Raven's Blog | Linux and IT
A convenient Docker lab with blackjack and a Web GUI

A convenient Docker lab with blackjack and a Web GUI

22 minute
4640 words
Categories:
Virtualization
Tags:
#komodo #nginx #technitium #docker #dns #linux #gui #guide
Level: Medium
Author: Ivan Cherniy
Greetings!

In this detailed article, we will build a Docker lab for convenient management of Docker Compose projects through a graphical interface. And yes, only Open Source under the hood 🐧.

Preface

I deployed such a lab on my home Linux PC and now conveniently manage my docker compose services running not only on it, but also on remote servers. But first things first 📝.

Our future lab will be built around such a wonderful Open Source product as Komodo.

Below is a brief overview of the lab components.

Lab diagram

There is a lot of material ahead, so fewer words and more action, penguins 🐧🐧🐧.

Preparation

Installing Docker

Since we are building a lab for convenient management of Docker resources, install Docker Engine and add our user to the docker group.

BASH
sudo curl https://get.docker.com/ | bash

sudo gpasswd -a $USER docker

newgrp docker
Click to expand and view more

After successful installation and adding the user to the Docker group, try running the command:

BASH
docker run hello-world
Click to expand and view more

If successful, we will see this:

Installing helper utilities

Now install utilities from the standard repositories that we will need while configuring our lab:

BASH
sudo apt update

sudo apt install -y libnss3-tools dnsutils acl mkcert pwgen
Click to expand and view more

Creating the working directory and setting permissions

Create a workdir and restrict access to it:

BASH
sudo mkdir -vp /opt/komodo/

sudo chmod -v 700 /opt/komodo
Click to expand and view more

Set full permissions on the workdir and future files for the current user:

BASH
sudo setfacl -R -m m::rwx /opt/komodo

sudo setfacl -R -m d:m::rwx /opt/komodo

sudo setfacl -R -m u:ivan:rwX /opt/komodo

sudo setfacl -R -m d:u:ivan:rwX /opt/komodo

getfacl /opt/komodo
Click to expand and view more

Generating certificates

Since I am showing an example of configuring a Docker lab on a desktop Linux PC, I will create a self-signed “certificate authority (RootCA)” and certificates for domains.

For this, use the previously installed mkcert utility:

BASH
mkcert -install

mkcert -CAROOT
Click to expand and view more

The first command creates a local certificate authority and adds its root certificate to the trusted certificates on our system and to the stores of installed browsers, for example Firefox and Chromium:

Now create a directory for certificates and two certificates themselves:

BASH
mkdir -vp /opt/komodo/periphery/stacks/nginx/certs

cd /opt/komodo/periphery/stacks/nginx/certs

mkcert -cert-file ./home.lan.crt -key-file ./home.lan.key "home.lan" "localhost" "127.0.0.1"

mkcert -cert-file ./_wildcard.home.lan.crt -key-file ./_wildcard.home.lan.key "*.home.lan"
Click to expand and view more

(Optional) Adding the mkcert rootCA to trusted certificates on another host

If you plan to access your local host over HTTPS from other hosts, for example through a secure private network, simply copy the root certificate (not the key!) created by mkcert to the trusted certificates on another host and update the list.

Example for Debian:

BASH
scp ~/.local/share/mkcert/rootCA.pem user@target_host:/tmp/

ssh -t user@target_host sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/mkcert-rootCA.crt

ssh -t user@target_host sudo update-ca-certificates

ssh user@target_host trust list | grep mkcert
Click to expand and view more

Adding hosts to /etc/hosts

Now we need to add 3 records to the local /etc/hosts file:

BASH
cat << EOF | sudo tee -a /etc/hosts
127.0.0.1 home.lan # Nginx proxy
127.0.0.1 komodo.home.lan # Docker manager
127.0.0.1 technitium.home.lan # DNS
EOF
Click to expand and view more

Creating the Docker network

For our installation, we will create a separate Docker network: komodo_net:

BASH
docker network create --opt com.docker.network.bridge.name=br-komodo-net --opt com.docker.network.enable_ipv6=false --driver bridge --subnet 10.51.51.0/24 --gateway 10.51.51.1 komodo_net
Click to expand and view more

Preparation is finished😌.

Configuring the proxy server - Nginx Proxy Manager

Proceed to configuring our proxy, which will manage certificates and HTTP and TCP proxying.

