60 lines
1.4 KiB
Markdown
60 lines
1.4 KiB
Markdown
# Topology
|
|
|
|
Every VM is a Docker host. Proxmox and Cloud-Init only create the machine and
|
|
bootstrap Ansible; service placement is controlled by inventory.
|
|
|
|
## Edge VM
|
|
|
|
The edge VM runs:
|
|
|
|
- Docker
|
|
- Traefik
|
|
- authentik IAM
|
|
|
|
It publishes Traefik entrypoints on host ports `80` and `443`. authentik can run
|
|
behind the same local Traefik instance by setting:
|
|
|
|
```yaml
|
|
nbops_service_routing_mode: traefik
|
|
authentik_domain: auth.example.invalid
|
|
```
|
|
|
|
## Downstream VMs
|
|
|
|
Downstream VMs also run Docker. Instead of publishing each application port on
|
|
the host, run Traefik on the VM and attach application containers to the shared
|
|
Docker proxy network.
|
|
|
|
```yaml
|
|
nbops_roles:
|
|
- base
|
|
- ssh
|
|
- ufw
|
|
- updates
|
|
- docker
|
|
- traefik
|
|
- gitea
|
|
- immich
|
|
|
|
nbops_service_routing_mode: traefik
|
|
nbops_traefik_entrypoint: web
|
|
nbops_traefik_tls: false
|
|
```
|
|
|
|
In this mode application roles do not publish their HTTP ports. They render
|
|
Traefik labels and join `nbops_proxy_network`, which defaults to `proxy`.
|
|
|
|
Only Traefik entrypoints should be exposed on the downstream host firewall. Use
|
|
`traefik_bind_address` to bind those entrypoints to the VM's internal address.
|
|
|
|
## Routing Modes
|
|
|
|
Application roles support:
|
|
|
|
- `host`: publish application ports directly and open those ports in UFW.
|
|
- `traefik`: do not publish HTTP ports; attach to Traefik and render labels.
|
|
|
|
Gitea is special: HTTP can be routed through Traefik while SSH remains published
|
|
with `gitea_publish_ssh: true`.
|
|
|