Skip to main content

LXC / Refuge

Description

This badly named LXC container (docker containers, inception for nested virtualization) is responsible for running theSamba majorityto ofprovice mynetwork servicesshare that run as docker containers.drives.

Configuration

Resources

Hostname CPU Memory
conception.hermz 62 vCPU 12GB256MB

Storage

Mount Point Source Destination
mp0 /storage/zpool10/downloadsbackups/timemachine/dpsweigart /storage/downloadstimemachine/dpsweigart
mp1 /storage/zpool10/downloads/incompletebackups/timemachine/jlaigle352 /storage/downloads/incompletetimemachine/jlaigle352
mp2
/storage/zpool10/services/mayanedms/watch /storage/mayan/watch mp3 /storage/zpool10/services/mayanedms/stage /storage/mayan/stage mp4 /storage/zpool10/services/mayanedms/scanned /storage/mayan/scanned mp5 /storage/zpool10/media /storage/media mp3mp6 /storage/zpool10/servicesdownloads /storage/services mp4 /storage/zpool10/services/plex /storage/services/plex mp5 /storage/zpool10/services/piwigo /storage/services/piwigodownloads

NOTE: mp4 and mp5 are exlpicitly listed because LXC doesn't support recursively mounting any nested mountpoints need to be specified.

Networking

Interfaces

ID Name Bridge IP Address Description
net0 eth0 vmbr1 10.0.4.2/3/21 Access to LAN and WAN
net1 eth1 vmbr2 192.168.0.2/24 Private network for VPN

Docker Networks

A brief overview of how I have my networking setup for Docker.

blackbox_containers

Gateway IP/Subnet IP Range 10.0.2.1 10.0.4.2/21 10.0.4.0/24

Traefik binds to the host ports on LXC / Conception for HTTP(S) traffic that has been forwarded from firewall.hermz and proxies it to the appropriate container using this bridge network.

    Containers that are part of this network can directly access other containers in this network using their hostnames and/or container names. Using hostnames to network containers provides an IP agnostic way to communicate while reducing overhead of SSL. Containers in this network are not publically accessible, access is controlled with Traefik acting as a gatekeeper.

    **NOTE** All publically accessible containers should be part of the blackbox_containers network.

    a_wireguarded

    Gateway IP/Subnet IP Range 192.168.0.1 192.168.0.2/24 192.168.0.2/24

    All containers which should be run through VM / Shield to anonymize their traffic need to be connected to this network. It is prefixed with a_ because networks are added to containers alphabetically and this must be added first to be assigned as the default gateway or else public bound traffic will not be routed over this network.

    **NOTE** All containers that want to mask the location of their traffic should be party of the a_wireguarded network.

    a_host_macvlan (10.0.2.64/27)

    Gateway IP/Subnet IP Range 10.0.2.1 10.0.4.64/27 10.0.4.64/27

    This is a macvlan network that very few containers should need since its purpose is to expose containers to the LAN.

    Installed Software

    NetdataSamba

    Services

    See Services