Running nginx-proxy-manager in Docker

Go to the nginx working directory and create the docker services file:

BASH
cd /opt/komodo/periphery/stacks/nginx/

vim ./compose.yaml
Click to expand and view more

Fill it with the following content:

YAML
---
# https://nginxproxymanager.com/setup/

networks:
  komodo_net:
    external: true

services:
  nginx:
    image: jc21/nginx-proxy-manager:2.14.0
    container_name: nginx
    restart: unless-stopped
    stop_grace_period: 30s
    cpus: 2
    mem_limit: 2G2.14.0
    environment:
      TZ: Europe/Moscow
      DB_SQLITE_FILE: /data/database.sqlite
    hostname: nginx
    volumes:
      - ./data/:/data/
      - ./certs/letsencrypt:/etc/letsencrypt/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 127.0.0.1:80:80 # HTTP
      - 127.0.0.1:81:81 # Web UI
      - 127.0.0.1:443:443 # HTTPS
      # - 127.0.0.1:53:53 # DNS
    networks:
      komodo_net:
        ipv4_address: 10.51.51.50
        aliases:
          - home.lan
          - nginx-proxy-manager
          - nginx-proxy
          - nginx
Click to expand and view more

Start our first service and watch the output:

BASH
docker compose up -d && docker logs -f nginx
Click to expand and view more

After a successful start, open http://localhost:81 in a web browser.

We will see a welcome window and a prompt to specify the administrator name/email and set a password for it:

Adding certificates to Nginx

At this step, we will configure proxy access to the Web GUI panels of our services (including nginx-proxy-manager) over HTTPS.

After logging in to the proxy admin panel, enable the dark theme 😉, change the interface language to Russian, and go to the certificate management section:

Click “Add Certificate” –> “Custom Certificate”. Specify:

Upload the wildcard certificate in the same way. As a result, you should have two certificates added:

Creating proxy hosts

Now go to “Hosts” –> “Proxy Hosts” and click “Add Proxy Host”:

In the “Domain Names” item, specify home.lan and press Enter. Next, in the “Forward Hostname / IP” field, specify the network alias of our proxy, nginx; in the “Forward Port” field, specify the port on which the proxy admin panel runs, 81. After filling this in, go to the “SSL” tab:

Here select the home.lan certificate, enable forced SSL and HTTP/2 support. Then click “Save”:

Add two more proxy hosts in the same way.

Komodo:

Technitium:

As a result, we will have three proxy hosts:

Check proxying by clicking the home.lan record in the “SOURCE” column. A new login page for the nginx panel will open, but now with a valid HTTPS connection:

No complaints about certificates or insecure connection😌.

Creating a stream for DNS queries

Now we will create one stream for proxying DNS queries to the technitium DNS server.

Go to “Hosts” –> “Streams” and click “Add Stream”:

Specify:

And click “Save”:

There will be this record:

Configuring the Docker manager - Komodo

Move on to the Docker resource manager - Komodo.

Running Komodo in Docker

Go to the working directory and create a compose file:

BASH
cd /opt/komodo

vim ./compose.yaml
Click to expand and view more

Fill it in:

YAML
---
# https://github.com/moghtech/komodo/blob/main/compose/mongo.compose.yaml

networks:
  komodo_net:
    external: true

services:
  komodo_db:
    image: mongo:8.2.7-rc0
    container_name: komodo-db
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    stop_grace_period: 1m
    cpus: 2
    mem_limit: 2G
    hostname: komodo-db
    command: --quiet --wiredTigerCacheSizeGB 0.25
    volumes:
      - ./db/data/:/data/db/
      - ./db/config/:/data/configdb/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      TZ: Europe/Moscow
      MONGO_INITDB_ROOT_USERNAME: ${KOMODO_DB_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${KOMODO_DB_PASSWORD}
    expose:
      - 27017
    networks:
      komodo_net:
        ipv4_address: 10.51.51.51
        aliases:
          - komodo-db.home.lan
          - komodo-db
  
