How to + all my compose files reddit / selfhosted ---------------------------------------------------------------------- delitti 路 2023-11-14 19:18 Hello everyone I used the ugly autumn weather to write a documentation of my homelab. Its meant to spread knowledge and maybe someone can learn from it and maybe dont make my mistakes 馃榿 Its about my hardware, a thin client for proxmox and docker and a qnap nas with unraid as mass storage. And many many docker compose files most of them with health checks. In my setup two piholes provide ad blocking and local domains via nginx proxy manager. https://github.com/The-Engineer/homelab-documentation If you have questions or feedback feel free to leave them here or github 馃憤馃徑 ---------------------------------------------------------------------- thekrautboy 路 2023-11-14 19:40 Hey thanks for sharing, always great to see what other selfhosters are up to :) But if i may provide some feedback: One thing i noticed right away with your compose setup, and you also mention it on the frontpage of the Github repo, is that you place **ALL** your containers into one single network (the default bridge network). I understand that this is convinient, but i would really not recommend this. There is no real reason why the runner container of Gitea should be in the same network as Glances, or Grafana together with nvidia- gpu-test and so forth. If any of those containers would get compromised it would probably be quite easy for an attacker to spread to other containers. Seperate your Docker networks like you seperate your stacks. For example, "Gitea + Gitea runner" = "Gitea" network. And for the reverse proxy, you can place "Gitea" into two networks, the "proxy" network and the "Gitea" network. But there is no need for the runner to be in the proxy network too. Another example would be Plex and Tautulli. Tautulli doesnt need to have network access to SyncThing or iobroker. It only needs Plex and Plex probably only needs Tautulli (or maybe things like the *arrs and PMM etc.) Especially your reverse proxy should be limited to have only access to those containers where it proxies too, and nothing more. If your proxy is public facing (open to the internet) then this is the highest priority to keep it isolated as much as possible. Imagine your proxy has a security flaw and gets exploited, a attacker will be very happy to see that he can directly get from the proxy to your database container. ---------------------------------------------------------------------- delitti 路 2023-11-14 19:58 Hi /u/thekrautboy thats some good points. I used to have every compose file in their own network. But i think they were all seeing eachother anyways thats why i put them all into one network. To keep things safe i have everything internal and just the wireguard vpns open to the internet. But separating things is always a good idea, i will look into that. And yes things like the gitlab runner dont need to be in the same net like the rev proxy. But it needed to be in the same like gitlab. And i didnt want to place gitlab in two networks :( And good point about autoheal, will definitely check that. So far i just get Infos from watchtower when it updates it EVERY night 馃榿馃榿 ---------------------------------------------------------------------- thekrautboy 路 2023-11-14 20:17 > But i think they were all seeing eachother anyways thats why i put them all into one network. Probably because you used "network_mode: bridge" on all of them, then obviously they can "see" each other because they all join the default network. > And i didnt want to place gitlab in two networks :( Why not? Whats the problem with that? Thats basically how its supposed to be. Place Gitlab into two networks, proxy and Gitlab. Place the runner only in Gitlab network. Done. Its only one line of extra text in the compose. > And good point about autoheal, will definitely check that. So far i just get Infos from watchtower when it updates it EVERY night Yes see my edit above about Watchtower... i remember those constant updates myself for autoheal and other things, iirc some from Linuxserver.io that get auto-built overnight even when there isnt any version available. And since it always uses the *latest* tag, Watchtower (or any similar tool) would assume it has actually been updated and notify me. These tools can be set up to have finer control over what might be considered a new version, but of course that only works when the repo of the image actually uses proper versioning and not only dumps everything into *latest* and be done with it. If you are dead set on keep using Watchtower you can atleast set it to ignore updates of the autoheal image. It hasnt been updated by the original creator in a pretty long time, its unlikely you miss out on anything if you disable notifications for this one. I made my own fork of it and added Pushover, ntfy and Gotify support to it, so i get notifications when a unhealthy container has been restarted, works fine... so far. ---------------------------------------------------------------------- RushTfe 路 2023-11-15 08:30 I have npm as well, but I couldn't set pihole together with it. I mean, I can have 2 containers running if I change pihole ip for something different (let's say 8081),but then I'm not able to use it as a dns server in my router. How did you fix this? Or do you have pihole in a different computer? (ip) ---------------------------------------------------------------------- thekrautboy 路 2023-11-15 08:36 > I mean, I can have both containers running if I change pihole ip for something different (let's say 8081),but then I'm not able to use it as a dns server in my router. 8081 is not a ip, you probably mean the port. And changing Piholes webui port is very easy to find in the Pihole documentation. If youre running Pihole as Docker container you dont even need to do that, you simply map the webui port from 80 to something else on the host, like 8081. For DNS to properly work it needs to be on port 53 UDP/TCP. But the webui you can put on whatever port you want. Or if you use a reverse proxy server on the same Docker host, you dont need to map the Pihole webui port at all to the host, just remove it and have the proxy point at Piholes port 80 through internal Docker networking. Done. /r/Pihole /r/Docker /r/NginxProxyManager all exist. ---------------------------------------------------------------------- RushTfe 路 2023-11-15 08:43 I meant port yes, my bad, was writing while doing other stuff. Yes, I'm aware I can map port in my compose file to something different, that's what I did. But then, I have to add my dns server ip in my router, which is looking (iirc) for port 80 on said ip and doesn't allow me to change port for something different, so, mapping 80->8081 will not work, as I cannot specify port 8081 at my router. Don't worry I was just asking in case you had that problem before, I haven't tried to fix this in a month or two, I'll look for those subreddits next time. Thank you ---------------------------------------------------------------------- thekrautboy 路 2023-11-15 08:52 > But then, I have to add my dns server ip in my router, which is looking (iirc) for port 80 on said ip and doesn't allow me to change port for something different, so, mapping 80->8081 will not work, as I cannot specify port 8081 at my router. That is not correct. As i already wrote, DNS works over port 53 UDP/TCP. The Pihole webinterface on port 80 or 8081 has absolutely nothing to do with that and you do not need to point your router at it. ---------------------------------------------------------------------- RushTfe 路 2023-11-15 08:54 OK thanks, I'll check this next time I can use some time at my server