NPM Load Balancing. Good idea or not? reddit / selfhosted ---------------------------------------------------------------------- cberm725 · 2023-09-28 17:18 For context, i run all my selfhosted services (barring proxmox, FreeNAS and Plex) off a raspberry pi 4 8GB. All docker containers. I recently acquired another rpi4 8GB for a good deal and am looking at two options: Redundancy of all my containers via Docker Swarm Replication backups via Duplicati. I'm leaning towards Docker Swarm. I know base nginx can do load balancing but I'm not wanting to set that up on another server/vm for that reason alone. I found [this article](https://silicon.blog/2023/05/17/how-to-load-balance-your- servers-using-nginx-proxy-manager-and-cloudflare/) on how to setup a Nginx Proxy Manager docker container with load balancing and I think that would work but I'm wanting to know if anyone else has done this or attempted it and if it's a good idea or not. TIA ---------------------------------------------------------------------- ElevenNotes · 2023-09-28 19:50 You don't need swarm to replicate. Install keepalive on both PIs. Create some virtual IPs and assign these via your prefered method to your containers. Basically allmost all web apps support scale out HA with multiple containers and most DBs support clusters. ---------------------------------------------------------------------- cberm725 · 2023-09-28 19:54 Ok but how would this work when making these public facing? ---------------------------------------------------------------------- ElevenNotes · 2023-09-28 21:11 Traefik. Ingress from WAN to the VIP of traefik and from there you can go anywhere. If RPi A goes down, the VIP will switch instantly to RPi B. ---------------------------------------------------------------------- lintorific · 2023-09-28 22:29 I mean, if OP going Swarm (which I strongly suggest they do, it’s awesome), then just ditch NPM, and use Treafik’s native swarm abilities to make it easy. Still need the VIPs with keepalived though. If they want to actually see the public IPs hitting your services, they can even put HAProxy on each node, accessed via the VIP, forwarding all traffic to Traefik with ProxyProtocol. ---------------------------------------------------------------------- cberm725 · 2023-09-29 03:00 That almost seems like a hot standby to me which isn't what I'm going for. Im more looking for load balancing, not a hot standby. ---------------------------------------------------------------------- lintorific · 2023-09-29 03:09 No, both nodes in the swarm, and the replicated services on them can all participate in handling traffic. The keepalived is just so that the IP of the swarm is highly available, and will float to either node. FW -> VIP (via keepalived on both swarm nodes) -> HAProxy TCP listener on whichever node is active for VIP -> Treafik (generally one instance, unless you want to get crazy with HA Treafik) -> services. It’s the way I have my swarm running and it’s awesome. I don’t have any “load-balanced” services, but doing so would be trivial. I mostly use Treafik to do sub-path routing to services, and to handle TLS. ---------------------------------------------------------------------- cberm725 · 2023-09-29 03:11 The hangup for me is that npm handles all my subdomain proxying and SSL. Does Traefik also handle all that? ---------------------------------------------------------------------- lintorific · 2023-09-29 03:15 Sure does. Probably with less work than NPM, as it’s all handled as service/container labels. Though I’ll admit I’ve never used NPM. I have yet to find a good way to clearly, and concisely document what I have setup, but it works well, and is surprisingly stable if not a little (ok, fine, a LOT) more complex than it probably needs to be. But it works, is fault tolerant, stable, flexible, and does everything I want it to do. ---------------------------------------------------------------------- cberm725 · 2023-09-29 03:16 I'll have to play with it then. ---------------------------------------------------------------------- NanobugGG · 2023-09-29 08:20 I don't think you'll need it for your own personal setup. But it's a fun thing to get into! So I'd say go for it! :D ---------------------------------------------------------------------- cberm725 · 2023-09-29 13:20 Yeah it not a definate need, but im paranoid about one of them just crapping out and I already have the pi...so why not? ---------------------------------------------------------------------- cberm725 · 2023-09-29 13:24 I will say that npm is very easy and simple to set up and get going. It's a simple web interface. For proxy hosts you just tell it the domain, IP, port, and then have it generate a Let's Encrypt SSL cert. You may need to give it a DNS provider API key (I had to for all of mine) and then you're golden as long as your DNS is set correctly. And it auto-renews the certs so it's pretty much set it and forget it. How similar os that to Traefik? ---------------------------------------------------------------------- lintorific · 2023-09-29 15:24 You don’t actually have to do anything via a web app. In Docker (individual containers, or Swarm services), you provide labels via a well documented format, Treafik picks those up, and configures itself automatically. You as you add/remove services in Swarm, their forwarding rules auto- update. If you have 1 replica, it will send all traffic there. If you scale it up, it will automatically split traffic across all instances of that service. Same goes for TLS certs. You define how it should validate them (DNS, or HTTP challenge), and it handles it all. ---------------------------------------------------------------------- cberm725 · 2023-09-29 15:25 Ill have to play with it and look up some guides ---------------------------------------------------------------------- cberm725 · 2023-09-30 16:28 Wait. Would i need keepalived on just the host server or install that on all containers? ---------------------------------------------------------------------- lintorific · 2023-09-30 16:38 Just on both hosts. It’s so that your router, or clients always have a single IP to hit when trying to access the services. ---------------------------------------------------------------------- cberm725 · 2023-09-30 16:42 Would that be necessary if they're statically assigned IPs? My network is pretty complex. They're both in my DMZ which is statically assined IPs. ---------------------------------------------------------------------- lintorific · 2023-09-30 16:50 The nodes are statically assigned IPs, but how are you going to handle re-routing traffic between them when one’s goes down? How do clients know to hit node A when Node B is down? DNS round-robin works great, but only if things are very reliably going to be up. Unless you set an obnoxiously short TTL on those records (30 seconds say). Having a VIP be the main way to get your services ensures that the clients don’t have to know or care that a failover has occurred. ---------------------------------------------------------------------- cberm725 · 2023-09-30 16:52 Im more asking if keepalived is necessary in a statically assigned IP schema. It doesn't seem like it would be. From my understanding. Traefik would be the IP that clients hit and then it distributes traffic to the nodes. Right? ---------------------------------------------------------------------- lintorific · 2023-09-30 17:27 Correct, but how do clients get to Treafik when it’s possible for it to run on either node? You could point then all at all the IPs in the swarm, or even just one IP, but at any given time, there’s to guarantee that that IP will be up. Hence the use of a VIP that is (almost always) going to be up. ---------------------------------------------------------------------- cberm725 · 2023-09-30 17:31 Right. Traefik will always have the VIP up, and all clients will route to the VIP and then incoming traffic gets routed from there. I was really only asking about the need for keepalived, which seems like a non issue with my current setup. ---------------------------------------------------------------------- lintorific · 2023-09-30 17:35 I have three PVE nodes, and 3 Swarm nodes, one per PVE node, though not “tightly” coupled 1:1. I can shutdown anything, anytime and things will automatically failover, and work seamlessly because clients always hit the VIP, whether internal or external. keepalived is part of what makes that possible, otherwise I’d have to do some DNS trickery, or wait for all nodes to be online for everything to work. YMMV though, as each setup is slightly different. ---------------------------------------------------------------------- cberm725 · 2023-09-30 17:40 But if everything is online, keepalived wouldn't really matter would it?