zedcode/selfhosted-apps-docker
1
0
Fork 0
mirror of https://github.com/DoTheEvo/selfhosted-apps-docker.git synced 2026-07-03 14:06:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
DoTheEvo
2026-01-03 03:07:00 +01:00
parent a235e03c82
commit 3e8505929b
3 changed files with 468 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_knowledge-base/backup-vlans.md
+314
View File
@@ -0,0 +1,314 @@
# VLANs Guide
![tagged_vlan_example_diag](https://i.imgur.com/l5IxAKf.png)
### Purpose of VLANs
Separate a network in to smaller segments.<br>
This can improve securirty, ease of managment,
reduce unnecessary chatter that can congest larger networks.
### Hardware
Whats required before thinking about vlans.
* **Managed switches** as oppose to cheaper typical *"dumb switches"*,
as majority of the configuration of vlans is done on switches.<br>
* **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches
that won't break the bank if it's just about 1gbit.
* **Mikrotik** or **Ubiquiti** - usually when in need of something
special, like 2.5gbit with some sfp+ or poe
* **TP-Link** - when just want something cheap, like poe switch for cameras
* A **router/firewall/gateway** device that supports vlans.
This will be the linchpin at the center, with separate settings
for each vlan - being their gateway, providing them with separate dhcp,
applying firewall rules between them,...<br>
* **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense),
installed as a virtual machine, but can be installed on any regular old pc,
or a miniPC with two intel NICs.
* **Ubiquiti UCG-Ultra** - solid go-to recommendation.
<details>
<summary>Reasons...</summary>
* it is **very easy to configure**.
* 100€.
* ok hardware - 4x arm cores, 3GB RAM, informative lcd display, usb-c power.
* full of features - vlans, wireguard VPN, cloud remote managment,
geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
</details>
* **Mikrotik** devices are a good pick, but their configuration can be
overwhelming. I gave up and use just their switches.
<details>
<summary><h3>Some basic networking knowledge is required.</h3></summary>
You should know about IP addresses, Mac addresses, packets, frames,
swiches, routers, about existance of first 4 OSI layers,..
* [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4)
* [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro)
* [CIDR notation](https://youtu.be/z07HTSzzp3o?t=746)
* [Layer 2 vs Layer 3 Switches](https://youtu.be/bdNS0K4Bt8U)
lets put here also vlan stuff
* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8)
* [vlan theory video](https://youtu.be/MmwF1oHOvmg)
* [vlan theory video2](https://youtu.be/JszGeQPTo4w)
* [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept)
* [What is VLAN and how it works](https://www.etherwan.com/support/featured-articles/brief-introduction-vlans)
* [Network Virtualization: Beyond VLANs – Part 1: VLANs](https://infrastructureadventures.wordpress.com/2010/11/13/network-virtualization-beyond-vlans-part-1/)
* [What is PVID? VLAN explained Quick and Dirty](https://forflukesake.co.za/wp/531/vlan-pvid-explained-quick-and-dirty/)
---
---
</details>
### Two types of VLANs
* **Port based**<br>
A simple separation of ports on a switch,
as if you would cut it in to several smaller switches.
This is boring, limiting and generally **useless**,
as you would need to deal with extra cables, extra interfaces, extra hardware..
* **Tag based**<br>
The real deal vlan. At layer2 a **vlan tag** is added to frames.
It contains a **vlan ID** which is a number between 1 and 4094.
These are used to create virtual networks that are separate
from each other but share same hardware, same cables.<br>
The standard is called **802.1Q**.
![frame_pic](https://i.imgur.com/pUq92ky.png)
Some aspects:
* **Tags** are added or removed from **frames** at physical ports,
when entering or leaving switch.
* A tag is 4 bytes in size, contains [several pieces of info](https://i.imgur.com/86zeYgG.png),
the most important being vlan ID.
