• 2 Posts
  • 12 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle
  • You can host docker volumes over NFS, but the actual container images need to exist on a filesystem that supports overlay (which NFS does not) unless you want things to be slow as shit. And I really do mean miserably slow. A container image shared over NFS will take forever to spin up because it has to duplicate the entire container filesystem instead of using overlays, and then it’ll blow up your disk usage by copying all these files around instead of overlaying them. It’s truly unusable.










  • As someone who has owned enterprise servers for self-hosting, I agree with the previous comment that you should avoid owning one if you can. They might be cheap, but your longterm ownership costs are going to be higher. That’s because as the server breaks down, you’ll be competing with other people for a dwindling supply of compatible parts. Unlike consumer PCs, server hardware is incredibly vendor locked. Hell, my last Proliant would keep the fans ramped at 100% because I installed a HDD that the BIOS didn’t like. This was after I spent weeks tracking down a disk that would at least be recognized, and the only drives I could find were already heavily used.

    My latest server is built with consumer parts fit into a 2U rack case, and I sleep so much easier knowing I can replace any of the parts myself with brand new alternatives.

    Plus as others have said, a 1U can be really loud. I don’t care about the sound of my gaming computer, but that poweredge was so obnoxious that despite being in the basement, I had to smother it with blankets just so the fans didn’t annoy me when I was watching TV upstairs. I still have a 1U Dell Poweredge, but I specifically sought out the generation that still let you hack the fan speeds in IPMI. From all my research, no such hack exists for the Proliant line.



  • As others have said, a reverse proxy is what you need.

    However I will also mention that another tool called macvlan exists, if you’re using containers like podman or docker. Setting up a macvlan network for your containers will trick your server into thinking that the ports exposed by your services belong to a different machine, thus letting them use the same ports at the same time. As far as your LAN is concerned, a container on a macvlan network has its own IP, independent of the host’s IP.

    Macvlan is worth setting up if you plan to expose some of your services outside your local network, or if you want to run a service on a port that your host is already using (eg: you want a container to act as DNS on port 53, but systemd-resolved is already using it on the host).

    You can set up port forwarding at your router to the containers that you want to publicly expose, and any other containers will be inaccessible. Meanwhile with just a reverse proxy, someone could try to send requests to any domain behind it, even if you don’t want to expose it.

    My network is set up such that:

    • Physical host has one IP address that’s only accessible over lan.
    • Containerized web services that I don’t want to expose publicly are behind a reverse proxy container that has its own IP on the macvlan.
    • Containerized web services that I do want to expose publicly have a separate reverse proxy container, which gets a different IP on the macvlan.
    • Router has ports 80 and 443 forwarding only to the IP address for my public proxy