  komodo_core:
    image: ghcr.io/moghtech/komodo-core:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
    depends_on:
      - komodo_db
    container_name: komodo-core
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    stop_grace_period: 1m
    cpus: 2
    mem_limit: 2G
    hostname: komodo-core
    env_file: ./.env
    environment:
      TZ: Europe/Moscow
      KOMODO_DATABASE_ADDRESS: komodo-db:27017
      KOMODO_DATABASE_USERNAME: ${KOMODO_DB_USERNAME}
      KOMODO_DATABASE_PASSWORD: ${KOMODO_DB_PASSWORD}
    volumes:
      - ./core/backups/:/backups/
      - ./core/syncs/:/syncs/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    expose:
      - 9120
    networks:
      komodo_net:
        ipv4_address: 10.51.51.52
        aliases:
          - komodo-core.home.lan
          - komodo.home.lan
          - komodo-core
          - komodo

  komodo_periphery:
    image: ghcr.io/moghtech/komodo-periphery:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    container_name: komodo-periphery
    stop_grace_period: 1m
    cpus: 2
    mem_limit: 2G
    hostname: komodo-periphery
    restart: unless-stopped
    env_file: ./.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /proc:/proc
      ## Specify the Periphery agent root directory.
      ## Must be the same inside and outside the container,
      ## or docker will get confused.
      ## Default: /etc/komodo.
      - ${PERIPHERY_ROOT_DIRECTORY:-/opt/komodo}:${PERIPHERY_ROOT_DIRECTORY:-/opt/komodo}
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    expose:
      - 8120
    networks:
      komodo_net:
        ipv4_address: 10.51.51.53
        aliases:
          - komodo-periphery.home.lan
          - komodo-periphery
Click to expand and view more

The file describes the operation and interaction of three services:

Now create a file with environment variables for the Komodo services:

BASH
vim ./.env
Click to expand and view more

And fill it in:

BASH
# https://github.com/moghtech/komodo/blob/main/compose/compose.env
TZ=Europe/Moscow
COMPOSE_KOMODO_IMAGE_TAG=2.0

KOMODO_INIT_ADMIN_USERNAME=komodo
KOMODO_INIT_ADMIN_PASSWORD=
KOMODO_DB_USERNAME=komodo
KOMODO_DB_PASSWORD=
KOMODO_PASSKEY=
KOMODO_HOST=https://komodo.home.lan
KOMODO_TITLE=Komodo
KOMODO_FIRST_SERVER=https://komodo-periphery:8120
KOMODO_FIRST_SERVER_NAME=komodo.home.lan
KOMODO_DISABLE_CONFIRM_DIALOG=true
KOMODO_MONITORING_INTERVAL="15-sec"
KOMODO_RESOURCE_POLL_INTERVAL="1-hr"
BLOG_KOMODO_WEBHOOK_SECRET=
KOMODO_JWT_SECRET=
KOMODO_JWT_TTL="1-day"
KOMODO_LOCAL_AUTH=true
KOMODO_DISABLE_USER_REGISTRATION=false
KOMODO_ENABLE_NEW_USERS=false
KOMODO_DISABLE_NON_ADMIN_CREATE=false
KOMODO_TRANSPARENT_MODE=false
KOMODO_LOGGING_PRETTY=false
KOMODO_PRETTY_STARTUP_CONFIG=false

PERIPHERY_ROOT_DIRECTORY=/opt/komodo/periphery
# PERIPHERY_STACK_DIR=/opt/komodo/stacks
PERIPHERY_PASSKEYS=${KOMODO_PASSKEY}
PERIPHERY_DISABLE_TERMINALS=false
PERIPHERY_SSL_ENABLED=true
PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname
PERIPHERY_LOGGING_PRETTY=false
PERIPHERY_PRETTY_STARTUP_CONFIG=false
Click to expand and view more

Here we need to set our own values for passwords/secrets. Use the pwgen utility again:

BASH
sed -iE "s/^KOMODO_INIT_ADMIN_PASSWORD=.*/KOMODO_INIT_ADMIN_PASSWORD=$(pwgen -s 32 1)/" ./.env

sed -iE "s/^KOMODO_DB_PASSWORD=.*/KOMODO_DB_PASSWORD=$(pwgen -s 32 1)/" ./.env

sed -iE "s/^KOMODO_PASSKEY=.*/KOMODO_PASSKEY=$(pwgen -s 64 1)/" ./.env

sed -iE "s/^BLOG_KOMODO_WEBHOOK_SECRET=.*/BLOG_KOMODO_WEBHOOK_SECRET=$(pwgen -s 64 1)/" ./.env

sed -iE "s/^KOMODO_JWT_SECRET=.*/KOMODO_JWT_SECRET=$(pwgen -s 64 1)/" ./.env
Click to expand and view more

After that, we can start the komodo service:

BASH
docker compose up -d && docker compose logs -f
Click to expand and view more

After a successful start, return to the browser and go to https://komodo.home.lan, where we see the Komodo control panel login without any TLS certificate complaints:

Enter the login komodo and the password from the KOMODO_INIT_ADMIN_PASSWORD variable:

BASH
grep ADMIN_PASSWORD ./.env
Click to expand and view more

The interface is user-friendly, with a pleasant and modern design.

