manage reverse proxy ip for Caddy.js
This commit is contained in:
@@ -0,0 +1,176 @@
|
||||
This is just recommandation for apxtri developer to help to create for testiing as well production to set many towns in a host (a physical server) with many VM (one LXC VM per town).
|
||||
We assume that you have setup a physical ubuntu server machine with network bond.
|
||||
|
||||
# into a host's terminal, create a container (use - not . for the naming):
|
||||
lxc launch ubuntu:24.04 {town}-{nation}
|
||||
# Create the user 'phil' with a home directory and bash shell
|
||||
lxc exec nova-libera -- useradd -m -s /bin/bash phil
|
||||
# Set a password for 'phil'
|
||||
lxc exec nova-libera -- passwd phil
|
||||
# Add phil to the sudo group
|
||||
lxc exec nova-libera -- usermod -aG sudo phil
|
||||
# Install SSH server
|
||||
lxc exec nova-libera -- apt update
|
||||
lxc exec nova-libera -- apt install -y openssh-server
|
||||
# Ensure it is running
|
||||
lxc exec nova-libera -- systemctl enable --now ssh
|
||||
# Login as phil
|
||||
lxc exec nova-libera -- sudo --login --user phil
|
||||
|
||||
Action Command
|
||||
Start lxc start nova-libera
|
||||
Stop lxc stop nova-libera
|
||||
List Containers lxc list
|
||||
Info/IP Address lxc info nova-libera
|
||||
Delete lxc delete --force nova-libera
|
||||
|
||||
|
||||
# Network Routing Synthesis: Accessing LXC Subnet from a Remote Local Machine
|
||||
|
||||
Architecture:
|
||||
|
||||
Machine C (Local Client): 192.168.1.104
|
||||
|
||||
Machine A (LXC Host): 192.168.1.96 (Interface: bond0)
|
||||
|
||||
LXC X (Container): 10.31.251.161 (Interface: lxdbr0)
|
||||
|
||||
1. On Machine C (The Client)
|
||||
The goal is to tell your computer that the path to the 10.31.251.0 network is through Host A.
|
||||
|
||||
Bash
|
||||
# Add the route to the LXC subnet via the Host IP
|
||||
sudo ip route add 10.31.251.0/24 via 192.168.1.96
|
||||
|
||||
# Verify that the route is active
|
||||
ip route get 10.31.251.161
|
||||
# Output should show: via 192.168.1.96 dev <your_interface>
|
||||
2. On Machine A (The LXC Host)
|
||||
You must authorize packet forwarding and open the firewall rules.
|
||||
|
||||
A. Enable IP Forwarding (Kernel)
|
||||
Bash
|
||||
# Check the status (should be 1)
|
||||
cat /proc/sys/net/ipv4/ip_forward
|
||||
|
||||
# If it is 0, enable it immediately:
|
||||
sudo sysctl -w net.ipv4.ip_forward=1
|
||||
B. Configure the Firewall (Iptables)
|
||||
Insert rules at position 1 to bypass automatic LXD/Docker restrictions.
|
||||
|
||||
Bash
|
||||
# 1. Authorize OUTBOUND traffic (Machine C -> LXC)
|
||||
sudo iptables -I FORWARD 1 -s 192.168.1.104 -d 10.31.251.0/24 -j ACCEPT
|
||||
|
||||
# 2. Authorize INBOUND traffic (LXC -> Machine C)
|
||||
sudo iptables -I FORWARD 2 -s 10.31.251.0/24 -d 192.168.1.104 -j ACCEPT
|
||||
|
||||
# Make these rules persistent (requires iptables-persistent)
|
||||
sudo netfilter-persistent save
|
||||
3. On Machine X (The LXC Container)
|
||||
Usually, no specific routing configuration is needed as long as the container uses the host as its default gateway (standard with lxdbr0).
|
||||
|
||||
Verification: Ensure that your services (Gitea, SSH, etc.) are listening on 0.0.0.0 (all interfaces) and not just 127.0.0.1.
|
||||
|
||||
4. Diagnostic Tools (Troubleshooting)
|
||||
If the ping still fails, run these tests in order:
|
||||
|
||||
From C: traceroute -n 10.31.251.161
|
||||
The first hop must be 192.168.1.96.
|
||||
|
||||
On A: sudo tcpdump -i bond0 icmp
|
||||
If you see packets arriving, Routing on C is correct.
|
||||
|
||||
On A: sudo tcpdump -i lxdbr0 icmp
|
||||
If you see packets here, Host A is correctly forwarding traffic to the container bridge.
