157 lines
4.2 KiB
Markdown
157 lines
4.2 KiB
Markdown
# Containerized Home Server
|
|
|
|
This repo is used to deploy the containers for the home server infrastructure. If you want to move infrastructure to another host you have to install docker and docker-compose at first.
|
|
|
|
## Requirements
|
|
|
|
### Docker
|
|
|
|
[Offical docker installation guide for ubuntu](https://docs.docker.com/engine/install/ubuntu/)
|
|
|
|
To be able to use this repo, you must have running system with a running docker instance.
|
|
Installing docker on ubuntu:
|
|
|
|
````
|
|
sudo apt update && sudo apt upgrade
|
|
sudo apt install ca-certificates curl gnupg lsb-release
|
|
````
|
|
|
|
Next docker's GPG key must be added to repo list:
|
|
|
|
``curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg``
|
|
|
|
To setup the stable repostiory:
|
|
|
|
````
|
|
echo \
|
|
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
|
|
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
````
|
|
|
|
Now docker engine can be installed:
|
|
|
|
````
|
|
sudo apt- update
|
|
sudo apt install docker-ce docker-ce-cli containerd.io
|
|
````
|
|
|
|
### Networking with macvlan
|
|
|
|
To expose containers to the local network a macvlan can be used. Containers that are
|
|
attached to this network can not be reached from the host system. To be able to reach
|
|
these containers from the host, a second bridge has to be created and traffic must be routed to this network.
|
|
|
|
* Network-Adapter of host: ``enp3s0``
|
|
* Name of the network bridge: ``docker-bridge``
|
|
* Free IP address of subnet out of dhcp range: ``192.168.178.19``
|
|
|
|
````
|
|
ip link add docker-bridge link enp3s0 type macvlan mode bridge
|
|
ip addr add 192.168.178.19/32 dev docker-bridge
|
|
ip link set docker-bridge up
|
|
ip route add 192.168.178.0/24 dev docker-bridge
|
|
````
|
|
|
|
### IPv6 networking
|
|
|
|
IPv6 is not enabled by default in docker networking. If you don't want to disable the complete IPv6 networking stack
|
|
in your routers configuration and use pihole or unbound, IPv6 has to be enabled.
|
|
Configuration is a bit tricky, and there might be better possibilities to get the stack running.
|
|
|
|
#### Determine data that has to be used:
|
|
|
|
* Private IPv6 prefix of home network \
|
|
``Fritz!Box -> Heimnetz -> Netzwerk -> Netzwerkeinstellungen -> IPv6-Einstellungen -> IPv6 Präfix des Heimnetz``
|
|
* Unique local address of router \
|
|
``Fritz!Box -> Heimnetz -> Netzwerk -> Netzwerkeinstellungen -> IPv6-Einstellungen -> Unique Local Address der Fritz!Box``
|
|
* Unique local address prefix (ULA) \
|
|
``Usually the first 64 bits of routers address``
|
|
|
|
#### Docker settings
|
|
|
|
Edit or create ``/etc/docker/daemon.json`` and use the private IPv6 prefix of home network
|
|
|
|
````
|
|
{
|
|
"ipv6": true,
|
|
"fixed-cidr-v6": "2a02:8070:c3b6:2b00::/64"
|
|
}
|
|
````
|
|
|
|
Then do a docker restart ``sudo systemctl restart docker``. Reloading was not successful in my setup.
|
|
|
|
#### Docker networking
|
|
|
|
For the macvlan use the router as gateway and the correct subnet. Select an IP range that has a longer Prefix for the network.
|
|
If the prefix is as long as the ULA prefix, there is no chance to build up a second macvlan network.
|
|
|
|
````
|
|
networks:
|
|
home:
|
|
external: false
|
|
driver: macvlan
|
|
enable_ipv6: true
|
|
driver_opts:
|
|
parent: enp2s0
|
|
ipam:
|
|
config:
|
|
- subnet: 192.168.178.0/24
|
|
gateway: 192.168.178.1
|
|
ip_range: 192.168.178.2/30 # .2 and .3
|
|
- subnet: fd00::/64
|
|
gateway: fd00::de15:c8ff:feec:9960
|
|
ip_range: fd00::1/80
|
|
name: home
|
|
````
|
|
|
|
### SQLite3
|
|
|
|
Vaultwarden stores data in a sqlite database. To view data sqlite3 should be installed.
|
|
|
|
````
|
|
sudo apt install sqlite3
|
|
````
|
|
|
|
## Components and structure
|
|
|
|
The root's docker-compose is used to install common components like databases and traefik.
|
|
Subdirectories are used to structure and keep components independent. You have to run the common part, after that you can run single components.
|
|
|
|
### Common
|
|
|
|
- traefik 2
|
|
- portainer
|
|
- mysql 8
|
|
- postgresql 14
|
|
- redis
|
|
|
|
### Development
|
|
|
|
- gitea: Version control
|
|
- kimai: Time tracking
|
|
- nginx: Reverse proxy for kimai
|
|
|
|
### Networking
|
|
|
|
- pihole
|
|
- unbound
|
|
- wireguard
|
|
- smokeping: Not used at the moment
|
|
- netdata: Not used at the moment
|
|
|
|
### Nextcloud
|
|
|
|
- nextcloud-fpm
|
|
- nginx
|
|
|
|
### Vault
|
|
|
|
- vaultwarden
|
|
|
|
### VPN
|
|
|
|
- wireguard: Not working at the moment
|
|
|
|
### Wiki
|
|
|
|
- bookstack |