Creating a compose stack for nginx - files on the server

Go to “Stacks” –> “New Stack”:

Specify the name nginx, and choose our local komodo.home.lan as the server:

Enter the nginx stack:

And on the “Config” tab, choose the “Files On Server” mode:

Save the changes:

And since our nginx is already running, the stack will automatically switch to the “RUNNING” status:

If you see something like this:

It means you specified the wrong stack name, or mounted the working directory of the periphery container incorrectly:

You can change stack parameters directly in the Komodo web interface on the “Info” tab (in “Files On Server” mode). After changes, click “Save” and then “Redeploy” to apply the updated parameters.

Server resources can be managed both inside the stack itself and in the “Servers” –> “<server_name>” section:

Very visual, very convenient 👍.

Configuring the DNS server - Technitium

(this is not an ad, this is Ryan Gosling)

Any lab is considered incomplete if it does not have its own DNS server.

Creating a compose stack for technitium - files on the server

Return to the “Komodo” web panel –> “Stacks” –> “New Stack”. Specify the name technitium and choose our local server komodo.home.lan.

Then enter the stack, and on the “Config” tab choose the “UI Defined” mode:

Fill the “Compose File” field with this content:

YAML
---
# https://github.com/TechnitiumSoftware/DnsServer/blob/master/docker-compose.yml

networks:
  komodo_net:
    external: true

services:
  technitium:
    image: technitium/dns-server:${DNS_SERVER_IMAGE_TAG:-latest}
    container_name: technitium
    restart: unless-stopped
    stop_grace_period: 1m
    cpus: 2
    mem_limit: 2G
    hostname: technitium
    sysctls:
      - net.ipv4.ip_local_port_range=1024 65535
    env_file: ./.env
    volumes:
      - ./data/:/etc/dns/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    expose:
      - 5380/tcp # DNS web console (HTTP)
      # - 53443/tcp # DNS web console (HTTPS)
      - 53/udp # DNS service
      - 53/tcp # DNS service
      # - 853/udp # DNS-over-QUIC service
      # - 853/tcp # DNS-over-TLS service
      # - 443/udp # DNS-over-HTTPS service (HTTP/3)
      # - 443/tcp # DNS-over-HTTPS service (HTTP/1.1, HTTP/2)
      # - 80/tcp # DNS-over-HTTP service (use with reverse proxy or certbot certificate renewal)
      # - 8053/tcp # DNS-over-HTTP service (use with reverse proxy)
      # - 67/udp # DHCP service
    dns: 
      - 10.51.51.50
      - 8.8.8.8
    networks:
      komodo_net:
        ipv4_address: 10.51.51.54
        aliases:
          - technitium.home.lan
          - technitium-dns
          - technitium
Click to expand and view more

Scroll down to the “Environment” field and fill it in as follows:

BASH
# https://github.com/TechnitiumSoftware/DnsServer/blob/master/DockerEnvironmentVariables.md
DNS_SERVER_IMAGE_TAG=14.3.0
DNS_SERVER_ADMIN_PASSWORD=4RyYdGWcpkdGFj6anL64JxtbKwpQheqC
DNS_SERVER_DOMAIN=technitium.home.lan
DNS_SERVER_PREFER_IPV6=false
DNS_SERVER_RECURSION=AllowOnlyForPrivateNetworks
DNS_SERVER_FORWARDERS=8.8.8.8, 9.9.9.9
Click to expand and view more

Click “Save”:

And start it by clicking the “Deploy” button:

Go to the “Log” tab to see the container output. If everything is OK, you should see the following:

You can change stack parameters directly in the Komodo web interface on the “Config” tab (in “UI Defined” mode). After changes, click “Save” and then “Redeploy” to apply the updated parameters.

