Differences

This shows you the differences between two versions of the page.

--- projects:cluster [2025/07/14 15:41] – RunC integration samp20
+++ projects:cluster [2025/07/14 16:04] (current) – Add Caddy samp20
@@ Line 19: / Line 19: @@
   * NFTables for firewall configuration.
   * Python Flask for config distribution.
+  * Caddy for HTTPS ingress proxy
 ===== General architecture =====
-The core of the system will be a python service that will receive the configuration (probably via UNIX socket), validate it and update the various components through python plugins using ''importlib.metadata.entry_points''.
+The core of the system will be a python service that will receive the configuration (probably via UNIX socket so the Flask http server can be kept in a separate container), validate it and update the various components through python plugins using ''importlib.metadata.entry_points''.
 The configuration will consist of objects representing different parts of the system that need to be configured. An example is below:
@@ Line 53: / Line 54: @@
 We will need a mechanism for pulling the Root filesystem. There is probably a standardized way of downloading these from a container registry and unpacking them. For now we won't worry about private registries, but something to consider if this project becomes more widespread.
+===== Network and Wireguard =====
+This will use the [[https://docs.pyroute2.org/index.html|pyroute2]] python module. This has support for [[https://docs.pyroute2.org/wireguard.html|Wireguard]] and [[https://docs.pyroute2.org/netns.html|Network Namespaces]] (their example is with a veth pair).
+===== NFTables =====
+NFTables comes with its own python interface that wraps around ''libnftables''. There's a good tutorial to get started here https://ral-arturo.org/2020/11/22/python-nftables-tutorial.html.
+The scope of this will initially be to configure the forward chains to forward from the container's virtual ethernet to the wireguard tunnel. In the future this can be extended to implement firewall policies between containers.
+===== Caddy =====
+Caddy can be configured directly through JSON. We can merge together multiple container configs, along with any required global configuration, and pass this directly to Caddy. There are probably some gotchas to be aware of when merging. A good starting point will be to take a existing ''Caddyfile'' and convert it to JSON to see what the structure is like and how it can be split.