It hosts kvm virtual machines as well as Docker containers
The machine has 2 Harddrives:
KVM is hosting several virtual machines and servers because until now, each service had a leghtweight ubuntu core machine. this should be moved to docker
VM disks are hosted in /mnt/fastdata/disks
docker containes should be hosted in groups
Portainer is running for an overview on https://kryptovisor:9443/
networks:
appnet:
name: ${APP_NET}
internal: true
proxy:
external: true
outbound:
driver: bridge
The template is hosted within /mnt/fastdata/docker/_template
The File structure is as follows:
/mnt/fastdata/docker/_template$ tree -a
├── backups
│ ├── backup.sh
│ └── restore.sh
├── compose.sh
├── config
│ ├── backend
│ │ ├── Cargo.toml
│ │ ├── Dockerfile
│ │ ├── readme.md
│ │ └── src
│ │ └── main.rs
│ ├── docker
│ ├── docker-compose.backend.yml
│ ├── docker-compose.yml
│ └── .env
└── data
├── backend
├── frontend
│ └── index.html
├── postgres
└── wiki
├── data
└── db
cd /mnt/fastdata/docker/_template
./deploy.sh
-> choose a name
-> choose a domain (wildcards *.app.lan) are routed automatically through dns but still require traefik config setup
cd /mnt/fastdata/docker/apps/newapp
rm -rf ./config/backend \
./data/backend \
./data/postgres \
./config/docker/docker-compose.backend.yml \
./config/nginx/templates/backend
rm -rf ./data/frontend \
./config/nginx/templates/frontend
nano ./config/docker/.env
./config/docker/docker-compose.service.ymlconfig/docker/docker-compose.pihole.yml
services:
pihole:
image: pihole/pihole:latest
container_name: pihole
hostname: pihole
restart: unless-stopped
environment:
TZ: Europe/Berlin
FTLCONF_webserver_api_password: "j*?S#6Zw5UP0)_s%!:!Ko*Q#n!`-tF^k"
VIRTUAL_HOST: ${APP_DOMAIN}
volumes:
- ../../data/pihole/etc-pihole:/etc/pihole
- ../../data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
ports:
- "53:53/tcp"
- "53:53/udp"
networks:
- appnet
- traefik
labels:
traefik.enable: "true"
traefik.docker.network: "traefik"
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wiki.rule: "Host(`${COMPOSE_PROJECT_NAME}-wiki.app.lan`)"
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wiki.entrypoints: "websecure"
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wiki.tls.certresolver: "letsencrypt"
traefik.http.services.${COMPOSE_PROJECT_NAME}-wiki.loadbalancer.server.port: "3000"
https://traefik-wiki.app.lan/e/en/home
An internal app uses the domain *.app.lan
A wildcard certificate has been placed in ./data/traefic/certs
Limitation: Wildcards only cover one level (
*.app.lan).
Names likewiki.dns.app.lanare not valid. (certificate warning)
Convention:
{service}-{subdomain}.app.lan
Example:dns-wiki.app.lan.
A dns wildcard routing for
**.app.lanis configured on pihole
Base Config (to be applied to the target container, NOT traefik itself):
networks:
traefik:
external: true
services:
wikijs:
networks: [traefik]
labels:
traefik.enable: "true"
traefik.docker.network: "traefik"
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wikijs.rule: Host(`${COMPOSE_PROJECT_NAME}-wiki.app.lan`)
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wikijs.entrypoints: websecure
traefik.http.routers.${COMPOSE_PROJECT_NAME}-wikijs.tls: true
traefik.http.services.${COMPOSE_PROJECT_NAME}-wikijs.loadbalancer.server.port: 3000
For apps that should be exposed to the internet:
public subdomains such as
wiki.myapp.bechtold-consulting.chdo work for public apps
DNS wildcard forwarding has been configured on selfhost provider and router
Config Example (with Let’s Encrypt):
networks:
traefik:
external: true
services:
myapp:
networks: [traefik]
labels:
traefik.enable: "true"
traefik.docker.network: "traefik"
traefik.http.routers.${COMPOSE_PROJECT_NAME}-myapp.rule: Host(`app.bechtold-consulting.ch`)
traefik.http.routers.${COMPOSE_PROJECT_NAME}-myapp.entrypoints: websecure
traefik.http.routers.${COMPOSE_PROJECT_NAME}-myapp.tls.certresolver: letsencrypt
traefik.http.services.${COMPOSE_PROJECT_NAME}-myapp.loadbalancer.server.port: 8080
/mnt/fastdata/docker
/mnt/fastdata/docker/
│── apps/
│ │── myapp1/
│ │ └── config/
│ │ └── data/
│ │ └── backups/
│ └── myapp2/
│ └── config/
│ └── data/
│ └── backups/
└── _template
| └── config/
│ └── data/
│ └── backups/
Backups are located in each app folder a backup script resides in /mnt/fastdata/docker/backup.sh
the script creates backups and makes sure they rotate as:
(33 total)