Added Adguard #16
No reviewers
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: redbeardymcgee/podbox#16
Loading…
Add table
Reference in a new issue
No description provided.
Delete branch "features/adguard"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Couple of questions before this one merges.
Is this problem solved after
passt
orpasta
becomes the default? Right now I'm running withslirp4netns
because on AlmaLinux my podman is still on 4.x. I actually have compiled 5.x from source to test socket activation, so I triedpasta
a bit. I know it works, but I have to finesse it on boot to start my containers because something comes up in the wrong order and there's no network when the containers try to start. I'm really not sure what all was going wrong yet. I think on a distro like fedora instead it might be working normally.Anyway, it's supposed to support source ip mapping. Are you running a version of podman/adguard/pasta where we could try that out? Maybe it can get rid of this note.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
Is this port mapping mismatched because your environment already uses port 80 for something else? Or is this an upstream example like from their compose file? I would like to avoid mapping ports around if possible to make it easier to drop in a single quadlet with no quirks.
@ -0,0 +19,4 @@
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
PublishPort=8443:443/tcp
i guess you can't mark a range of lines to comment on, but see above.
I will test this today I have a load balanced setup so I can test on my failover node.
podman version 5.2.2
If you omit the
Network
completely and expose the ports as normal (note I changed 80 to something else as its in use on the host) it works and shows up correctly as you can see it defaults to pasta networking and is fully operational.@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
This is because these ports are in use, anyone running Nginx, OpenResty, Apache etc will have to do this.
Changes made to remove host networking and moved to pasta.
That's awesome! I don't have a setup that can test as well as you just did yet so thanks for clearing that so quickly.
I guess we should leave it as it is for now, because my proof of concept is running 4.x still, and that's what my other setup document is based on. I need to find a way to set a reminder to change this note once I have the setup doc in better shape, and using 5.x by default.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
Okay this is a common issue when running multiple web servers. In my setup, I do not expose any ports except
80
and443
with Caddy as a reverse proxy in front of all my containers. I want to try to make such a setup explicit and easy for people. My Caddyfile has a bunch of simple blocks like:In fact, I do not use the
PublishPort
setting at all on mine, except exactly80
and443
forcaddy.container
. I don't see a better way to solve this problem of port map mazes. What do you think?You already submitted the change for this, so I'll just take your updated version. I didn't notice you had put that together before I got up this morning.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
I generally agree 100% in most use cases, however I feel adguard and pi-hole would be the exception to the rule here as most people run these locally within the network rather than exposing them and have them handle dns requests etc directly rather than having a middle man proxy involved, as if caddy goes down you would forfeit all dns.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
I probably still need to correct some of my other quadlets, but in this repo I'd like to show the upstream defaults as much as possible for the basic quadlet service. In advanced examples, I will add documentation regarding how to overcome port conflicts.
Does that make sense to you? I'm not asking you to add a commit, just curious if my idea sounds okay to someone who isn't myself.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
Additionally, the reverse proxy is only for the web ui frontends on ports
80
and/or443
. The dns will still be handled without any proxying.@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
Yeah that makes sense, if you want to keep it simple and have it run through a proxy, my only gripe would be that most people wont want to proxy a dns server and keep it local :)
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
The proxy only applies to the frontend for the web ui. It won't affect the dns server or any other services.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
So you would say omit the 80 and 443 port publishing from the quadlet here and have the proxy handle only that portion? How would the proxy communicate with the adguard container on internal ports, in podman 5+ if you dont enable a
Network=
it will default to a pasta network driver so there will be no exposed ports for you communicate with.@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
Publish 80:80 and 443:443 (and maybe
443:443/udp
). It's not feasible to remap those ports for every quadlet under the sun, right? If there are port conflicts, that is an issue that you have to resolve in your local environment. You can either remap them yourself, downstream in your local env, or you can proxy and/or load balance them. The main thing is that's not something an upstream example should define.However, as i said, I am working on advanced examples to demonstrate and document how to handle port conflicts among other common issues, such as re-using quadlets for different needs like running two
postgres
instances for different purposes.Also, if you are remapping 80 and 443 often in your setup, I recommend putting caddy in front of it. You don't need a public domain. You can use it on your LAN just as effectively without exposing it to the web. Plus you can re-use the
Network=
key multiple times, so you can join 1 caddy instance to multiple networks. That caddy can then route you to all your web guis with a simple config, by container or host name. There are lots of ways to solve this problem, unless you just prefer to remap your host ports. You'll run out of ports eventually and have to start creating new virtual network interfaces to map more ports :PI still need to work on unifying all the example quadlets and make sure they are all similarly formatted, so I am happy to accept this as-is. I will deal with the port mapping issue once I nail down how everything should look.
@ -0,0 +18,4 @@
PublishPort=784:784/udp
PublishPort=853:853/tcp
PublishPort=3000:3000/tcp
PublishPort=8844:80/tcp
That would work by joining caddy to multiple networks without exposing ports, but most of the quadlet examples arent using defined networks so podman 5.0 defaults to pasta which means caddy has no networks to join to and therefore cant communicate with the containers ports internally through podman networks?
Thanks again for all your contributions @sudo-kraken . It was incredible to discover some new services, and I really appreciate the work you put in to tidy them all up too.
No problem at all, I will keep contributing when I add new services or learn new things 👍