DNS Management Advice

Submitted ⁨⁨2⁩ ⁨months⁩ ago⁩ by ⁨___@lemm.ee⁩ to ⁨selfhosted@lemmy.world⁩

I’m running opnsense on proxmox with some lxc containers and docker hosts.

I’ve never done internal DNS routing, just a simple DMZ with Cloudflare proxies and static entries for some external services. I want to simplify things and stop using my IPs from memory internally.

For example, I have the ports on my docker hosts memorized for the services I use, only a couple mapped hosts in opnsense, but nothing centralized.

What is the best way to handle internal DNS name resolution for both docker and the lxc containers? Internal CA certs? External unroutable (security)?

Any tips and setups appreciated.

source

Comments

Sort:hotnew top

just_another_person@lemmy.world ⁨2⁩ ⁨months⁩ ago
Focus on DNS for the host machine and it’s port mappings, not the individual containers.

If you’re instead asking “How can I easily map a DNS name to service and port?”, then you want a reverse proxy on your host machine, like nginx (simplest) or Traefik (more complex).

In the latter scenario you setup a named virtual host for each service that maps back to the service port exposed for your containers. Example: a request for jellyfin.localdomain.com points to the host machine, nginx answers the request and maps the host name in the request, then proxies your session to the container.

It’s copy and paste for the most part once you get the first one going unless you’re dealing with streaming.

source
CallMeButtLove@lemmy.world ⁨2⁩ ⁨months⁩ ago
I have a similar setup except I use pfSense as my router and pihole for DNS, but I’m sure you can get the same results with your setup. I’m running HAProxy for my reverse proxy and configs for each of my docker containers so any traffic on 443 or 80 gets sent to the container IP on whatever unique port it uses. I then have DNS entries for each URL I want to access the container by, with all of those entries just pointing to HAProxy. Works like a charm.

I have HAProxy running on the pihole itself but there’s no reason you couldn’t just run that in it’s own container. pfSense also let’s you install an HAProxy package to handle it on the router itself. I don’t know if opensense supports packages like that though.

You can even get fancy and do SSL offloading to access everything over HTTPS.

source