* **Vlan ID** (VID) is just a number between 1-4094, often picked as
multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN
having it somewhere too.<br>
Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24.
* A **frame** can be tagged only for a **single vlan**,
but a port can belong to many vlans.
* Tagged frames **get dropped** if they would arrive to a regular machine,
not configured for vlans.
### The Core concept
The **absofucking essence** of VLANs is a clear understanding of two types
of ports - untagged and tagged.
![tagged_untagged_traffic](https://i.imgur.com/snTxTyf.gif)
* **Untagged ports**<br>
Called untagged because frames coming in to a switch, or leaving the switch
through that one port are not tagged. So that the end device can actually
communicate without the need to be configured for vlans.<br>
While the inbound frames, the ones entering the switch through this port
are untagged at the moment of entering, they are tagged once inside the switch
according to **PVID** settings for that port, so that they can exit only
through other ports tagged with that same VLAN.<br>
Untagged ports are **used for end user devices** unaware of vlans - computers,
printers, ip cameras, IoT devices,...<br>
These are sometimes called **access ports**, as thats cisco term for them.
* **PVID** - Port Vlan ID<br>
Is a setting on a port. Incoming frames entering switch that are not tagged
get tagged with this PVID number.<br>
It might feel weird that for an untagged port you are setting both VLAN ID
and PVID when VLAN ID should be enough. It feels like duplication of effort...
but its there to solve some hybrid cases.
* **Tagged ports**<br>
Tagged frames going in and out of this kind of ports. Tagged port can carry many
VLANs simultaneously if set so, or can carry just one.
Purpose is to communicate with other vlan aware devices,
like other switches, routers, servers/virtual machines, IP telephones,...<br>
Of note is that setting a port to **vlan 4095** allows all vlans to traverse,
though it can be manufacturer dependent, if its even allowed to set vlan above
`4094`.<br>
* **Trunk port**<br>
A type of tagged port. The term is used for ports that carry multiple vlans,
usually the ones connecting switch with another switch or a server or a router,..<br>
A tagged port that is not a trunk port would be for example a port that carries
just one vlan to a VoIP phone.
* **Native vlan**<br>
Frames belonging to native vlan leave the trunk port untagged.
The initial reason for the existence of this is to allow older dumb switches
to be part of the infrastructure, in between two managed ones.
[Video.](https://youtu.be/Fmq1E1Qr2W4)
# Setting up VLANs on Routers
![vlan_pic_with_dhcp](https://i.imgur.com/nV27IlD.png)
Your vlan aware router wil be the linchpin at the center,
the gateway to the internet for all vlans, the dhpc server for all vlans,
the firewall for all vlans,...
#### The usual generic steps
* creating a new interface or a new network with a specific Vlan ID.
* setting a static IP address / subnet the router will have on that network.
* setting the dhcp pool for for that network.
* maybe enable or restrict the traffic through firewall rules
<details>
<summary><h2>OPNsense - Router</h2></summary>
![opnsense_int](https://i.imgur.com/fz67oJj.png)
[Isolating Networks in OPNsense](https://youtu.be/TjXkWSjYqlM)
* **Add new VLAN**<br>
`Interfaces: Other Types: VLAN`<br>
Add; Device = empty; Parent = **LAN**; VLAN tag = `20`; VLAN priority = default;
Description = `VLAN20WIFI`
* **Assign the new VLAN as an interface**<br>
`Interfaces: Assignments`<br>
Assign a new interface > pick the VLAN from dropbox; Description = `vlan_20_wifi`<br>
Enter the newly created interface, Enable it; IPv4 Configuration Type = `Static IPv4`;
IPv4 address = `10.20.20.1/24`
* **Setup dhcp servis on the new interface**<br>
`Services: ISC DHCPv4: [VLAN20WIFI]`<br>
Enable; From = `10.20.20.50` To = `10.20.20.200`; DNS servers = 10.20.20.1;
Gateway = `10.20.20.1`
* **Firewall rule to enable traffic through**<br>
`Firewall: Rules: VLAN20WIFI`<br>
Source = `VLAN20WIFI net`; save as default is pass and everything
<details>
* [opnsense video](https://youtu.be/LMJeIUDlrHo)
* [pfsense video but applicable](https://youtu.be/SsaGeXx2qh0)
<summary><h5>If running opnsense as a virtual machine.</h5></summary>
![esxi](https://i.imgur.com/uvpF8KC.png)
For VLAN aware devices on the network to get through
* Edit the port group with the opnsense VM LAN interface
and add VLAN ID = `4095`<br>
This will allow all VLANs to get through
For a virtual machine on that ESXI host should be on that VLAN
* Add new port group, to the virtual switch that opnsense uses for LAN<br>
Name = `vlan20`; VLAN ID = `20`
Now you can edit a VM or create new one, set its Network Adapter to `vlan20`
and it should get ip address from the vlan 20 dhcp pool.
