martinx3-administrativedevelopment / servercontainertemplate Goto Github PK

Grundsätzliche Projektdurchführung:

Anforderungen an Demo-Szenario.
Finde bzw. entwickle geeigneten Docker-Container als Grundlage für das Szenario.
Entwickle Architektur für das Demo-Szenario.
Realisiere Demo-Szenario.
Guter anwendungsbezogener Vortrag/Demo zum Projekt.
Projektdokumentation

With a basic configuration.

There is an open slirp4netns issue for this -> rootless-containers/slirp4netns#253

IPv6 is in the works and experimental. Thus it is not recommended to be used in this stage.
Exception: You could bind a container to one IPv6 address, it's a workaround.

https://www.openldap.org/

https://github.com/bitnami/bitnami-docker-openldap#how-to-use-this-image

Connect it with OpenID
#25

https://wiki.archlinux.org/title/RAID#RAID_Maintenance
https://wiki.archlinux.org/title/RAID#Email_notifications

With send email support

Server with Bitwarden
https://github.com/bitwarden/server

Munin, Telegraf oder zabbix statt prometheus?

Create a script / tool to automatically partition the server and install the needed things.

Like ansible or something else

Use the https nginx container

https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-nginx
https://hub.docker.com/r/cockpit/ws
https://github.com/cockpit-project/cockpit-container

cockpit-project/cockpit#17566

--network-alias=alias

[…]NOTE: A container will only have access to aliases on the first network that it joins. This is a limitation that will be removed in a later release.

https://docs.podman.io/en/latest/markdown/podman-pod-create.1.html#network-alias-alias

containers/dnsname#12 (comment)

http://containrrr.github.io/watchtower/arguments/

https://nextcloud.com/

https://wiki.archlinux.org/index.php/S.M.A.R.T.#smartd
As example with email support

Schedule self-tests
DEVICESCAN -s (S/../.././11|L/../../6/12)

Smart Monitor
https://github.com/AnalogJ/scrutiny#docker
https://github.com/analogj/scrutiny/pkgs/container/scrutiny
https://hub.docker.com/r/linuxserver/scrutiny

https://stackoverflow.com/questions/60409585/how-to-upgrade-postgresql-database-from-10-to-12-without-losing-data-for-openpro

???
Or better way???

Aside from the security part of the arch wiki

Choose a firewall and add rules to every service manual.

Easiest solution seems to be the iptables wrapper
https://wiki.archlinux.org/title/Uncomplicated_Firewall

UFW also has a rate limit feature against brute force attacks

(Add a hint to each docker service)

https://community.torproject.org/relay/setup/bridge/docker/

A first configuration with basic data is enough.

Create Readme.md with exact instructions to reproduce the result.

Add access via Browser from another Computer of the same Network

https://directory.fedoraproject.org/
https://hub.docker.com/r/389ds/dirsrv
https://directory.fedoraproject.org/docs/389ds/design/docker.html
https://directory.fedoraproject.org/index.html

Supersedes
#14
#25

https://github.com/Loader009/ansible-archlinux-encrypted-root

https://github.com/nginx-proxy/nginx-proxy
0.9.0

Switch to
https://github.com/linuxserver/docker-swag
https://hub.docker.com/r/linuxserver/swag
Remove https://github.com/MartinX3-EducationOrganization/nginx-certbot

Symlink the Let'sEncrypt Certificat on the Host to the Cockpit service

https://hub.docker.com/r/linuxserver/wireguard

https://github.com/furlongm/patchman

https://github.com/aquasecurity/trivy
https://aquasecurity.github.io/trivy/v0.28.0/docs/advanced/container/podman/
Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues

https://github.com/mikaku/Monitorix

Monitorix is a free, open source, lightweight system monitoring tool.

https://www.linuxserver.io/

Buildkite is written in Golang
Jenkins is written in Java
In theory Buildkite should use less RAM.

https://github.com/buildkite/agent
https://github.com/compono/podman-buildkite-plugin

To deploy and upgrade services?

podman-play-kube - Create containers, pods or volumes based on Kubernetes YAML
https://docs.podman.io/en/latest/markdown/podman-play-kube.1.html

Network plugins
https://github.com/containernetworking/plugins

Backup backup backup

The container volumes need to be backuped
Maybe the OS as well

Maybe renting a dedicated server running a S3 compatible storage like ceph or minio
https://dev.to/hendr_ik/automate-backing-up-your-docker-volumes-3gdk

Or maybe a borg client in a container mounting every volume?
https://www.borgbackup.org/

https://github.com/paperless-ngx/paperless-ngx

OpenKM turned closed source with v7
https://github.com/openkm/document-management-system/issues/314
https://github.com/openkm/document-management-system

OpenID is an open standard and decentralized authentication protocol.

eID support
https://github.com/eid-login/eid-login-nextcloud

Connect it with LDAP
#14

1. Switch to https://hub.docker.com/r/bitnami/postgresql
2. The postgresql user should only be used for a pgadmin docker-compose
3. In the readme for projects using the DB a step to create the individual user should be inserted

https://dovecot.org/
https://hub.docker.com/r/dovecot/dovecot

Mailu.io

https://github.com/docker-mailserver/docker-mailserver

rootless SMTP -> https://github.com/haraka/Haraka
LDAP plugin
https://github.com/haraka/Haraka/blob/master/Plugins.md
https://github.com/haraka/haraka-plugin-auth-ldap
Dockerimage
https://github.com/instrumentisto/haraka-docker-image

https://github.com/root-gg/plik

https://github.com/portainer/portainer
Making Docker and Kubernetes management easy.

Starting with version 2.6
portainer/portainer#5188

https://www.nsupdate.info/
https://github.com/nsupdate-info/nsupdate.info

Probably by using

• https://github.com/solarkennedy/ipmi-kvm-docker
• https://registry.hub.docker.com/u/solarkennedy/ipmi-kvm-docker/

• https://github.com/bastienwirtz/homer
• https://github.com/lissy93/dashy
• https://github.com/ajnart/homarr

Icons

• https://github.com/WalkxCode/dashboard-icons

Add a VOLUME to guarantee persistent data storage

As example
https://github.com/grke/burp

It also has a client ui
https://git.ziirish.me/ziirish/burp-ui

Or borg backup client server solution
https://www.borgbackup.org/

As example
https://mkdev.me/en/posts/dockerless-part-1-which-tools-to-replace-docker-with-and-why
https://jaxenter.de/buildah-linux-container-docker-80513

move to rootless podman
use docker-compose or podman-compose
podman-dnsname
https://github.com/containers/
https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md

https://rootlesscontaine.rs/
https://github.com/rootless-containers

systemctl --user enable podman.socket --now
DOCKER_HOST=unix:///run/user/1000/podman/podman.sock docker-compose up

https://github.com/firefly-iii/firefly-iii/
https://www.firefly-iii.org/

Create a short summarisation of what we need to do in the Readme.md

Maybe some services are usefull or better than already listed/used in this repo.

https://github.com/awesome-selfhosted/awesome-selfhosted

Alpine Linux based?
Dedicated partition?
How to change the bootloader from a broken initframfs recovery to point to the recovery OS?

BTRFS RAID 1 at the end of the partition?
1GB?

if bootloader not accecible because of a headless server, is it switchable by a bootable recovery image with grub tools? (grub bootloader)