mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-09-19 04:19:09 +02:00
103 lines
4.6 KiB
Plaintext
103 lines
4.6 KiB
Plaintext
---
|
|
title: "Clustering Requirements"
|
|
description: "Hosts, networking, and DNS delegation needed before deploying a Pangolin cluster"
|
|
---
|
|
|
|
<Note>
|
|
Clustering is only available in [Enterprise Edition](/self-host/enterprise-edition).
|
|
</Note>
|
|
|
|
Review these requirements before you start deploying. They cover the hosts you need, the ports that must be open, and the DNS records you need to delegate ahead of time. For background on why each piece exists, see [Understanding Clustering](/self-host/advanced/clustering/understanding-clustering).
|
|
|
|
## Hosts
|
|
|
|
You need a minimum of **three hosts**:
|
|
|
|
- **Node 1** -- runs Pangolin, Gerbil, and Traefik
|
|
- **Node 2** - runs Pangolin, Gerbil, and Traefik
|
|
- **A database host** - runs PostgreSQL and a Redis-compatible server (Valkey, Redis, etc.)
|
|
|
|
<Tip>
|
|
The database host doesn't need to be a dedicated instance. You can run PostgreSQL and Redis however you like - a managed cloud database, an existing cluster, etc. - as long as both nodes can reach them. The only hard requirement is that the Redis-compatible server supports **pub/sub**.
|
|
</Tip>
|
|
|
|
You can add more Pangolin nodes beyond two for additional capacity or regional distribution. The two-node topology in this guide is the minimum for high availability.
|
|
|
|
For sizing information, see [Choosing a VPS](/self-host/choosing-a-vps) - the same sizing from single pangolin node deployments applies to each node in a cluster.
|
|
|
|
## Networking
|
|
|
|
- **Node 1 and Node 2 each need a public, static IP address**, reachable from the internet
|
|
- **Node 1 and Node 2 need to be able to address each other** over an internal network
|
|
- **You must provide your own HA load balancer** in front of both nodes. It needs to route to both nodes and health-check the `/ping` endpoint on each, removing any node that fails the check
|
|
|
|
### Required Ports
|
|
|
|
Configure the following firewall rules on each Pangolin node.
|
|
|
|
**Inbound**
|
|
|
|
| Type | Protocol | Port range | Source | Description |
|
|
| --- | --- | --- | --- | --- |
|
|
| HTTP | TCP | 80 | 0.0.0.0/0 | Ping and redirects |
|
|
| HTTPS | TCP | 443 | 0.0.0.0/0 | Pangolin public resources |
|
|
| Custom UDP | UDP | 21820 | 0.0.0.0/0 | WireGuard relay port |
|
|
| Custom UDP | UDP | 51820 | 0.0.0.0/0 | WireGuard port |
|
|
| DNS (UDP) | UDP | 53 | Load balancer | DNS |
|
|
| HTTP | TCP | 3000 | Load balancer | Pangolin dashboard UI and API |
|
|
| Custom TCP | TCP | 3004 | Self + all other nodes | Gerbil node API |
|
|
|
|
**Outbound**
|
|
|
|
| Type | Protocol | Port range | Destination | Description |
|
|
| --- | --- | --- | --- | --- |
|
|
| All traffic | All | All | 0.0.0.0/0 | Allow all outbound |
|
|
|
|
## DNS Delegation
|
|
|
|
Pangolin's built-in DNS server needs to be delegated authority for a nameserver subdomain. Point an NS record at your load balancer, then optionally delegate additional subdomains through it.
|
|
|
|
<Steps>
|
|
<Step title="Create the nameserver record">
|
|
Create an A record pointing your chosen nameserver hostname at your load balancer's IP. The examples in this guide use `ns.example.com` - substitute your own domain or subdomain.
|
|
|
|
| Name | Type | Value |
|
|
| --- | --- | --- |
|
|
| `ns.example.com` | A | `<LOAD_BALANCER_IP>` |
|
|
</Step>
|
|
<Step title="Delegate CNAME-based domains (optional)">
|
|
If you want to support CNAME delegation for resource domains, delegate a subdomain to your nameserver.
|
|
|
|
| Name | Type | Value |
|
|
| --- | --- | --- |
|
|
| `cname.example.com` | NS | `ns.example.com` |
|
|
</Step>
|
|
<Step title="Delegate site-to-cloud resolution (optional)">
|
|
If you want to support site-to-cloud networking - resolving a site's tunnel address by DNS from within a cloud environment - delegate another subdomain the same way.
|
|
|
|
| Name | Type | Value |
|
|
| --- | --- | --- |
|
|
| `site.example.com` | NS | `ns.example.com` |
|
|
</Step>
|
|
</Steps>
|
|
|
|
These three hostnames map directly to the `dns` section of `privateConfig.yml`, covered in [Deploy a Cluster](/self-host/advanced/clustering/deploy-a-cluster):
|
|
|
|
```yaml
|
|
dns:
|
|
enabled: true
|
|
nameserver_name: "ns.example.com"
|
|
cname_extension: "cname.example.com"
|
|
site_extension: "site.example.com" # Optional
|
|
```
|
|
|
|
## Other Requirements
|
|
|
|
- **Contact email** for Let's Encrypt ACME registration
|
|
- **GeoIP databases** - download and keep up to date the MaxMind `GeoLite2-Country.mmdb` and `GeoLite2-ASN.mmdb` databases, placed in each node's `config/` directory. See [Enable Geo-location](/self-host/advanced/enable-geolocation) and [Enable ASN Lookup](/self-host/advanced/enable-asn-lookup)
|
|
- **Site type support** - in clustered deployments, only Newt sites are supported. Local sites and basic WireGuard sites are not supported
|
|
|
|
<Card title="Deploy a Cluster" href="/self-host/advanced/clustering/deploy-a-cluster" icon="server">
|
|
Once these requirements are met, follow the full deployment walkthrough.
|
|
</Card>
|