This is a good test if stuff works as it should before diving in to configuration
of VLANs on switches.
</details>
</details>
<details>
<summary><h2>Ubiquiti Unifi - Router</h2></summary>
![opnsense_int](https://i.imgur.com/8pPHuX4.png)
Disgustingly simple.
Settings > Networks > New Virtual Network
* set `Name`
* turn off `Auto-Scale Network`
* set `Gateway IP/Subnet` which sets this routers IP on that vlan
* set `VLAN ID` = `20`
* pick if you want guest network or isolation or disable internet access on it
* `DHCP` set pool range
</details>
# Setting up VLANs on switches
There are three settings for a port:
* **PVID** - applies to all <ins>untagged</ins> frames **entering**
the port - ingress. PVID sets vlanID, let's say to `1`
This connects the port with all other ports belonging to that `vlan-1`.
* **Untagged** - similar to PVID but this setting is applied to the frames
**leaving** the port, leaving the switch - egress.
The name `untagged` is telling the whole story - the frames are leaving
the switch <ins>untagged</ins>, the tag is removed before they leave...
and the fact that the port is untagged for `vlan-1` means the port
is connected with all other ports belonging to that `vlan-1`.<br>
Usually a port has the same `PVID` and `Untagged` number set.
* **Tagged** - similar to `untagged`, it is about the frames **leaving**
the port, but this setting is saying that the frames leave with specific
vlan tag, expecting the device connected to this port to be vlan aware.<br>
A port can have both untagged and tagged set.
What happens immediately after you enable VLANs on a switch?
* Everything should still work as before.
* All ports switch to be untagged ports. So they strip any vlan tags from
outbound frames.
* PVID on all ports is set to 1, so that incoming frames get tagged as vlan 1,
so all ports can communicate with each other.
What happens next is you pick a trunk port, the one communicating with the router
or a switch through which multiple vlan goes as set it accordingly to belong to
all vlans.<br>
Then pick which ports have device that should be together and separated from the
rest and set their vland and PVID.
<details>
<summary><h2>TP-Link - Switch</h2></summary>
![tplink_switch](https://i.imgur.com/u0INJ4C.gif)
Got [TL-SG108PE](https://www.tp-link.com/us/home-networking/8-port-switch/tl-sg108pe/)
thats a managed switch with PoE. At the moment the situation
is that opnsense LAN port is connected to port 7 and testing notebook
is connected to port 6.
* VLAN > 802.1Q VLAN > set port 7 as tagged and port 6 as untagged.
* VLAN > 802.1Q PVID Setting > set port 6 with vlan tag 20
Dunno what is the reason there are two settings, they say PVID is setting
specifically to tags incoming frames that come without any tag... but I cant
imagine a situation where one would want different number between these two.
</details>
<details>
<summary><h2>MikroTik - Switch</h2></summary>
![mikrotik_switch](https://i.imgur.com/FMpl9TA.gif)
[a vlan guide](https://forum.mikrotik.com/viewtopic.php?t=143620)
* **Bridge** section is where all the settings are happening.<br>
This setup is simple layer 2, no routing, not doing anything with interfaces.
