Submitted 4 days ago by ohshit604@sh.itjust.works to selfhosted@lemmy.world
Evening y’all
I’ll try to keep it brief, I need to move my reverse proxy (traefik) to another machine and I’m opting to utilize Docker Swarm for the first time this way I’m not exposing a bunch of ports on my main server over my network, so ideally I’d like to have almost everything listening on local host while traefik does it’s thing in the background
Now I gotta ask, is Docker Swarm the best way to go about this?
I’ve worked with Swarm in a startup setting. It was an absolute nightmare. We eventually gave up and moved to Kubernetes.
That said, your use case does sound simpler. As I recall, we had to set up service discovery (with Hashicorp Consul) and secret management (with Hashicorp Vault) ourselves. I believe we also used Traefik for load balancing. There were other components as well, but I don’t remember it all. This was over 5 years ago, though.
The difficulty wasn’t configuring each piece but getting them to work together. There was also the time burned learning all the different tools. Kubernetes is great because everything is meant to work together.
But if it’s just two machines with separate configuration, do you even need orchestration? Is there a lot of overhead to just manage them individually?
Unfortunately, it was too long ago to remember the details of differences between compose and swarm. I do remember it was a very trivial conversion.
I ran swarm in a homelab and ended up switching back. I don’t remember all the details I had issues with, but be aware of quorum. Here is the link to high availability docs. If one of the nodes goes down then you can’t do anything with the other. I also had issues getting everyone back online when one went down (with only two). I had three nodes, but one failed and I didn’t replace it. If one of the remaining two went offline I had to manually setup the swarm again each time. I found it to be a hassle because I didn’t have enough need for multiple nodes and high availability.
I now use Pangolin (Underlying traefik) on a VPS which VPNs back into my home where I host the sites. I have the VPN on it’s own proxmox container in the same VLAN as my servers.
I have used Docker Swarm in my homelab for years without big issues, you just have to be aware of its limitations. For example, I use SWAG for my reverse proxy and it works better as a compose deployment on an individual docker node because then it can identify incoming IPs. All of the backend communication runs on internal networks, which helps isolate them.
I like using Swarm at home because it is simple and easy while providing good scalability and security (yes, I know podman would be more secure, but I haven’t taken that plunge yet).
That being said, Docker Swarm isn’t used in the industry much. So if you are looking to expand on your IT skills, K8s is the way.
thegreekgeek@midwest.social 1 day ago
Well first off swarm doesn’t work with environment variables, so if you pass any in you’re going to need to pipe the output of docker compose read into docker swarm service create.
Your port settings are gonna give it a problem too, swarm doesn’t support that new syntax, and as a result you can only assign a single network interface to a service.
Regarding networking, since the whole paradigm is that you’re not defining a single container but a service that can live/move across multiple nodes; any traffic to any node in your swarm will be routed (round robin style) across the copies of that service. (This makes logging setup a PITA, ask me how I know!)
Bind mounts aren’t recommended, volumes are preferred. Otherwise everything needs to be mirrored across all nodes, depends on the use case.
That being said I’m not convinced that swarm is the right answer here, I concur with @talentedkiwi@sh.itjust.works. You should just install pangolin on your second machine.