|
||||
If you see the Request (out) but no Reply (back):
|
||||
|
||||
This is either a REJECT/DROP rule on the Host or the Container does not know how to reach 192.168.1.104.
|
||||
|
||||
Persistence Note: To ensure this survives a reboot:
|
||||
Ensure Host A (192.168.1.96) has a Static IP (configured via Netplan on Ubuntu).
|
||||
|
||||
Make the route on Machine C permanent (via Netplan, NetworkManager, or /etc/network/interfaces).
|
||||
|
||||
# SSH/SFTP Key-Based Access Setup: Client C to Container X
|
||||
|
||||
This guide explains how to set up a simplified, passwordless access for user phil to the LXC container nova-libera (IP 10.31.251.161) host on a 192.168.1.96, working for both the terminal and Nautilus helpfull when you manage manually a setup using a VM LXC
|
||||
|
||||
**1. On Machine C (Local Client)**
|
||||
A. Generate the Key Pair
|
||||
If you don't have a key pair yet, generate a new one (press Enter to accept default options):
|
||||
|
||||
Bash
|
||||
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_nova_libera
|
||||
B. Configure the SSH Shortcut
|
||||
Edit your local SSH configuration file:
|
||||
|
||||
Bash
|
||||
nano ~/.ssh/config
|
||||
Add the following block:
|
||||
|
||||
Plaintext
|
||||
Host nova-libera
|
||||
HostName 10.31.251.161
|
||||
User phil
|
||||
IdentityFile ~/.ssh/id_nova_libera
|
||||
(If your private key is stored on an external drive, replace ~/.ssh/id_nova_libera with the full path to your private key file).
|
||||
|
||||
**2. On Container X (nova-libera)**
|
||||
Log into your container (via lxc exec or your current session) to set up the receiver side.
|
||||
|
||||
A. Prepare the SSH Directory
|
||||
Bash
|
||||
# Ensure you are in phil's home directory
|
||||
mkdir -p /home/phil/.ssh
|
||||
chmod 700 /home/phil/.ssh
|
||||
touch /home/phil/.ssh/authorized_keys
|
||||
chmod 600 /home/phil/.ssh/authorized_keys
|
||||
chown -R phil:phil /home/phil/.ssh
|
||||
B. Add the Public Key
|
||||
You must copy the content of your .pub file (generated in Step 1) into the authorized_keys file inside the container:
|
||||
|
||||
Bash
|
||||
# Example from the host (if you have the file available)
|
||||
cat id_nova_libera.pub >> /home/phil/.ssh/authorized_keys
|
||||
|
||||
**3. Daily Usage**
|
||||
From the Terminal
|
||||
You no longer need to type the IP address or username:
|
||||
|
||||
Bash
|
||||
ssh nova-libera
|
||||
From Nautilus (File Manager)
|
||||
Open Nautilus.
|
||||
|
||||
Press Ctrl + L to focus the address bar.
|
||||
|
||||
Enter the following address:
|
||||
|
||||
Plaintext
|
||||
sftp://nova-libera
|
||||
Press Enter. You will be connected instantly without a password prompt.
|
||||
|
||||
**4. Troubleshooting (Checks)**
|
||||
If the connection is denied, verify these points inside the container:
|
||||
|
||||
Does the SSH service allow keys?
|
||||
Check in /etc/ssh/sshd_config that:
|
||||
|
||||
PubkeyAuthentication yes is enabled.
|
||||
|
||||
AuthorizedKeysFile .ssh/authorized_keys is set.
|
||||
|
||||
Strict Permissions:
|
||||
SSH will reject connections if directories are too "open":
|
||||
|
||||
/home/phil should not be 777.
|
||||
|
||||
.ssh folder must be 700.
|
||||
|
||||
authorized_keys file must be 600.
|
||||
|
||||
Restart the Service:
|
||||
|
||||
Bash
|
||||
sudo systemctl restart ssh
|
||||
@@ -425,6 +425,9 @@ TRIBE_EOF
|
||||
echo "[INFO] Tribe '$TOWN' created."
|
||||
fi
|
||||
|
||||
# Fix ownership after sudo cp/mkdir in step 7 (files created as root)
|
||||
sudo chown -R "$APXTRI_USER:$APXTRI_USER" "$TRIBE_DATA_DIR" "$TRIBE_CODE_DIR"
|
||||
|
||||
# ==== STEP 8: CREATE .ENV FILE ====
|
||||
echo "[STEP 8/11] Creating environment configuration..."
|
||||
|
||||
|
||||
Reference in New Issue
Block a user