• 0 Posts
  • 20 Comments
Joined 3 years ago
cake
Cake day: June 3rd, 2023

help-circle


  • All my services run in podman containers managed by systemd (using quadlets). They usually point to the :latest tag and I’ve configured the units to pull on start when there is a new version in my repository. Since I’m using opensuse microos, my server (and thus all services) restart regularly.

    For the units that are configured differently, I update the versions in their respective ansible playbooks and redeploy (though I guess I could optimize this a bit, I’ve only scratched the surface of ansible).


  • What I’m reading is that you want site-to-site connectivity. Wireguard + possibly dynamic DNS makes this pretty easy (assuming you can open ports and configure NAT at your sites). Or you could set up some other VPN solution like OpenVPN.

    There’s also tailscale (a paid service) for facilitating the wireguard setup, NAT traversal and relaying. headscale is a self hosted solution that aims to provide something similar (but more limited in scope).




  • I’m also using caddy with desec.io. When first triggering the challenge for an entry, it can fail a couple of times. I think it just takes a while for the DNS entry to be available.

    Another thing that I’ve experienced is that I can’t use wildcard subdomain entries. My guess is that it’s somehow because I only have public IPv6 addresses (but I don’t remember the details). I have configured an internal DNS with the wildcard entry since I’m only ever connecting to that host via wireguard from outside my network. For the host itself I’ve created a regular AAAA record.