mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-07-19 22:31:27 +02:00
156 lines
4.3 KiB
Plaintext
156 lines
4.3 KiB
Plaintext
https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-on-a-router
|
|
/etc/docker/daemon.json
|
|
{
|
|
"ip-forward-no-drop": true
|
|
}
|
|
|
|
Docker will also enabling forwarding by default but if not sudo sysctl -w net.ipv4.ip_forward=1 and make perminate with
|
|
|
|
docker-compose-host.yml
|
|
name: pangolin
|
|
services:
|
|
pangolin:
|
|
image: docker.io/fosrl/pangolin-node:1.4.0
|
|
# image: 537824365807.dkr.ecr.us-west-1.amazonaws.com/pangolin_node_owen
|
|
container_name: pangolin
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./config:/app/config
|
|
- pangolin-data-certificates:/var/certificates
|
|
- pangolin-data-dynamic:/var/dynamic
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
|
|
interval: "10s"
|
|
timeout: "10s"
|
|
retries: 15
|
|
|
|
gerbil:
|
|
image: docker.io/fosrl/gerbil:1.4.2
|
|
container_name: gerbil
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
depends_on:
|
|
pangolin:
|
|
condition: service_healthy
|
|
command:
|
|
- --reachableAt=http://localhost:3003
|
|
- --generateAndSaveKeyTo=/var/config/key
|
|
- --remoteConfig=http://localhost:3001/api/v1/
|
|
volumes:
|
|
- ./config/:/var/config
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
|
|
traefik:
|
|
image: docker.io/traefik:v3.5
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
depends_on:
|
|
pangolin:
|
|
condition: service_healthy
|
|
command:
|
|
- --configFile=/etc/traefik/traefik_config.yml
|
|
volumes:
|
|
- ./config/traefik:/etc/traefik:ro
|
|
- ./config/traefik/logs:/var/log/traefik
|
|
- pangolin-data-certificates:/var/certificates:ro
|
|
- pangolin-data-dynamic:/var/dynamic:ro
|
|
|
|
volumes:
|
|
pangolin-data-dynamic:
|
|
pangolin-data-certificates:
|
|
|
|
config/config.yml
|
|
app:
|
|
log_level: debug
|
|
server:
|
|
internal_port: 3001
|
|
internal_hostname: localhost
|
|
gerbil:
|
|
start_port: 51820
|
|
base_endpoint: "54.176.101.5"
|
|
reachable_at: http://localhost:3003
|
|
managed:
|
|
endpoint: https://app.pangolin.dev.fosrl.io
|
|
id: "owjiufga6mdj94k"
|
|
secret: "iicbif2oxlqzkx13eb501h586h1gtxiwpr7nu52tr1rpbcqi"
|
|
|
|
|
|
config/traefik/traefik_config.yml
|
|
api:
|
|
insecure: true
|
|
dashboard: true
|
|
|
|
providers:
|
|
file:
|
|
directory: "/var/dynamic"
|
|
watch: true
|
|
|
|
experimental:
|
|
plugins:
|
|
badger:
|
|
moduleName: "github.com/fosrl/badger"
|
|
version: "v1.3.1"
|
|
|
|
log:
|
|
level: "INFO"
|
|
format: "common"
|
|
maxSize: 100
|
|
maxBackups: 3
|
|
maxAge: 3
|
|
compress: true
|
|
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
websecure:
|
|
address: ":443"
|
|
proxyProtocol:
|
|
trustedIPs:
|
|
- 0.0.0.0/0 # This is coming from gerbil
|
|
- ::1/128
|
|
transport:
|
|
respondingTimeouts:
|
|
readTimeout: "30m"
|
|
|
|
serversTransport:
|
|
insecureSkipVerify: true
|
|
|
|
ping:
|
|
entryPoint: "web"
|
|
|
|
|
|
Use <newtId>.site.pangolin.net to resolve the site between multiple exit nodes in the same cloud. this will return the routable address of the site that we can route to and if the site moves between nods because they are down or something this will follow the site but you can expect a little downtime when it moves
|
|
|
|
|
|
You must allow all traffic into the node from the network so it can act as a concentrator otherwise the security group will block this inbounc traffic.
|
|
images/security_group_inbound_to_node.png
|
|
|
|
Add the subnet to the route tables so that the data in the VPC knows to route to the node. Use the node as the instance id.
|
|
images/subnet_in_route_table.png
|
|
|
|
Disable source destination check or the VPC will block VPN traffic from entering the node
|
|
images/source_destination_check_menu.png
|
|
images/source_destination_check_box.png
|
|
|
|
Put the VPC subnet into the routes on the remote node to be pushed to the sites
|
|
images/subnet_programmed_on_node.png
|
|
|
|
Run the site with --native-main to create the routes and network interface on the host
|
|
sudo newt --id 34s48my8iba5wsl --secret ts1v7480qqw01j7ba4uiw5y7l58skw7anpji2ndludhgzloh --endpoint https://app.pangolin.net --native-main
|
|
|
|
|
|
if running on windows sometimes windows does not respond to pings:
|
|
Enable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)"
|
|
|
|
%PROGRAMDATA%/newt/newt-client/config.json
|
|
{
|
|
"id": "34s48my8iba5wsl",
|
|
"secret": "ts1v7480qqw01j7ba4uiw5y7l58skw7anpji2ndludhgzloh",
|
|
"endpoint": "https://app.pangolin.net",
|
|
"nativeMain": true
|
|
}
|