Where communities thrive

Join over 1.5M+ people
Join over 100K+ communities
Free without limits
Create your own community

Explore more communities

Ansible-NAS/Chat

General chat and support for Ansible-NAS. If you enjoy Ansible-NAS, a coffee would be appreciated! https://ko-fi.com/davestephens

People

Repo info

Activity

08:07

anarion80 synchronize #641
Jan 29 21:17

vanklompf synchronize #646
Jan 29 21:08

vanklompf synchronize #646
Jan 29 13:22

vanklompf opened #646
Jan 28 04:22

choskeli opened #645
Jan 27 15:25

dependabot[bot] labeled #644
Jan 27 15:25

dependabot[bot] opened #644
Jan 24 17:01

choskeli labeled #643
Jan 24 17:01

choskeli opened #643
Jan 20 22:10

codemeister64 synchronize #625
Jan 17 05:17

georgejung labeled #642
Jan 17 05:17

georgejung opened #642
Jan 14 06:04

tsjordan-eng synchronize #543
Jan 11 14:56

anarion80 opened #641
Jan 10 23:03

lexxish edited #640
Jan 10 23:03

lexxish opened #640
Jan 10 23:03

lexxish labeled #640
Jan 09 20:24

anarion80 edited #638
Jan 09 16:36

StevenCHowell opened #639
Jan 09 16:34

anarion80 opened #638

allthestairs

@allthestairs

It works by adding a second network to the docker containers and then changing their default route.

I was about to ask something about how to use ansible to restore the original default route when you remove a container from the list but I think I figured it out while typing the question.

allthestairs

@allthestairs

Prototype done if anyone uses a wireguard vpn and wants to try out routing arbitrary containers through it in ansible-nas https://github.com/allthestairs/ansible-nas/tree/wireguard

You put in your info in the relevant vars, it sets up a tunnel interface, generates a second docker bridge network, configures routing to send traffic on that second bridge through wireguard, then adds that bridge network to all containers you list and sets their default route to wireguard

containers can still be accessed locally on their normal IP

if you remove a container from the list it should reset the default route to the original docker bridge network

you get it by running the wireguard.yml playbook

Andrew DiLosa

@adilosa

thanks! was just looking for a vpn setup, great timing. i'll try it out this weekend

allthestairs

@allthestairs

I was debating whether to use wireguard in a container instead of setting up an interface with systemd templates but I couldn't think of a good reason for that hassle when it isn't all that distinct from how ansible-nas handles something like NFS

Andrew DiLosa

@adilosa

my preference at the moment is as much in configurable containers as possible, install almost nothing on the host. im a bit surprised something like a VPN works out that nicely, but if it's as you said where the local ips are preserved too seems great

allthestairs

@allthestairs

yeah I could probably change it to use wireguard in a container, and that just made me realize i don't have a task to actually install wireguard

the problem with wireguard containers is they need so many privileges to make interfaces and manipulate routes and such

Andrew DiLosa

@adilosa

ah yeah i can imagine. making a task is dead simple, esp since theres already images like linuxserver/wireguard. but the networking might be gnarly

allthestairs

@allthestairs

the effect is that you are creating a docker container to create an interface on the host outside of the container namespace

all it takes to do the setup is dropping two templates in /etc/systemd/network and restarting systemd-networkd

maybe i'll experiment with containers tomorrow

Andrew DiLosa

@adilosa

eh, your way might be the way to go for this. as long as its in ansible its pretty transparent anyway

allthestairs

@allthestairs

I still need to test it with containers with more unusual network setups, if there are any in ansible-nas

works great with transmission atm

Andrew DiLosa

@adilosa

that's good. i can let you know how it works for me. only weird thing i have might be pihole

allthestairs

@allthestairs

That is one of those things where I'd have to think about what you're trying to accomplish by tunneling your pi-hole container through a wireguard vpn

