Docker

Ever since i moved behind starlinks cgnat i have been looking for a way to proxy my sites out to a public ip I have been using cloudflare tunnels for http/https however for tcp/udp i have been less successful as a patch job i setup playit.gg for git and minecraft however this has a very low amount of ports and does not let you chose which port to use. My first major break through came when i started investigating oracle cloud free tier. My first attempt was using a software called pangolin and i just could not figure out its tunnelling. I then looked to wireguard and while i could create a tunnel i ran into a issue with ip config where the tunnel wouldn’t bind to the public ip only to the tunnel ip. The one which finally worked was as you can guess rathole. It has a docker image and uses a single config file on both ends. This makes it ideal to use in my current environment. I am still unsure if i want to switch off of cloudflare tunnel but i will definitely switch off playit.gg.

One of my big goals with my homelab is resiliency as in that i could lose everything and have the ability to rebuild quickly on a new piece of hardware. To this end i have previously had a gitea repo which contained: a docker compose; a deploy target txt; and a env.sh loader script. My setup currently looks like a main.ft with indivial files pre container. I am also using a gitea action to run terraform and commit the new tfstate file to the repo. I think this will be able to scale up with me for now once i finish my migration.

So in my process of preparing to switch to starlink I setup headscale to replace my wireguard vpn. I thought that I would have to use tailscale as I presumed the headscale server would require a port. It does but it just so happens to use https which I can tunnel with cloudflare. So with that in mind I setup headscale in a docker container and connected my phone with no issue. The server side was slightly harder as a i used the tailscale docker container and accidentally removed the envs so i spent a while trying to figure out why the state file wasn’t saving properly. That is fixed now and it works fine. However on further investigation I realised that I could not use it for my main purpose as cloudflare tunnels do not support web socket PUSH.

The setup was simple I deployed the panel in a docker container to a fresh docker host. I had to set the application url env to the public url not the private one. Then I installed the wings software on the same VM as the panel. I had to manually copy the config file from the panel. Everything else it automated with gitea actions. I made sure to change some of the files in the config files to my nfs share. Unfortuantly I then ran into a massive bug where I couldn’t start any server. I hope this is fixed soon.

Since I started storing all my docker compose files in git i have wanted to create a public mirror as a disaster recovery option. To that end i needed a way to remove sensitive envs from the files. To achive this I set the docker env to a shell env like so TEMP: ${TEMP} This shell env was set by a script which contained export TEMP=$(vault kv get -field=temp kv/data/docker). This vault currently runs as a single node in docker and has to be manually unsealed as needed.

It started when i tired to set up my emails on Thunderbird mail on arch I noticed it wouldn’t connect. I checked the logs and found “2025-01-16 21:04:11,919 WARN exited: amavis (exit status 1; not expected)” I fixed this relatively quickly by removing “amavisd.pid”. After this it booted but I still couldn’t connect. I tracked this down by using dig and whats my ip to see that the dns record was wrong. I fixed this by switching to a cname record set to @ so i only need 1 ddns setup. This finally fixed it.

I began by trying several plugins to get https working on my website none of the ones I found worked for free so I kept looking until I found one called simple ssl. I installed and activated it but when I went to refresh my website nothing just a plain white screen. I tried lots of different ideas to fix it but nothing worked solutions like renaming plugin and theme folders did nothing in the end I just gave up.

Ever since I setup mailcow I have been annoyed that it runs with docker volumes and updates with a script. This makes it imposible to run how I want. I feel the main benefit of docker should be all the files needed are backed up and I can use the docker compose file to spin the container up anywhere. I have tried may times to fix these problems in mailcow and have always failed. So I finally gave up with mailcow and started looking at other options. I quite quickly found docker mailserver as my main option. I don’t know if I didn’t see it the first time round or if I was scared of by the lack of a GUI. What ever the case now I am happy to use the command line for everything. ...

During a backup test I did recently I found that wireguard wasn’t working properly. I have no idea how long this has been the case but to fix it I started trying to change the config however when that lead to no improvment I decided to reinstall. This is something I have considered before as my current setup doesn’t have a gui which would be nice so I use the repository (https://github.com/wg-easy/wg-easy?tab=readme-ov-file). The install was over all easy however the password hashing didn’t work on a super strong password. This seems to be working now and I will probably redo the backup test for wireguard soon.

I noticed today that Wazuh wasn’t working after I restarted my server. I saw in the logs it was failing the bootstrap test. I thought the issue was the mass of file permission error that were appearing before this error showed. However after messing around with file permissions I noticed a error about sysctl vm.max_map_count after running “sysctl -w vm.max_map_count=262144” it started working however I have no idea how this wasn’t a issue until now.