Support Mullvad.
You should have bought the framework after they put more effort into Coreboot.
Pine64 and Fairphone are good companies too
Support Mullvad.
You should have bought the framework after they put more effort into Coreboot.
Pine64 and Fairphone are good companies too
Just run KODI from anywhere
If you can only use port 22 for multiple SSH endpoints (for example), then yes your going to need multiple IPs. Or Port-mapping as a compromise
In short, you need a reverse-proxy + traffic segregation with domain names (SNI).
I don’t remember much about ingresses, but this can be super easy to set up with Gateway API (I’m looking at it right now).
Basically, you can set up sftp.my.domain/ssh
to 192.168.1.40:22
, sftp.my.domain/sftp
to 192.168.1.40:121
(for example). Same with Forgejo, forgejo.my.domain/ssh
will point to 192.168.1.50:22
and forgejo.my.domain/gui
will point to 192.168.1.50:443
.
The Gateway API will simply send it over to the right k8s service.
About your home network: I think you could in theory open up a DMZ and everything should work. I would personally use a cheap VPS as a VPN server and NAT all traffic through it. About traffic from your router maintaining the SNI, that’s a different problem depending on your network setup. Yes, you’ll have to deal with port-mapping because at the end of the day, even Gateway API is NodePort-esque when exposing traffic outside.
You’d receive traffic on IP:PORT, that’s segregation right there. Slap on a DNS name for convenience.
I might have my MetalLB config lying around somewhere (it’s super easy, I copied most of it from their website), I can probably paste it here if you’d like.
Exposing services publicly on the Internet is a L3-L4/L7 networking problem, unfortunately I don’t know enough about your situation to comment.
Edit: the latter end of your post is correct. You could route to different end-points that way
Ingress controllers like Traefik come across as LB services to IPAM modules like MetalLB (I’ve never used Kube-VIP but I suppose it’s the same story). These plug-ins assign IP addresses to these LB services.
You can assign a specific IP to an instance of an “outward-facing route” with labels. I don’t remember technical terms relevant to Ingresses because I’ve been messing with the Gateway API recently.
MetalLB + map new external IP to sub-domain == profit.
Read some of the other comments: it’s not about your control plane. All you need is multiple external IPs which an IPAM module/plug-in can provide (MetalLB, Cilium and maybe Kube-VIP: I’ve never used it).
SMR vs CMR and drive speeds
I need to try this, thanks
Setting SELinux to permissive is not a good security practice
Why not port knocking over TOR?
You can do that with Wireguard and NAT.
Traefik’s marketing as the “Docker reverse-proxy” put me off since I like technologies to stay agnostic of each other (personal preference).
Your arguments are correct, and usually I’d run a separate web server but I suppose for a homelab having less things to manage is great
Indeed, I don’t find NGINX that easy to configure either
I have heard a lot about Envoy proxy from Istio but never looked into it for baremetal usage. I’ll keep an eye out, thanks
It should technically do that already, but as extra insurance I’m running it with the -u bind
flag in ENTRYPOINT
. The problem was solved with a chmod 755
I think ZFS does some advanced stuff which makes it better than just relying on hardware checksums (which have been shown to not be so great)
How about bitrot?
I’m worried about reliability; what are the chances that they will lose my data? I have a local backup but I’m also feeling paranoid
Use something that can do TCP, i.e. HAProxy, NGINX or Apache