Nowhere do I see mention of how to update and upgrade this thing after initial deployment... How does it work ?
Sovereign: Ansible playbooks to build and maintain your own private cloud
121–130 of 145 posts
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#122Earlier quoted context omitted.
Sovereign can be used as is to create linux container with LXD without any changes. You can create container image and than use it across your immutable infrastructure. Don’t waste time in Docker, for this purpose use lxd containers [1]. LXD containers are more secure than docker in general and provide support for unprivileged containers for over 5 years. You can use your ansible scripts to create and manage your con…
Come on. I like LXD, and I used it before docker. Docker is a standard and community. You can find prebuilt containers online and layer your own additions with a single configuration line. Don’t get me wrong, Docker has made some stupid technology decisions, but the network effect of so many adopters means that it should be the default choice for any container situation.
> You can find prebuilt containers online and layer your own additions with a single configuration line.
That's the kicker that got them over the line. Look at usage graphs and docker is running circles around Linux containers. I use docker professionally but privately will use lxd barring some complicated setups that are a docker pull away.
Truly can't stand some of their design choices, eg the utter distain for iptables and even non-technical ones like requiring signup to get the daemon on Windows/Mac, it's frustrating software overall whose only saving grace is the ecosystem around it.
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#123This is a pretty cool setup! I have been tinkering in the self-hosting world for awhile now and I would say my biggest piece of advice is to learn Docker. (Not trying to shill for Docker here or start a Docker vs. Ansible flame war.) In my personal experience, Docker images (and docker-compose orchestrations) are more pervasive than Ansible playbooks and when it comes to self-hosting for personal use, hosting all my…
> I would say my biggest piece of advice is to learn Docker. (Not trying to shill for Docker here The first step to learning Docker by downloading it, irritatingly, is that getting Docker Desktop on Mac or Windows requires creating a Docker Hub account and signing in! There’s even a long issue thread about this on GitHub and the response was totally irrelevant! Luckily for those who don’t want to jump through these h…
I remember when they changed that and the GitHub issue was one of the most hilarious examples of corporate doublespeak.
"Why are you doing this?"
"To improve user experience"
"But now I have to sign up for an account whereas before I could just download"
"Yes this will improve the experience for everyone over time"
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#124Earlier quoted context omitted.
> ...the network effect of so many adopters means that it should be the default choice for any container situation. People assume that just because Docker and lxd do "containers", they are somehow equivalent and it's simply a matter of choosing between the two. But they are far from equivalent. It's not a choice between two competing technologies that achieve the same goal at all.
That’s what I wanted to say docker is only designed with specific goal to have one process running per container. So to run a system like Sovereign will need many many containers, one each for each daemon and then environment variables for each config settings. It’s a nightmare to manage. LXD is designed for multi-process with proper init and do not suffer zombie process problem of docker and unlike Docker supports u…
What makes it a nightmare to manage? My guess is it's all about how you do the declarative config, that fight is age old: http://mikehadlow.blogspot.com/2012/05/configuration-complex...
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#125Nice resource, will definitely give it a spin, also this is the first time I've ever come accross `Tarsnap` looks really interesting too !
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#126Earlier quoted context omitted.
> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running applications in isolation, while Ansible is for provisioning and configuring hosts. For instance, you won't use Docker to harden sshd on your hosts but Ansible.
Yet they are both security disasters.
How is docker container, running a process as unprivileged user with reduced capabilities security disaster? With Kubernetes you can even have network policy or service mesh with mTLS. Compare it to bunch of bare processes running on the same machine, lots of services listening on localhost, difficult updates due to different dependency version requirements by different software, requiring you do the manual, painful update only once a year. It may look bad at first, but container can be far more secure that common non-container environments. It's always matter of configuration and maintenance.