Andrew DiLosa

@adilosa

oh i wouldnt need that necessarily. just the only thing in my setup that has weird docker-networking implications

im still on an old fork, before things changed from tasks -> roles, because i incorporated some of the PRs from @bcurran3 like pihole and unifi. will see if i can get wireguard working with all that

as long as wireguard doesnt interfere with pihole working locally, all good there

allthestairs

@allthestairs

hmm, you can probably just drop that one role folder and wireguard.yml in there and have it work since i didn't touch nas.yml

it shouldn't affect anything that you don't put in the wireguard_containers list

I wanted fine-grained here

Andrew DiLosa

@adilosa

sounds good to me! i'll pull your commit in later and see how it goes

allthestairs

@allthestairs

if there are any ansible or docker networking wizards I would love to know a better way to do the, let's say, last four tasks in that role

allthestairs

@allthestairs

I don't seem to have broken traefik yet but hypothetically having two ip addresses, only one of which traefik can see, could cause problems if traefik restarts while the container has two networks

I'll need to figure out if setting traefik.docker.network=bridge will break something

oh right, it doesn't break because we use traefik in host networking mode

Jean Lucas

@jeanlst

Cool! Gonna snatch that hydra role from your rope @allthestairs

Jean Lucas

@jeanlst

Guys, why do we have separate tasks for calibre/guacamole/etc and their defaults inside nas.yml instead of having their own role folder inside roles like the other ones?

Andrew DiLosa

@adilosa

I think the migration to roles hasn't been finished. There's open PRs for Calibre (davestephens/ansible-nas#415) and a bunch of others, but no commits have been made since Apr 2.

allthestairs

@allthestairs

My hydra role should be ready to pull into master. I'm a bad contributor and forgot about fixing my lint problems on that pull request...four months ago.

Jean Lucas

@jeanlst

I was looking at the smarttools issue, has anyone been able to make a role for it? davestephens/ansible-nas#2

19 replies

I have my own domain and I'm using protonmail for mail with that domain

allthestairs

@allthestairs

This looked like an interesting option: https://hub.docker.com/r/analogj/scrutiny

allthestairs

@allthestairs

I integrated https://hub.docker.com/r/analogj/scrutiny into the stats role that I also added to run it alongside grafana

it can handle all sorts of smartd notification tools using https://containrrr.dev/shoutrrr/services/overview/

allthestairs

@allthestairs

If anyone wants to try it you can find my branch here: https://github.com/allthestairs/ansible-nas/tree/scrutiny It does include a commit that transitions the stats task to a role

it should be configurable to allow notifications without manually editing the template file

allthestairs

@allthestairs

I think the migration to roles hasn't been finished. There's open PRs for Calibre (davestephens/ansible-nas#415) and a bunch of others, but no commits have been made since Apr 2.

I went through and created a branch for each reamining task that replaces task with a role and then created another streamlined single-commit branch that has everything as a role with not a single remaining bare task https://github.com/allthestairs/ansible-nas/tree/all_roles

Andrew DiLosa

@adilosa

pulled the commit, seemed to install wireguard fine. ended up moving to wg-quick settings from systemd as part of debugging. turned out there was bug in the Unifi controller that made port forwarding settings silently not take effect, ended up in a whole Unifi upgrade hell where DHCP was hosed all day.

anyways... tl;dr once i rebuilt my network i ended up configuring wireguard manually in the host. it seems to give me access to all my containers that are locally accessible anyway, without mucking around with docker networking.

allthestairs

@allthestairs

I seem to have run into an issue with using it and docker port forwarding but I probably fucked something up manually while experimenting.

It definitely needs more testing before I'd suggest anyone do more than experiment with it.

Also I realized my routing manipulation in the containers isn't a real solution since it doesn't survive a container restart.

I'm not sure if Docker actually supports a way to do what I'm doing, but the current ansible plugin definitely seems not to

Well, actually lets say I'm pretty sure I could make it work if I was willing to go into the docker_container setup for every container and modify it there, but I don't really want to make that sweeping a set of changes to enable VPN

Chat via Matrix