All 3 nodes run keepalived, at varying priorities.Traefik knows the containers names because it's able to read the docker socket. The traefik service ( in swarm mode) receives incoming requests ( on HTTP and HTTPS), and forwards them to individual containers.Persistent storage for the containers is provide via cephfs mount.The various containers belonging to the application 'stacks' deployed within Docker Swarm are automatically distributed amongst the swarm nodes.All 3 nodes participate in the Docker Swarm as managers.All 3 nodes provide shared storage via Ceph, which is provided by a docker container on each node.Gollum), a further authentication against an OAuth provider will be required.Īssuming a 3-node configuration, under normal circumstances the following is illustrated: Where the hosted application provides inadequate ( i.e.Privatebin), no additional layer of authentication will be required.

Where the hosted application provides a trusted level of authentication ( i.e., NextCloud), or where the application requires public exposure ( i.e.HTTPS (TCP 443) : Serves individual docker containers via SSL-encrypted reverse proxy.Under this design, the only inbound connections we're permitting to our docker swarm in a minimal configuration ( you may add custom services later, like UniFi Controller) are: Network Flows ¶ Services are portable, meaning a particular stack could be shut down and moved to a new provider with minimal effort.Services are defined using docker-compose v3 YAML syntax.Where multiple solutions to a requirement exist, preference will be given to the most portable solution. You'll be able to migrate to ceph/more nodes if/when you expand.

In fact, under the single-node configuration, you don't need ceph either, and you can simply use the local volume on your host for storage. It's still a perfectly valid swarm configuration, ideal for starting your self-hosting journey. If you only have one node, then obviously your swarm is only as resilient as that node. An exception to the 3-nodes decision is running a single-node configuration.

Chef docker tutorial