Tagged VLANs would be needed regardless, because I have only one server with one physical connection and I wanted to have processes on it on 2 different networks.
Docker is neither here nor there, you’re right it’s not needed for the solution. I was using it anyway, I know lots of selfhosters do, and it does make it easy to create an ipvlan and put an app on it.
Docker is not the only way to achieve containerization but I do appreciate and use containerization (and virtualization). It lets the host OS stay simpler and cleaner and prevents the various apps from messing with it. It makes it easy to control each app’s environment. You can do app containers, system containers or VMs as needed. It makes it easy to back up, restore and reproduce an app and its state, independently of the host OS or any other app.
Abstractions help… they empower you to do more. You invest some time into learning, sure, but it pays off later in time saved managing and the ability to do more complex stuff faster.
Troubleshooting is what it is. Nothing’s perfect, you’re going to end up troubleshooting something sometime not matter what you use.
GreenKnight23@lemmy.world 1 day ago
@> A. Do you absolutely NEED the VLAN for your NVR? Why not just isolate the devices on the network with a bogus DNS record or FW rule blocking via MAC or IP?
DNS doesn’t stop direct IP comms. I have seen a few devices that talked direct IP to bypass DNS blocks. as you said, a firewall rule is a far better solution.
However, I don’t trust my Chinese cameras enough to not rootkit their way across my network, so it has to be quarantined. a VLAN is one way to successfully do that.
personally I dislike the high maintenance costs of VLANs. That’s why I opted to run a completely different network for all my IOT devices including cameras. the DVR is on that network and proxied through a dual homed server that straddles the two networks. firewall rules in place that only allow specific ports through on specific devices to specific devices.
corsicanguppy@lemmy.ca 1 day ago
Said no one ever, until now.
GreenKnight23@lemmy.world 1 day ago
a VLAN is assigned to a specific port on the same subnet.
now I have to know which port is for that VLAN specifically.
now I have to segment my network to ensure I know which IPs are on that VLAN.
now I have to statically assign IPs.
now I need to replace my router and rebuild everything.
or I setup a separate network on a different subnet with firewall rules to ensure nothing can talk to anything outside of the private network and let dhcp do assignments.
hmmmm…which one is easier to maintain… I wonder…
VLANs literally exist because it would be too costly to run dedicated networking hardware in enterprise solutions. from a networking perspective in a selfhosting or small business environment VLANs are overkill and high maintenance.
unitedwithme@lemmy.today 1 day ago
On older hardware I would agree it can be cumbersome. At work, I’ve swapped everything to Ubiquiti and it’s a couple clicks and I’m there. I liked it so much I did it at home with some caveats. Local account only and blocking anything phoning home.
I’ve got Chinese cameras too, they’re on their own VLAN,ext traffic is blocked simply.