* Have a **bridge**, create a new one if you have clean config<br>
Assign all the physical ports to this bridge in **Bridge > Ports**
* Define **VLANs** in **Bridge > VLANs** that it should handle.<br>
Set which ports are tagged and which untagged for that vlan
* untagged - **outgoing** frames are normal - access port - PCs, Printers, TVs,..
* tagged - **outgoing** frames are tagged - trunks - servers, gateways, wifi APs,...
* Set **PVIDs** for the ports in **Bridge > Ports**<br>
PVID is about **incoming untagged** frames entering the switch,
what VLAN tag should they get as they move through switch.
By default mikrotik switches give tag 1 to all ports.
* After everything is configured **enable VLAN Filtering** on the bridge itself<br>
**Bridge > Bridge > bridge** > VLAN section
</details>
<details>
<summary><h2>Ubiquiti Unifi - Switch</h2></summary>
![unifi_switch](https://i.imgur.com/Lf2UIY3.png)
</details>
_knowledge-base/mounting_network_share_linux.md
+117 -36
View File
@@ -1,63 +1,144 @@
# Mounting Network Shares in Linux
# Mounting at Boot Network Shares
possible ways to mount stuff - fstab, autofs, systemd, docker volumes if its for docker
Many ways to mount - fstab, autofs, systemd, fuse, gvfs,...<br>
but the current go-to is **systemd mount**.
possible types of shares
There are two distinct ways to mount with systemd
* smb/samba/cifs - the most common share, support on all OS
* nfs - mostly used between linux machines, bit better performance
* iSCSI - the share is mounted as a block device as if it was really a disk,
great performance for small files
* **mount** service is enabled<br>
straight up simple mounting at boot, high expectation that the network share
is always available during the boot, it's simple and easy to control
order of execution, retries, time outs, easy to debug,
best for servers, docker hosts,...
* **automount** service is enabled<br>
the mounting happens at the first demand to access the path,
does not wait during boot for the mount to really happen, less predictable,
can auto-umount on idle, good for users machines
More on setup of these shares is in
[TrueNAS Scale guide.](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/trueNASscale)
# smb/samba/cifs
# Samba / SMB / CIFS
[Arch wiki](https://wiki.archlinux.org/title/samba#As_systemd_unit)
on samba systemd mount
* you will create two files in `/etc/systemd/system`
* one will have extension `.mount` the other `.automount`
* the name will be the same for both and it MUST correspond with the planned
mount path. Slashes `/` being replaced by dashes `-`.<br>
So if the share should be at `/mnt/mirror` the files are named
`mnt-mirror.mount` and `mnt-mirror.automount`
* copy paste the bellow content, edit as you see fit,
changing description, ip address and path, user and password,..
* linux command `id` will show your current user `uid` and `gid`
* after ther changes execute command `sudo systemctl enable mnt-mirror.automount`
This will setup mounting that does not fail on boot if there are network issues,
and really mounts the target only on request
* Have `/mnt/pool` directory ready on the client - `sudo mkdir /mnt/pool`
* will be creating a mount file in `/etc/systemd/system/`<br>
the name MUST correspond with the planned mount location,
just slashes `/` are replaced with dashes `-`<br>
So if the share should be mounted at `/mnt/pool` the file is:<br>
`/etc/systemd/system/mnt-pool.mount`
```ini
[Unit]
Description=Mount MergerFS Pool or Whatever
After=network-online.target
Wants=network-online.target
# Before=docker.service
`mnt-mirror.mount`
```ini
[Mount]
What=//10.0.19.80/pool
Where=/mnt/pool
Type=cifs
Options=rw,username=bastard,password=aaa,uid=1000,gid=1000,file_mode=0664,dir_mode=0775,vers=3,_netdev
[Install]
WantedBy=multi-user.target
```
* enable the mount service `sudo systemctl enable mnt-pool.mount`
* done
### Automount version
If the machine is just an end user PC or a notebook,
or no service really depends on that share being present straight from boot,
or a notebook moves between networks and share is not always there...
we can use automount that mounts the share only when something tries to access
the path.