After a successful start, go to the browser and open https://technitium.home.lan. The DNS management web interface should also open without problems:

Login admin; take the password from the DNS_SERVER_ADMIN_PASSWORD variable.

After logging in, immediately enable the dark theme 🌚:

This DNS server is very convenient to manage and has quite broad functionality: zones, cache, recursion, and so on.

Creating the home.lan zone and records for it

For convenience in our lab, create a separate zone for the home.lan domain.

Go to the “Zones” tab and click “Add Zone”:

Specify the home.lan zone, leave the “Primary zone (default)” checkbox enabled, and click “Add”:

After creation, we will land in the settings for the new zone. Click “Add Record”, specify the * character as the name, and 127.0.0.1 or the physical address where nginx-proxy-manager listens on port 443 in the address field.

Click “Save”.

After a minute or two, check it from the host terminal using the dig utility:

BASH
dig @10.51.51.50 r4ven.me +noall +answer

dig @10.51.51.50 test.home.lan +noall +answer
Click to expand and view more

You should see this:

This DNS server can do many things. I recommend exploring its functionality in your spare time 👨‍💻.

Checking the status of lab resources

Perform a small check that everything is in place and everything works after finishing the compose services configuration:

BASH
docker ps; docker image ls; docker network ls
Click to expand and view more

Configuring autostart for key services

Since our lab rests on three pillars (proxy, Docker manager, and DNS server), let’s configure their autostart with Systemd so that they reliably start when the system boots.

Nginx Proxy Manager

Feel free to paste the whole block into the terminal (this is one here doc command):

BASH
cat << EOF | sudo tee /etc/systemd/system/komodo-proxy.service
[Unit]
Description=Nginx Proxy Manager
Requires=docker.service
After=docker.service

[Service]
Restart=always
RestartSec=5
User=root
Group=root
WorkingDirectory=/opt/komodo/periphery/stacks/nginx
ExecStart=/usr/bin/docker compose up
ExecStop=/usr/bin/docker compose down

[Install]
WantedBy=multi-user.target
EOF
Click to expand and view more

Komodo

BASH
cat << EOF | sudo tee /etc/systemd/system/komodo-core.service
[Unit]
Description=Komodo docker stack services
Requires=docker.service
After=docker.service

[Service]
Restart=always
RestartSec=5
User=root
Group=root
WorkingDirectory=/opt/komodo
ExecStart=/usr/bin/docker compose up
ExecStop=/usr/bin/docker compose down

[Install]
WantedBy=multi-user.target
EOF
Click to expand and view more

Technitium

BASH
cat << EOF | sudo tee /etc/systemd/system/komodo-dns.service
[Unit]
Description=Technitium DNS server
Requires=docker.service
After=docker.service

[Service]
Restart=always
RestartSec=5
User=root
Group=root
WorkingDirectory=/opt/komodo/periphery/stacks/technitium
ExecStart=/usr/bin/docker compose up
ExecStop=/usr/bin/docker compose down

[Install]
WantedBy=multi-user.target
EOF
Click to expand and view more

Starting and checking

Update the Systemd configuration and try to start the services while enabling autostart:

BASH
sudo systemctl daemon-reload

sudo systemctl enable --now komodo-{proxy,core,dns}

systemctl list-units | grep -E 'komodo.*.service' | column -t

systemctl status komodo-{proxy,core,dns} | grep -B3 'Active:'
Click to expand and view more

Configuring the DNS client

For convenient operation of our lab, I recommend configuring local DNS queries to be sent to our Technitium server.

Resolver configuration depends on your system and network configuration.

systemd-resolved

Below I will show an example configuration using systemd-resolved.

Back up the DNS configs and create a new minimal systemd-resolved config:

BASH
sudo mv -v /etc/resolv.conf{,.backup}

sudo ln -sv /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

sudo mv -v /etc/systemd/resolved.conf{,_backup}

cat << EOF | sudo tee /etc/systemd/resolved.conf
[Resolve]
DNS=10.51.51.50
FallbackDNS=192.168.1.1 8.8.8.8
Domains=~.
EOF
Click to expand and view more

Restart the service:

BASH
sudo systemctl restart systemd-resolved

systemctl status systemd-resolved

resolvectl
Click to expand and view more

Check DNS operation without explicitly specifying the technitium address:

BASH
dig r4ven.me +noall +answer +identify

dig test.home.lan +noall +answer +identify
Click to expand and view more

It works!

