61 lines
3.5 KiB
Markdown
61 lines
3.5 KiB
Markdown
# Prod: ks4
|
||
|
||
Incus host at OVH — public-facing self-hosted services.
|
||
|
||
- Debian 13, Xeon D-1521 / 32 GiB, 2× 6 TB (OS on mdraid RAID1,
|
||
ZFS pool `data` on `sda5`) — setup & rebuild:
|
||
[install.md](install.md)
|
||
- SSH: `ssh -i id_rsa_claude -p 2233 julien@193.70.35.17`
|
||
(`julien` has passwordless `sudo incus …`, including
|
||
`sudo incus exec …`; the backup crons themselves run as root)
|
||
- Instances are on a NAT bridge `incusbr0` (192.168.1.0/24); public
|
||
ingress via Incus proxy devices. `gateway` (nginx) is the sole HTTP/S
|
||
entry point and fans out to the app containers.
|
||
- OS inventory: `incus list -c n,config:user.os,config:user.os-checked`
|
||
— refreshed by `incus-container-upgrade.sh` (`-o` for metadata only).
|
||
`image.description` shows the *creation* image (2019 for most), not
|
||
what the container runs today.
|
||
- Services: gateway, mail, nextcloud, seafile, git, freshrss, bitwarden,
|
||
outline, login (SSO), wireguard, + more — full table in
|
||
[install.md](install.md).
|
||
- ⚠️ The ZFS `data` pool is single-disk (not mirrored); durability
|
||
rests on nightly cron jobs — 01:00 `incus copy --refresh` of all
|
||
instances to the local `backup` pool on sdb5, then the instance leg
|
||
to S3; 05:00 restic (DB dumps + data trees) to S3; nuc pulls the
|
||
replicas over WireGuard. Full picture and restore procedures:
|
||
**[backup-strategy.md](../backup-strategy.md)**
|
||
([local-backup-cron.md](local-backup-cron.md),
|
||
[incus-copy.md](incus-copy.md),
|
||
[restic-backup.md](restic-backup.md)).
|
||
|
||
## Network flows (nuc ↔ ks4)
|
||
|
||
```
|
||
nuc — home LAN 192.168.0.0/24 ks4 — OVH 193.70.35.17
|
||
+-----------------------------------+ +-------------------------------------+
|
||
| | | |
|
||
| host: wg-ks4 (10.8.0.20) | | [wireguard] 192.168.1.18 |
|
||
| incus remote "ks4" ------+--WG-->| wg0 10.8.0.1/24, udp 51845 |
|
||
| pull ks4:* -> pool ks4backup | udp | | masquerade -> eth0 |
|
||
| on usb4t [pending FTTH seed] | 51845 | | |
|
||
| | | +-> incus API 192.168.1.1:8443 |
|
||
| [transmission-bt] wg0 (10.8.0.21) | | | (ufw: only from .18) |
|
||
| full tunnel 0.0.0.0/0 ------+--WG-->| | |
|
||
| kill switch: no default route | udp | +-> WAN egress: torrents + |
|
||
| downloads -> /srv/media | 51845 | apt of transmission-bt |
|
||
| (usb4t/media, read by jellyfin) | | exit as 193.70.35.17 |
|
||
| | | |
|
||
| 03:00 instance snapshots | | 03:00 instance snapshots |
|
||
| 03:30 incus-copy: all instances | | 01:00 incus-copy: all instances |
|
||
| -> project backup, pool | | -> project backup, zpool sdb5 |
|
||
| nucbackup (usb4t/backup/nuc) | | then restic instance leg -> S3 |
|
||
| 05:00 pull ks4:* -> ks4backup | | 05:00 restic: DB dumps + data |
|
||
| [pending FTTH] | | trees -> S3 (restic-data) |
|
||
| 05:30 apt upgrade all containers | | Sun 14:00 restic maintenance |
|
||
+-----------------------------------+ +-------------------------------------+
|
||
phones/laptops: WG peers 10.8.0.2-3 reach 192.168.1.x through the same endpoint
|
||
```
|
||
|
||
Both tunnels initiate **from** nuc (home NAT, dynamic IP) toward ks4's
|
||
fixed endpoint; ks4's incus API is never exposed to the internet.
|