* disable mount service if already enabled:
`sudo systemctl disable mnt-pool.mount`
* we add another file next to the mount file, named exactly the same,
except the extension is `automount`, so here it would be:<br>
`/etc/systemd/system/mnt-pool.automount`
```ini
[Unit]
Description=Mount MergerFS Pool or Whatever
[Automount]
Where=/mnt/pool
# TimeoutIdleSec=3600 # Unmount after 1 hour idle
[Install]
WantedBy=multi-user.target
```
* we enable this automount service:
`sudo systemctl enable --now mnt-pool.automount`
* done
### Useful commands
`smbclient -L 10.0.19.11` - list shares mounted from the ip<br>
`systemctl list-units -t mount --all`
# NFS
[Arch wiki](https://wiki.archlinux.org/title/NFS#As_systemd_unit)
on NFS systemd mount
All the stuff regarding mount vs automount from Samba section above applies,
only the content of the systemd unit files changes.
`/etc/systemd/system/mnt-pool.mount`
```
[Unit]
Description=3TB truenas mirror mount
Description=Mount MergerFS Pool or Whatever
After=network-online.target
Wants=network-online.target
[Mount]
What=//10.0.19.11/Mirror
Where=/mnt/mirror
Type=cifs
Options=rw,username=kopia,password=aaa,file_mode=0644,dir_mode=0755,uid=1000,gid=1000
What=10.0.19.80:/mnt/pool
Where=/mnt/pool
Type=nfs
Options=vers=3
[Install]
WantedBy=multi-user.target
```
`mnt-mirror.automount`
```ini
`/etc/systemd/system/mnt-pool.automount`
```
[Unit]
Description=3TB truenas mirror mount
Description=AutoMount MergerFS Pool or Whatever
Requires=network-online.target
After=network-online.target
[Automount]
Where=/mnt/mirror
Where=/mnt/pool
TimeoutIdleSec=0
[Install]
WantedBy=multi-user.target
```
### Useful commants
`smbclient -L 10.0.19.11` - list shares mounted from the ip
`systemctl list-units -t mount --all`
Enable the mount service: `sudo systemctl enable --now mnt-pool.mount`<br>
Or for automount `sudo systemctl enable --now mnt-pool.automount`
# Windows Client
### Samba - windows
just mount it or map it as a letter
### NFS - windows
For Windows NFS clients, write access often requires `all_squash`
with a defined anonuid/anongid, because Windows does not send linux uid/gid
information. Something like this:<br>
`/mnt/pool 10.0.19.0/24(rw,async,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=1)`
**Windows Client**
* must be windows pro, not windows home
* add windows component in the control panel - `Services for NFS` - `Client for NFS`
* cmd, not powershell - `mount \\10.0.19.80\mnt\pool N:`
_knowledge-base/vlans.md
+37 -10
View File
@@ -4,8 +4,9 @@
### Purpose of VLANs
Separation of a network in to smaller segments.<br>
This can improve securirty, ease of managment, latency in larger networks.
Separate a network in to smaller segments.<br>
This can improve securirty, ease of managment,
reduce unnecessary chatter that can congest larger networks.
### Hardware
@@ -13,13 +14,18 @@ Whats required before thinking about vlans.
* **Managed switches** as oppose to cheaper typical *"dumb switches"*,
as majority of the configuration of vlans is done on switches.<br>
* **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches
that won't break the bank if it's just about 1gbit.
* **Mikrotik** or **Ubiquiti** - usually when in need of something
special, like 2.5gbit with some sfp+ or poe
* **TP-Link** - when just want something cheap, like poe switch for cameras
* A **router/firewall/gateway** device that supports vlans.
