
|
||||
-v /run/user/1000/podman/podman.sock:/var/run/docker.sock:z \
|
||||
-v ./acme.json:/acme.json:z \
|
||||
-v ./configuration/:/configuration/:z \
|
||||
--net web \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
--restart always \
|
||||
docker.io/library/traefik:latest \
|
||||
--entrypoints.web.address=":80" \
|
||||
--entrypoints.web.http.redirections.entryPoint.to=websecure \
|
||||
--entrypoints.web.http.redirections.entryPoint.scheme=https \
|
||||
--entrypoints.websecure.address=":443" \
|
||||
--providers.docker=true \
|
||||
--certificatesresolvers.myresolver.acme.email=postmaster@nbit.ch \
|
||||
--certificatesresolvers.myresolver.acme.storage=/acme.json \
|
||||
--certificatesresolvers.myresolver.acme.tlschallenge=true \
|
||||
--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory \
|
||||
--certificatesresolvers.myresolver.acme.httpChallenge.entrypoint=web \
|
||||
--providers.file.directory=/configuration/ \
|
||||
--providers.file.watch=true \
|
||||
--accesslog=true \
|
||||
--log.level=DEBUG
|
||||
|
||||
containers$ touch /data/traefik/acme.json
|
||||
containers$ chmod 0600 /data/traefik/acme.json
|
||||
|
||||
containers$ mkdir -p ~/.config/systemd/user/
|
||||
containers$ cd ~/.config/systemd/user/
|
||||
containers$ podman generate systemd -f -n traefik
|
||||
containers$ systemctl --user enable container-traefik.service
|
||||
|
||||
containers$ podman stop traefik
|
||||
containers$ systemctl --user start container-traefik.service
|
||||
|
||||
# mkdir /data
|
||||
# chown containers:containers /data
|
||||
|
||||
containers$ escaped=$(systemd-escape ~/onyx_pods/traefik/traefik.yaml)
|
||||
containers$ systemctl --user start podman-kube@$escaped.service
|
||||
containers$ systemctl --user enable podman-kube@$escaped.service
|
||||
```
|
||||
|
||||
### Setup Backend Services
|
||||
|
||||
Hack until Podman supports network in Play YAML:
|
||||
```bash
|
||||
Create Kubernetes YAML File:
|
||||
|
||||
[containers@onyx default.target.wants]$ pwd
|
||||
/home/containers/.config/systemd/user/default.target.wants
|
||||
[containers@onyx default.target.wants]$ ls -l
|
||||
total 0
|
||||
lrwxrwxrwx. 1 containers containers 42 Dec 5 19:16 podman-kube@-home-containers-onyx_pods-nbit_websites-nbit_websites.yaml.service -> /usr/lib/systemd/user/podman-kube@.service
|
||||
lrwxrwxrwx. 1 containers containers 42 Dec 3 16:06 podman-kube@-home-containers-onyx_pods-traefik-traefik.yaml.service -> /usr/lib/systemd/user/podman-kube@.service
|
||||
backendservice=nbitwebsite
|
||||
containers$ mkdir ~/onyx_pods/${backendservice}
|
||||
|
||||
Create File ~/onyx_pods/${backendservice}/${backendservice}.yaml
|
||||
|
||||
containers$ escaped=$(systemd-escape ~/onyx_pods/${backendservice}/${backendservice}.yaml)
|
||||
containers$ systemctl --user start podman-kube@$escaped.service
|
||||
containers$ systemctl --user enable podman-kube@$escaped.service
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user