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#127This is a pretty cool setup! I have been tinkering in the self-hosting world for awhile now and I would say my biggest piece of advice is to learn Docker. (Not trying to shill for Docker here or start a Docker vs. Ansible flame war.) In my personal experience, Docker images (and docker-compose orchestrations) are more pervasive than Ansible playbooks and when it comes to self-hosting for personal use, hosting all my…
Sovereign can be used as is to create linux container with LXD without any changes. You can create container image and than use it across your immutable infrastructure. Don’t waste time in Docker, for this purpose use lxd containers [1]. LXD containers are more secure than docker in general and provide support for unprivileged containers for over 5 years. You can use your ansible scripts to create and manage your con…
"LXD containers are more secure than docker in general"
Please explain. This statement doesn't look correct to me. Both use the same technology - namespaces and cgroups. LXC is just meant to host the full OS installs, so you have to manually do things like "apt upgrade", resolve all breaking changes manually etc. So you end up with bunch of VM-like full OS installs, taking lots of time to manage.
Docker is basically the same, except there are layers of filesystem data and that those base OSs are minimal. Minimal also means less attack vectors, btw. Now, in the image there are all the required dependencies and you can prepare new version in your laptop, resolve breaking changes, test it properly and then easily deploy.
So why are LXC containers more secure?
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#128Earlier quoted context omitted.
Sovereign can be used as is to create linux container with LXD without any changes. You can create container image and than use it across your immutable infrastructure. Don’t waste time in Docker, for this purpose use lxd containers [1]. LXD containers are more secure than docker in general and provide support for unprivileged containers for over 5 years. You can use your ansible scripts to create and manage your con…
"LXD containers are more secure than docker in general" Please explain. This statement doesn't look correct to me. Both use the same technology - namespaces and cgroups. LXC is just meant to host the full OS installs, so you have to manually do things like "apt upgrade", resolve all breaking changes manually etc. So you end up with bunch of VM-like full OS installs, taking lots of time to manage. Docker is basically…
LXD/LXC by default launches unprivileged containers in user space and map the userid’s to hosts user id’s, now they use new kernel feature shiftfs which makes it much easier to provide consistent user id mapping inside a container across hosts, with consistent security model, it doesn’t exist in Docker as it was designed from beginning not to have init process which results in zombie processes inside docker containers and recommends only one process per container. Docker doesn’t by default launches containers running in user space, and there are so many design difference as I posted a link in another post which really makes it a security nightmare unless company like google provides you managed container services taking the burden away from you, but indeed the security vulnerabilities which impacted all k8s didn’t impact LXD running unprivileged containers.
Every image in LXD can be locally hosted including the base one privately, so do not need to rely on inspecting a hotch-potch of Dockerfile, scripts and pull from other docker images to know what’s inside.
Now with the release of LXD 3.19 they introduced interceptions of syscall so even unprivileged containers Running in user space can securely access hardware. So NFS can be mounted inside unprivileged container I haven’t tried the latest docker container but in the old one cannot mount NFS from inside a container without running it in privileged mode with kernel access.
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#129There seems to be a few questionable picks in the readme.
* Why pick ownCloud over NextCloud? The former's forum had 139 posts in the last 7 days and the latter's forum had about 1700. Also some of the features in the former product are locked for enterprise only.
https://central.owncloud.org/about
https://help.nextcloud.com/about
* Tarsnap is a paid online service. You could try restic command to have encrypted backup to remote storages.
* cgit is an old project released more than 10 years ago and despite being written by the author of wireguard, we have far better stuff like Gitea (or its fork source Gogs) to have user access control with nice web interface for git project management.
Re: Sovereign: Ansible playbooks to build and maintain your own private cloud
#130There are so many servers and apps being installed by Sovereign that I'm certain few would be able to keep it secure ( https://github.com/sovereign/sovereign/wiki/Software-used-by... ). The big win for the cloud is that you're paying a fraction of the cost for access to a, typically, enormous security and operations team. If you want to build software like this that allows people to self-host, you need to scale down…
fail2ban and rkhunter are in the kit, and that offsets some of the issues: you get some assurance and protection right there out of the box. You can also comment out the bits you don't want from https://github.com/sovereign/sovereign/blob/master/site.yml before you run the top level playbook.
fail2ban is security theater. Turn off password-based ssh authentication, use keys only, and you’re done. You don’t need additional software for it.
For extra security, bind ssh to localhost only and run a tor hidden service on the machine for accessing it.