diff --git a/config/ha-reference/README.md b/config/ha-reference/README.md index e985852d6..69f121404 100644 --- a/config/ha-reference/README.md +++ b/config/ha-reference/README.md @@ -3,6 +3,23 @@ you need 3 instances at a minimum: node1 running pangolin, node 2 running pangol the two pangolin nodes need to have public STATIC ips accessible on the internet AND the two nodes need tp be able to address each other and +update these values in the `docker-compose.yml` file under the gerbil section: + +```yaml + gerbil: + image: docker.io/fosrl/gerbil:latest + container_name: gerbil + restart: unless-stopped + depends_on: + pangolin: + condition: service_healthy + command: + - --reachableAt=http://:3004 + - --generateAndSaveKeyTo=/var/config/key + - --remoteConfig=http://pangolin:3001/api/v1/ + - --trusted-upstreams=, # All trusted nodes in the cluster +``` + open ports should look like this **Outbound Rules** @@ -28,12 +45,49 @@ add your email address for acme into only one of the nodes - in this case node1 - should be configured to run the acme client. the other node should have acme disabled. this is because only one node should be responsible for generating and renewing certificates. the other node will use the same certificates from the database. this is controlled with `acme.enable_acme_client` +delegating domains: + +you need to create a namesever dns record. this is an a record pointing at the cluster for the DNS nameserver. + +in the example config, this is ns.example.com. you can replace example.com with your domain or choose a any subdomain. Create an A record pointing at your cluster's load ballencer: + +| Name | Type | Value | +| --- | --- | --- | +| ns.example.com | A | | + +if you plan to support cname delegation to the server you will need to add an additional cname record for the cluster. this is an example of a cname record pointing at the cluster for the DNS nameserver. + +| Name | Type | Value | +| --- | --- | --- | +| cname.example.com | NS | ns.example.com | + +finally, if you would like to support site-to-cloud networking, you can delegate a domain to be able to resolve site addresses withing a cloud encironement to address them through remote nodes. this looks like the above + +| Name | Type | Value | +| --- | --- | --- | +| site.example.com | NS | ns.example.com | + +update all three of these values in the privateConfig dns section: + +```yaml +dns: + enabled: true + nameserver_name: "ns.example.com" + cname_extension: "cname.example.com" + site_extension: "site.example.com" # Optional +``` -- when you start for the first time pick one node to start first. This node will init the database and print out the init token to the logs. Use this token to visit the UI and login to create the first user. Then bring up the other nodes +notes: + +traefik uses file_mode: true. this is different than the regular pangolin instrall which scrapes the http api. the file mode writes the traefik config into the dynamic directory - the routers and certs. This is because traefik will only pull cert config files from a file and not from an api. ensure there is a shared volume beteeen pangolin and traefik + +be sure to download and keep up to date the maxmind databases for geoip and asn. these are used for geolocation and asn lookups. (reference the geoblocking docs here) and place them into the config directory GeoLite2-ASN.mmdb and GeoLite2-Country.mmdb + -- whats required: @@ -51,4 +105,4 @@ if you run into loopback issues with the local pangolin instance not being able ``` gerbil: local_exit_node_reachable_at: "http://gerbil:3004" -``` \ No newline at end of file +``` diff --git a/config/ha-reference/node1/config/dynamic/.gitkeep b/config/ha-reference/node1/config/dynamic/.gitkeep deleted file mode 100644 index e69de29bb..000000000 diff --git a/config/ha-reference/node1/config/dynamic/dynamic_config.yml b/config/ha-reference/node1/config/dynamic/dynamic_config.yml new file mode 100644 index 000000000..39bf537fe --- /dev/null +++ b/config/ha-reference/node1/config/dynamic/dynamic_config.yml @@ -0,0 +1,67 @@ +http: + middlewares: + badger: + plugin: + badger: + disableForwardAuth: true + + routers: + # Next.js router (handles everything except API and WebSocket paths) + next-router: + rule: "!PathPrefix(`/api/v1`)" + service: next-service + entryPoints: + - dashboard + middlewares: + - badger + + # API router (handles /api/v1 paths) + api-router: + rule: "PathPrefix(`/api/v1`)" + service: api-service + entryPoints: + - dashboard + middlewares: + - badger + + # WebSocket router + ws-router: + rule: "PathPrefix(`/`)" + service: api-service + entryPoints: + - dashboard + middlewares: + - badger + + services: + next-service: + loadBalancer: + servers: + - url: "http://pangolin:3002" # Next.js server + + api-service: + loadBalancer: + servers: + - url: "http://pangolin:3000" # API/WebSocket server + +tcp: + serversTransports: + pp-transport-v1: + proxyProtocol: + version: 1 + pp-transport-v2: + proxyProtocol: + version: 2 + +udp: + routers: + dns-router: + entryPoints: + - dns + service: dns-service + + services: + dns-service: + loadBalancer: + servers: + - address: "pangolin:53" \ No newline at end of file diff --git a/config/ha-reference/node1/config/traefik/traefik_config.yml b/config/ha-reference/node1/config/traefik/traefik_config.yml index e62a3f262..ebe178f70 100644 --- a/config/ha-reference/node1/config/traefik/traefik_config.yml +++ b/config/ha-reference/node1/config/traefik/traefik_config.yml @@ -33,6 +33,10 @@ entryPoints: encodedCharacters: allowEncodedSlash: true allowEncodedQuestionMark: true + dashboard: + address: ":3000" + dns: + address: ":53/udp" serversTransport: insecureSkipVerify: true diff --git a/config/ha-reference/node1/docker-compose.yml b/config/ha-reference/node1/docker-compose.yml index c4440486b..c8f80d603 100644 --- a/config/ha-reference/node1/docker-compose.yml +++ b/config/ha-reference/node1/docker-compose.yml @@ -4,15 +4,6 @@ services: image: docker.io/fosrl/pangolin:ee-latest container_name: pangolin restart: unless-stopped - deploy: - resources: - limits: - memory: 2g - reservations: - memory: 512m - ports: - - 53:53/udp # DNS - - 3000:3000 # Pangolin UI volumes: - ./config:/app/config - ./config/certificates:/var/certificates @@ -43,9 +34,11 @@ services: ports: - 51820:51820/udp # wireguard - 21820:21820/udp # relay + - 53:53/udp # DNS - 443:8443 # resources - 80:80 # web - 3004:3004 # gerbil api + - 3000:3000 # Pangolin UI traefik: image: docker.io/traefik:v3.7.11 diff --git a/config/ha-reference/node2/config/dynamic/.gitkeep b/config/ha-reference/node2/config/dynamic/.gitkeep deleted file mode 100644 index e69de29bb..000000000 diff --git a/config/ha-reference/node2/config/dynamic/dynamic_config.yml b/config/ha-reference/node2/config/dynamic/dynamic_config.yml new file mode 100644 index 000000000..39bf537fe --- /dev/null +++ b/config/ha-reference/node2/config/dynamic/dynamic_config.yml @@ -0,0 +1,67 @@ +http: + middlewares: + badger: + plugin: + badger: + disableForwardAuth: true + + routers: + # Next.js router (handles everything except API and WebSocket paths) + next-router: + rule: "!PathPrefix(`/api/v1`)" + service: next-service + entryPoints: + - dashboard + middlewares: + - badger + + # API router (handles /api/v1 paths) + api-router: + rule: "PathPrefix(`/api/v1`)" + service: api-service + entryPoints: + - dashboard + middlewares: + - badger + + # WebSocket router + ws-router: + rule: "PathPrefix(`/`)" + service: api-service + entryPoints: + - dashboard + middlewares: + - badger + + services: + next-service: + loadBalancer: + servers: + - url: "http://pangolin:3002" # Next.js server + + api-service: + loadBalancer: + servers: + - url: "http://pangolin:3000" # API/WebSocket server + +tcp: + serversTransports: + pp-transport-v1: + proxyProtocol: + version: 1 + pp-transport-v2: + proxyProtocol: + version: 2 + +udp: + routers: + dns-router: + entryPoints: + - dns + service: dns-service + + services: + dns-service: + loadBalancer: + servers: + - address: "pangolin:53" \ No newline at end of file diff --git a/config/ha-reference/node2/config/traefik/traefik_config.yml b/config/ha-reference/node2/config/traefik/traefik_config.yml index e62a3f262..ebe178f70 100644 --- a/config/ha-reference/node2/config/traefik/traefik_config.yml +++ b/config/ha-reference/node2/config/traefik/traefik_config.yml @@ -33,6 +33,10 @@ entryPoints: encodedCharacters: allowEncodedSlash: true allowEncodedQuestionMark: true + dashboard: + address: ":3000" + dns: + address: ":53/udp" serversTransport: insecureSkipVerify: true diff --git a/config/ha-reference/node2/docker-compose.yml b/config/ha-reference/node2/docker-compose.yml index c4440486b..8a2e6d4d7 100644 --- a/config/ha-reference/node2/docker-compose.yml +++ b/config/ha-reference/node2/docker-compose.yml @@ -4,15 +4,6 @@ services: image: docker.io/fosrl/pangolin:ee-latest container_name: pangolin restart: unless-stopped - deploy: - resources: - limits: - memory: 2g - reservations: - memory: 512m - ports: - - 53:53/udp # DNS - - 3000:3000 # Pangolin UI volumes: - ./config:/app/config - ./config/certificates:/var/certificates @@ -43,9 +34,11 @@ services: ports: - 51820:51820/udp # wireguard - 21820:21820/udp # relay + - 53:53/udp # DNS - 443:8443 # resources - 80:80 # web - 3004:3004 # gerbil api + - 3000:3000 # Pangolin UI traefik: image: docker.io/traefik:v3.7.11