this post was submitted on 20 Dec 2024
24 points (96.2% liked)

Selfhosted

60482 readers
838 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
24
Need some advice on caddy + podman + preserving source IPs (lemmy.ca)
submitted 2 years ago* (last edited 2 years ago) by bigdickdonkey@lemmy.ca to c/selfhosted@lemmy.world
3 comments fedilink hide all child comments
 

Edit: If anyone comes across this post, use the built-in socket activation provided in caddy 2.9+ https://github.com/eriksjolund/podman-caddy-socket-activation/

I have rootless podman containers all connected a network with caddy that proxies them by their hostname. It seems that the default networking mode doesn't preserve the source ip and instead shows all traffic coming internally from 10.89.1.98. Preserving that ip requires pasta/slirp4netns which is incompatible with adding the container to a network. I've found a few solutions but I'm having trouble deciding what is the right way to move forward.

Using the host network or running caddy with host loopback abilites

Would require exposing all the ports on all my containers which means I would lost the ability to access containers by the DNS inside the podman network. I have a lot of containers and manually managing ports is not something I want to do again.

socket activation + libsdsock with caddy

Socket forwarding done using systemd. I've tested it and it works but it requires systemd on the container, and caddy is built on alpine which uses a different boot system. There are ways to get the systemd libs on alpine but it would be quite hacky.

socket activation + libsdsock with another os

Caddy provides ways to build with extensions on debian but it seems tricky to do in a Containerfile because systemd init issues.

Has anyone experienced this issue before? What direction did you take?

all 4 comments
sorted by: hot top controversial new old
[–] magikmw@lemm.ee 4 points 2 years ago (1 children)

Please confirm for me, the client traffic looks like proxy is the source on the containered services?

I haven't had that issue with caddy before, but may be I'm using some particular config to make sure it always passes the client IP.

Some services also need a setting to "know" they are behind a proxy and should look for client address in the headers like x-forwarded-for.

[–] bigdickdonkey@lemmy.ca 2 points 2 years ago* (last edited 2 years ago) (1 children)

Yeah the remote ip is always local. This comes from a podman configuration, not a caddy one. Setting the podman network mode to pasta or slirp4netns will show the proper remote ips

[–] magikmw@lemm.ee 2 points 2 years ago

Yeah I see. I don't know if I can help, as I've only used caddy outside of podman, as a separate machine, pointing back to my services.