126 lines
6.9 KiB
Markdown
126 lines
6.9 KiB
Markdown
# Multi-Server Deployment with On-Demand Services
|
|
|
|
## Overview
|
|
|
|
This guide explains the **current multi-server architecture** where:
|
|
- **Core Server**: Handles external traffic (ports 80/443); runs DuckDNS, Traefik (multi-provider), Authelia
|
|
- **Additional Servers**: Run Sablier (lazy loading) with direct port exposure; no local Traefik
|
|
- **Manual Routing**: Core Traefik routes to IP:PORT combinations via YAML configuration files
|
|
- **Independent Management**: Each server manages its own containers with lazy loading
|
|
|
|
> **Note**: This document describes the current simplified architecture. Additional servers are "headless" - they expose ports directly without local reverse proxy.
|
|
|
|
## Architecture Diagram
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────┐
|
|
│ 🌐 PUBLIC INTERNET │
|
|
│ HTTPS Traffic (Ports 80/443 forwarded from router) │
|
|
└─────────────────────────────┬────┬──────────────────────────────┘
|
|
│ |
|
|
HTTP(S) ▼ HTTPS
|
|
| |
|
|
┌─────────────────────────────┼────┼──────────────────────────────┐
|
|
│ CORE SERVER │ | │
|
|
| ▼ |
|
|
│ ┌───────────────┐ ┌──────────┐ ┌────────────────┐ │
|
|
│ │ Core Services │ │ Traefik │ │ Local Services │ │
|
|
│ │ Authelia │ ---- │ │ ---- │ │ │
|
|
│ │ DuckDNS │ │ │ │ │ │
|
|
│ └───────────────┘ └────┬─────┘ └────────────────┘ │
|
|
│ │ │
|
|
│ ┌──────────────┼────────────┐ │
|
|
│ │ Routes: │ │
|
|
│ │ • Local (labels) │ │
|
|
│ │ • Remote (YAML files) │ │
|
|
| | | |
|
|
| └──────────────┬────────────┘ |
|
|
| | |
|
|
└───────────────────────────────┼─────────────────────────────────┘
|
|
│
|
|
HTTP (internal network) │
|
|
No SSL/TLS encryption │
|
|
▼
|
|
┌───────────────────────────────┼─────────────────────────────────┐
|
|
│ ADDITIONAL SERVER │
|
|
| |
|
|
│ ┌───────────────┐ ┌────────────────┐ ┌────────────────┐ │
|
|
│ │ Sablier │ │ Your Apps │ │ Dockge | |
|
|
│ │ lazy loading │ │ expose ports │ │ | |
|
|
│ │ │ │ │ │ | |
|
|
│ └───────────────┘ └────────────────┘ └────────────────┘ │
|
|
└─────────────────────────────────────────────────────────────────┘
|
|
|
|
```
|
|
|
|
### Traffic Flow Summary
|
|
|
|
1. **Internet → Core**: HTTPS (ports 80/443 forwarded from router)
|
|
2. **Core → Additional**: HTTP (internal network, no encryption needed)
|
|
3. **Additional → Core**: HTTP (direct response to core Traefik)
|
|
|
|
# Deployment Process
|
|
|
|
## Step 1: Deploy Core Server
|
|
|
|
On the core server, run `ez-homelab.sh`
|
|
* Use Option 1 to Install Prerequisites
|
|
* Then Option 2 to Deploy Core Server
|
|
|
|
This deploys: DuckDNS, Traefik(core), Authelia, Dashboards & Infrastructure
|
|
|
|
From Dockge you can start/stop any of the stacks or containers.
|
|
|
|
**Port Forwarding**:
|
|
- Forward ports 80 & 443 from your router
|
|
- Only this server requires port forwarding
|
|
|
|
## Step 2: Deploy Additional Server
|
|
|
|
On the additional server, run `ez-homelab.sh`
|
|
* Use Option 1 to Install Prerequisites
|
|
* Then Option 3 to Deploy Additional Server
|
|
|
|
This deploys: Sablier (lazy loading), Dashboards & Infrastructure
|
|
|
|
From Dockge you can start/stop any of the stacks or containers.
|
|
|
|
**No Port Forwarding Required**:
|
|
- Services are accessed through core server
|
|
|
|
## How It Works
|
|
|
|
### Traffic Flow
|
|
|
|
1. **User accesses** `https://sonarr.yourdomain.duckdns.org` (HTTPS from internet)
|
|
2. **Core Traefik** receives HTTPS request:
|
|
- Checks Authelia for authentication (SSO)
|
|
- Routes to additional server: `http://192.168.1.100:8989` (HTTP internally)
|
|
3. **Additional server** receives direct HTTP request:
|
|
- Service container receives request on exposed port
|
|
- If stopped, Sablier starts the container
|
|
- Shows loading page while container starts
|
|
4. **Service responds** directly back to core Traefik via HTTP, then HTTPS to user
|
|
|
|
### Key Points
|
|
|
|
- **External Traffic**: Always HTTPS (SSL/TLS encrypted)
|
|
- **Internal Traffic**: Always HTTP (no encryption needed on local network)
|
|
- **No Double Encryption**: Core Traefik terminates SSL, forwards plain HTTP internally
|
|
|
|
### Service Registration
|
|
|
|
When you deploy an additional server:
|
|
1. Services are deployed with exposed ports (no Traefik labels)
|
|
2. Core server creates YAML route files pointing to IP:PORT
|
|
3. Core Traefik loads routes automatically
|
|
4. Services become accessible at `https://servicename.hostname.yourdomain.duckdns.org`
|
|
|
|
### Key Benefits
|
|
|
|
- **Simplified Architecture**: No local Traefik on additional servers
|
|
- **Direct Port Access**: Services expose ports directly (no reverse proxy overhead)
|
|
- **Centralized Access**: All services accessed through one domain
|
|
- **Unified SSO**: Authelia on core server protects all services
|
|
- **Local Lazy Loading**: Sablier manages containers on each server independently
|