LXD FTW

Tonight I got Ubuntu 18.04 installed on my Intel NUC (a very tiny computer with lots of power and disk space). I connected my Mac’s Ubuntu VM to the NUC’s VM, and migrated my LXD containers over the network to the NUC. The NUC is installed next to my AT&T fiber router, so it gets the full 1Gbps fiber speed, where as my Mac is limited my the ethernet-over-power adapters to around 75 Mbps.

This is awesome, and eliminates my Mac and the wireless internal networking in this house as a single point of failure. Since the NUC has a 2TB disk, I can even create a 1TB backup volume to run Time Machine backups from both our Mac computers. I have the VM for that already.

whistl.com fixed

For a few days, I was decieved into thinking my Mac’s ethernet port had died. It could detect the network cable was plugged in, but was not receiving any IP traffic at all. It wasn’t until today that I realized it was actually my ethernet-over-power adapters that had become disconnected. Once I reset and reconfigured them, everything started working again.

During the week or so they had failed, my home DNS master server was unable to reach my internet-based secondary servers, so all of my domains went completely offline, which resulted in my being unable to send or receive any email.

I need to work on a more robust DNS setup, so my home network is no longer a single point of failure.

New Turntable – AT-LP120

For my birthday, I received several 33-1/3 rpm LPs. But we didn’t have a turntable to listen to them. So, I did a little research and ordered a nice turntable, the audio-technica LP-120. It’s way heavier and fancier than I imagined, but I really like it. The thing that attracted me most was the direct drive motor.

And I love my new albums – Fragile: Yes, Rick Wakeman: The Six Lives of Henry VIII, Jesus Christ Superstar: The Original Broadway Soundtrack. I know I have Rolling Stones Sticky Fingers somewhere around here.

Limitations of LXD and DNAT

I am learning of some limitations of using LXD to containerize apps. I mean, LXD is nice, and it works great as designed. I have tried the default configuration, with lxdbr0 bridge and filesystem backing, and found I get more use out of one where I run the host’s ethernet interface as a slave to bridge br0, and add br0 (unmanaged) to the LXD default profile instead of lxdbr0, so each container gets peer level networking on it’s host. I also attach an external disk as LVM backing for LXD, so each of my containers get take advantage of LVM snapshots.

You have to be careful with firewall rules with LXD, but you do have the option of 1) simple ufw rules on each container, or 2) host level ufw rules that control all the forwarding. You already have to add some lines to /etc/ufw/before.rules and before6.rules, to NAT all outbound IP traffic and DNAT inbound ports to services you run. I found the DNAT rules painful for IPV6 addresses, and think I probably need to enable both DHCP6 support, and static IP v4 and v6 addresses for each container.

Or, I could go old school, rebuild the host and isntead of LXD, run LXC version 1 to containerize the applications using the host’s native IP network stacks, meaning no NAT or DNAT will be needed. Just plain simple ufw rules at the host level. LXC is more complex to setup, but is more flexible in some ways.

Or, I could go REALLY old school, and do it 80s style, where postfix, mysqld, and nginx all run native on the host. The absolute least amount of overhead, only 1 set of iptables rules, which might make more sense on a 1 vcpu/1 GB RAM/25 GB disk VPS, but somewhat less secure.