NetworkManager

If your network is managed by NetworkManager, you can specify your DNS servers through the GUI:

Or through nmcli:

BASH
# View connections
nmcli connection show

# Set DNS
nmcli connection modify "Wired connection 1" \
    ipv4.dns "10.51.51.50,192.168.1.1,8.8.8.8" \
    ipv4.ignore-auto-dns yes
Click to expand and view more

After applying changes, it is advisable to restart the NetworkManager service:

BASH
sudo systemctl restart NetworkManager
Click to expand and view more

Check DNS operation without explicitly specifying the technitium address:

BASH
dig r4ven.me +noall +answer +identify

dig test.home.lan +noall +answer +identify
Click to expand and view more

Everything looks OK 😌. But I recommend the systemd-resolved option more.

Adding external servers to Komodo

One of Komodo’s key features is the ability to orchestrate containers that run on remote servers.

Next, I will show an example of configuring and running the agent (periphery) on a remote machine with the IP 192.168.122.31.

Installing komodo-periphery on a remote host for management through local Komodo

Of course, Docker Engine must be installed on the remote host:

BASH
sudo curl https://get.docker.com/ | bash
Click to expand and view more

Create a working directory, set permissions, and create a compose file:

BASH
sudo mkdir -p /opt/periphery && sudo chmod 700 /opt/periphery

sudo vim /opt/periphery/compose.yaml
Click to expand and view more

Then fill it in:

YAML
---

services:
  komodo_periphery:
    image: ghcr.io/moghtech/komodo-periphery:2.0
    labels:
      komodo.skip:
    container_name: komodo-periphery
    stop_grace_period: 1m
    cpus: 1
    mem_limit: 1G
    hostname: komodo-periphery
    restart: on-failure
    env_file: ./.env
    ports:
      - 192.168.122.31:8120:8120
    volumes:
      - ${PERIPHERY_ROOT_DIRECTORY}:${PERIPHERY_ROOT_DIRECTORY}
      - /var/run/docker.sock:/var/run/docker.sock
      - /proc:/proc
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
Click to expand and view more

Now create and fill in the environment variables:

BASH
sudo vim /opt/periphery/.env
Click to expand and view more
BASH
TZ=Europe/Moscow
PERIPHERY_ROOT_DIRECTORY=/opt/periphery
PERIPHERY_PASSKEYS=
PERIPHERY_DISABLE_TERMINALS=false
PERIPHERY_SSL_ENABLED=true
PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname
PERIPHERY_LOGGING_PRETTY=false
PERIPHERY_PRETTY_STARTUP_CONFIG=false
PERIPHERY_BIND_IP=0.0.0.0
Click to expand and view more

Now create a Systemd unit for starting Periphery automatically when the OS boots:

BASH
sudo vim /etc/systemd/system/komodo-periphery.service
Click to expand and view more
BASH
[Unit]
Description=Komodo periphery docker stack services
Requires=docker.service
After=docker.service

[Service]
Restart=always
RestartSec=5
User=root
Group=root
WorkingDirectory=/opt/periphery
ExecStartPre=/usr/bin/sleep 5
ExecStart=/usr/bin/docker compose up
ExecStop=/usr/bin/docker compose down

[Install]
WantedBy=multi-user.target
Click to expand and view more

Reread the Systemd config and start our service:

BASH
sudo systemctl daemon-reload

sudo systemctl enable --now komodo-periphery

systemctl status komodo-periphery

sudo docker compose -f /opt/periphery/compose.yaml logs -f komodo_periphery
Click to expand and view more

If we see this, everything is OK:

Now return to the Komodo interface: “Servers” –> “New Server”, specify a name, for example rustfs.home.lan:

Here enable the “Enabled” server option and specify its address:port. In my case, this is https://192.168.122.31:8120:

Click “Save”, and after a successful connection you will see:

Creating a compose stack - RustFS (S3 storage)

Overall, our lab is already operational and ready to perform its tasks. As an example, let’s add one more stack: RustFS, an S3-compatible storage that acts as an alternative to the infamous MinIO.