This will be the linchpin at the center, with separate settings
for each vlan - being their gateway, providing them with separate dhcp,
applying firewall rules between them,...<br>
* **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense),
installed as a virtual machine, but can be installed on any regular old pc,
or a miniPC with two NICs.
or a miniPC with two intel NICs.
* **Ubiquiti UCG-Ultra** - solid go-to recommendation.
<details>
<summary>Reasons...</summary>
@@ -29,15 +35,14 @@ Whats required before thinking about vlans.
* full of features - vlans, wireguard VPN, cloud remote managment,
geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
</details>
* **Mikrotik** devices are a good pick, but their configuration can be
* **Mikrotik** devices are a good pick, but their configuration can be
overwhelming. I gave up and use just their switches.
<details>
<summary><h3>Some basic networking knowledge is required.</h3></summary>
You should know about IP addresses, Mac addresses, packets, frames,
swiches, routers, about existance of first 4 OSI layers,..
You should know about IP addresses, Mac addresses, packets, **frames**,
swiches, routers, about existance of the first 4 OSI layers,..
* [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4)
* [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro)
@@ -46,6 +51,7 @@ swiches, routers, about existance of first 4 OSI layers,..
lets put here also vlan stuff
* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8)
* [vlan theory video](https://youtu.be/MmwF1oHOvmg)
* [vlan theory video2](https://youtu.be/JszGeQPTo4w)
* [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept)
@@ -83,13 +89,15 @@ Some aspects:
multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN
having it somewhere too.<br>
Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24.
* A **frame** can be tagged only for a **single vlan**,
but a port can belong to many vlans.
* Tagged frames **get dropped** if they would arrive to a regular machine,
not configured for vlans.
### The Core concept
The **absofucking essence** of VLANs is a clear understanding of two types
of ports - untagged and tagged.
of traffic - untagged and tagged.
![tagged_untagged_traffic](https://i.imgur.com/snTxTyf.gif)
@@ -120,7 +128,7 @@ of ports - untagged and tagged.
`4094`.<br>
* **Trunk port**<br>
A type of tagged port. The term is used for ports that carry multiple vlans,
usually the ones connecting two switches, or a switch and a router.<br>
usually the ones connecting switch with another switch or a server or a router,..<br>
A tagged port that is not a trunk port would be for example a port that carries
just one vlan to a VoIP phone.
* **Native vlan**<br>
@@ -140,7 +148,7 @@ the firewall for all vlans,...
#### The usual generic steps
* creating a new interface or a new network with a specific Vlan ID.
* setting what IP address / subnet the router will have on that network.
* setting a static IP address / subnet the router will have on that network.
* setting the dhcp pool for for that network.
* maybe enable or restrict the traffic through firewall rules
@@ -218,6 +226,25 @@ Settings > Networks > New Virtual Network
# Setting up VLANs on switches
There are three settings for a port:
* **PVID** - applies to all <ins>untagged</ins> frames **entering**
the port - ingress. PVID sets vlanID, let's say to `1`
This connects the port with all other ports belonging to that `vlan-1`.
* **Untagged** - similar to PVID but this setting is applied to the frames
**leaving** the port, leaving the switch - egress.
The name `untagged` is telling the whole story - the frames are leaving
the switch <ins>untagged</ins>, the tag is removed before they leave...
and the fact that the port is untagged for `vlan-1` means the port
is connected with all other ports belonging to that `vlan-1`.<br>
Usually a port has the same `PVID` and `Untagged` number set.
* **Tagged** - similar to `untagged`, it is about the frames **leaving**
the port, but this setting is saying that the frames leave with specific
vlan tag, expecting the device connected to this port to be vlan aware.<br>
A port can have both untagged and tagged set.
What happens immediately after you enable VLANs on a switch?
* Everything should still work as before.