• 0 Posts
  • 3 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle


  • Home

    Firewall / OpenBSD running on APU2

    • Wireguard (only thing open to the public)
    • IPSec site-to-site to Oracle cloud (only open for Oracle VPN GW IP)
    • NSD for authoritative DNS
    • Unbound for DNS filtering (unbound adblock script)
    • script that updates my public IP to DNS provider should it change

    Containers / Debian running on Asus PN62

    • Portainer for controlling local Docker as well as one in the Oracle Cloud
    • certbot with DNS auth to get certificate for local services, this way I don’t need to open anything to the Internet
    • Traefik as reverse proxy configured via labels

    Cloud

    Cloudflare

    • This is in front of public services
    • Public DNS

    Oracle Cloud

    • Free tier server (4x vCPU, 24GB RAM) with Docker, Traefik, Portainer agent
    • IPSec from home so I can control Docker on my cloud server

    Azure

    • Azure blob storage for backups (Restic)

    Everything is separated as much as I can. All stacks are on separate networks with strict firewall rules (iptables) on host to control which container can talk to others. For example Traefik can talk to Gitea but not vice versa. Everything on physical network is separated by VLANs.