Go to “Stacks” –> “New Stack”, specify the name rustfs, and choose our remote server rustfs.home.lan:

Next, choose the UI Defined mode and fill in the “Compose File” fields in the same way:

YAML
---
# https://github.com/rustfs/rustfs/blob/main/docker-compose-simple.yml
# https://github.com/rustfs/rustfs/blob/main/docker-compose.yml

services:
  rustfs:
    image: rustfs/rustfs:1.0.0-alpha.90
    container_name: rustfs
    restart: unless-stopped
    stop_grace_period: 30s
    cpus: 2
    mem_limit: 2G
    user: "root:root"
    env_file: ./.env
    healthcheck:
      test:
        [
          "CMD",
          "sh", "-c",
          "curl -f http://127.0.0.1:9000/health && curl -f http://127.0.0.1:9001/rustfs/console/health"
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    ports:
      - "192.168.122.31:9000:9000" # S3 API port
      - "192.168.122.31:9001:9001" # Console port
    volumes:
      - ./data/storage/:/data/
      - ./data/logs/:/app/logs/
      - ./data/certs/:/opt/tls/ # TLS configuration, you should create tls directory and put your tls files in it and then specify the path here
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
Click to expand and view more

and “Environment”:

BASH
# https://docs.rustfs.com/installation/docker/#complete-parameter-configuration-example
RUSTFS_UID="root"
RUSTFS_GID="root"
TZ=Europe/Moscow
# RUSTFS_VOLUMES=/data/rustfs{0..3} # Define 4 storage volumes
RUSTFS_ADDRESS=0.0.0.0:9000
RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001
RUSTFS_CONSOLE_ENABLE=true
RUSTFS_CORS_ALLOWED_ORIGINS=*
RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS=*
RUSTFS_ACCESS_KEY=ivan
RUSTFS_SECRET_KEY=3QuZHlIh6KDtnX0SBElGa8nI2xZAtSNb
RUSTFS_OBS_LOGGER_LEVEL=info
RUSTFS_TLS_PATH=/opt/tls
# RUSTFS_OBS_ENDPOINT=http://otel-collector:4318
Click to expand and view more

In the RUSTFS_ACCESS_KEY variable, specify the administrator login, and set the password in RUSTFS_SECRET_KEY. You can also generate it with pwgen:

BASH
pwgen -s 32 1
Click to expand and view more

Now “Save” and “Deploy”:

It is time to configure proxying. Go to our Nginx: “Proxy Hosts” –> “Add Proxy Host”.

Create a record for the RustFS admin panel:

Then create a record for S3 itself:

Go to https://rustfs.home.lan, enter the login (RUSTFS_ACCESS_KEY) and password (RUSTFS_SECRET_KEY):

You can create buckets:

And access them at s3.home.lan. For example, using the rclone utility, about which I recently wrote an article on mounting remote storage:

BASH
sudo apt install -y rclone

mkdir -vp ~/.config/rclone

cat << EOF > ~/.config/rclone/rclone.conf
[rustfs]
type = s3
provider = Minio
endpoint = https://s3.home.lan
access_key_id = ivan
secret_access_key = 3QuZHlIh6KDtnX0SBElGa8nI2xZAtSNb
# force_path_style = true
# no_check_bucket = true
EOF
Click to expand and view more

Check:

BASH
rclone ls rustfs:

rclone mkdir rustfs:doc

rclone copy /usr/share/doc/docker-ce rustfs:doc

rclone ls rustfs:doc
Click to expand and view more

It works😌

Afterword

Phew, as usual, the path was thorny, but we made it 😉👨‍💻.

Now we have a full-fledged lab where you can develop, test, and operate various services with much greater convenience 😌.

In the next note, I will show how to create stacks using the third option: through Git repositories. I will show how to safely store env files in Git and automate the deployment procedure on push of changes to the repo.

I also have a ready-made Ansible playbook for deploying komodo-periphery to remote hosts. I will also publish it as a separate note. Do not miss it!

Join our Telegram channel and the Raven chat there as well. We have a friendly (I keep an eye on this) community of penguins 🐧🐧🐧 there. You can also freely ask questions about the blog materials there.

Thank you for reading. See you! 👋

Useful materials

Copyright Notice

Author: Ivan Cherniy

Link: https://r4ven.me/en/virtualization/udobnaya-docker-laboratoriya-s-blekdzhekom-i-web-gui/

License: CC BY-NC-SA 4.0

Blog materials may be used with attribution to the author and source, for non-commercial purposes, and under the same license.

Related Posts

Start searching

Enter keywords to search articles

↑↓
↵
ESC
⌘K Shortcut