What's the best way to connect this Docker setup?
reddit / selfhosted

----------------------------------------------------------------------
MontanaCanMan · 2023-11-23 14:54

​

[Wireguard is running outside of docker, please excuse the jank](https
://preview.redd.it/c2dfx500z32c1.png?width=863&format=png&auto=webp&s=
23a99381cf36641740a0f354e0c20b15d49ad373)

Hi, i'm currently trying to figure what'd be the best way to connect
my two docker nodes.
Previously i just used my homelab node, had nginx proxy manager
running on there and updated the cloudflare dns entry via ddclient.

Now i'm in a different location with a single shared IPv4 for multiple
homes and i can't properly map ports for IPv4 with my router anymore.
So i figured i'd just rent a hetzner vserver for the static IP and use
it as a management node for the docker instance at home.
Currently i have wireguard running between both hosts and could have
the reverse proxy on the hetzner node route through the tunnel to the
docker network on the homelab node (see the diagram).
As far as i can tell this would require static IPs for each container
running on the homelab node, while i could just use the container
hostnames on the hetzner node.

Now i'm wondering if there is a better way to accomplish this setup
where containers from both nodes can talk to each other as if they
were running on the same machine.

Also is it worth it to switch to traefik from nginx proxy manager?


Any input is much appreciated, thanks in advance!

----------------------------------------------------------------------
tschloss · 2023-11-23 16:02

How are the containers connected into the host? The usual setup is
that the containers run hidden in bridge type networks (NAT) and are
only reachable through mapped (forwarded) ports. So all TCP/UDP
services are addressable by the portnumber on that host.
You don‘t need to know L2-4 addresses of contaIners.
If you run some reverse proxy you have another level of comfort by
mapping names to ports.

So where is your issue?

----------------------------------------------------------------------
MontanaCanMan · 2023-11-23 17:46

Thanks for your reply!
Just like you said, currently by a bridge network where all webservers
reside and extra networks for their db's and other containers that
don't need to access to the internet/communicate to the outside.

My previous setup had only the reverse proxy bind its port to host and
was inside the same network of the webservers, so i could point the
reverse proxy entry for [example.com](https://example.com) to
container foo:443, [another.example.com](https://another.example.com)
to bar:443 and so on.

Now  the reverse proxy is on Host A facing the internet and would need
to communicate with Host B over the wireguard tunnel.
My understanding is that now i'd need to bind foo:443 and bar:443
directly to Host B.
That would mean one of them hast to be mapped to hostB:443 and the
other to hostB:8080 for example.
What i'm looking for is a way to not have to bind directly to Host B
but rather share the network of the webservers on Host B with the
reverse proxy on Host A.