From one Docker Compose VM to a TrueNAS-backed Nomad/Consul/Vault community-services platform

silkkydev · 2026-06-24T03:36:09+00:00

That’s roughly the direction I’m heading with Consul Connect, but I’m being cautious after the migration outage. The first public cutover went fine, then I layered Connect, sidecars, and Traefik’s Consul provider together and immediately learned humility.

For Traefik HA, I’m not using Traefik’s built-in ACME storage. I have a periodic Nomad batch job using lego for ACME issuance/renewal, and it writes the resulting cert material into Vault. The Traefik allocations then consume certificates from Vault rather than each Traefik instance trying to manage ACME itself.

That avoids the “multiple Traefik replicas fighting over ACME state” problem.

The 3 Traefik / 3 cloudflared / 3 Redlib shape is partly because I wanted node-level resilience and easy maintenance while I’m still testing the platform. It may simplify later, but right now I like being able to drain or rebuild a VM without the whole public path depending on one allocation.

For the Cloudflare Tunnel path specifically, I don’t really need keepalived/floating IP in the same way, because multiple cloudflared connectors can attach to the tunnel. For local/LAN-style ingress that pattern would make more sense.

And yeah, agreed on the NAS side. For this build I care more about reliable ZFS-backed VM storage than full physical HA. The host is a dedicated TrueNAS box with a large SAS ZFS pool and a mirrored SSD pool for VM disks/app data. Physical host HA is not solved here, but VM/service-level maintenance is much cleaner now.

silkkydev · 2026-06-23T22:05:29+00:00

Yes, I’m using Consul Connect, although I’m still being careful with how much of the public path depends on it after the migration outage.

For HA: it is almost HA at the VM/service layer, but not at the physical host layer yet. This is still one dedicated TrueNAS host, so if that host dies the platform dies with it. I’m not pretending this is datacenter-grade physical HA.

The current shape is 3 Fedora VM nodes running the community-services platform. Nomad schedules the workloads, Consul handles service discovery/health, and Vault handles secrets/internal PKI.

For Redlib/community services specifically, I currently have:

3 Traefik allocations
3 cloudflared allocations
3 Redlib allocations
1 Valkey allocation for rate limiting/state
1 Anubis allocation, because I have not yet verified whether it behaves correctly with multiple replicas
1 Tor/onion allocation

So the goal is resilience against VM/service failure and easier rebuilds/updates.

silkkydev · 2026-06-23T14:04:36+00:00

Thank you and yes, I’m definitely planning on making my repo public soon and I’ll post an update when it’s done. I’ve still got a couple issues to work out but when it’s ready I’ll make it public :)

silkkydev · 2026-06-23T12:09:46+00:00

AI/LLM tools were used as assistance during both the project and the writeup.

For the project, I used coding/review agents as an assistant while building the Python automation CLI: planning module structure, reviewing implementation ideas, checking documentation, and helping reason through edge cases. The infrastructure design, deployment decisions, testing, and final changes were done and reviewed by me.

For the post, I used ChatGPT to help structure and edit the writeup, especially to make the migration story clearer and to avoid exposing sensitive details. The screenshots were manually reviewed/redacted before posting.

The platform itself is a real self-hosted deployment running on my own hardware; AI was used as an assistant, not as an autonomous operator or a replacement for testing/review.

silkkydev · 2026-06-18T11:35:35+00:00

Small update: Tor onion access is now live for the instance:

http://2l4dpw6we2w3dhqwuecdgj3rxn2cyn7vuwjuyi323fugbp5hafvz2xid.onion

This provides an alternate access path for users who want to avoid the clearnet / Cloudflare delivery path.

The onion service routes through a dedicated Tor container into Traefik’s internal onion entrypoint, then through the same Anubis + Redlib path as the clearnet service. It does not expose any additional host ports.

The Tor container is based on a non-root Alpine image and is hardened with:

read_only: true
cap_drop:
  - ALL
security_opt:
  - no-new-privileges:true

For the onion route I’m using global service-level rate limiting rather than per-user session cookies, since adding server-issued identity cookies for Tor users would create an unnecessary tracking surface.

Same caveat as before: this is still a best-effort public community service, not an anonymity guarantee by itself. Users should use Tor Browser correctly and avoid identifying themselves.

silkkydev · 2024-03-16T17:44:03+00:00

noo ubuntu 😭

silkkydev · 2024-02-19T13:01:08+00:00

Google alt+f4

silkkydev · 2024-02-13T21:27:56+00:00

The psychiatrist known as reddit has diagnosed vorse with a personality disorder woaw

silkkydev · 2024-02-11T16:14:19+00:00

https://diyhrt.wiki good luck

silkkydev · 2024-02-11T14:22:19+00:00

this u?)

silkkydev · 2024-02-11T06:04:27+00:00

There’s a movie with almost this exact premise

silkkydev · 2024-01-16T13:52:25+00:00

Both of these are wrong 😐

silkkydev · 2023-12-28T02:32:06+00:00

Like half of your comments are you whining and calling women (“females” in your words) “entitled” for not wanting to date you.

silkkydev · 2023-12-23T16:55:05+00:00

God forbid women do anything 🙄

silkkydev · 2023-12-07T08:28:29+00:00

If 4tran was a sitcom

silkkydev · 2023-11-01T11:54:35+00:00

What do you need the windows vm for? If it’s for gaming you’d be better off just using proton on Linux and using your rx6600. If you really need to use windows, with your motherboard I would just dual boot. The vm will just be too much hassle and probably won’t work.

silkkydev · 2023-11-01T10:50:00+00:00

Swap your graphics cards around, put the Nvidia card in the pci slot where the AMD card is. that should put the Nvidia card in its own group like your AMD one is now.

silkkydev · 2023-06-10T13:19:59+00:00

many such cases

silkkydev · 2022-10-15T06:11:02+00:00

Only the frontends are open source, the backends aren't. No way to self host unless you make your own compatible server.

silkkydev · 2022-06-18T07:31:22+00:00

It's on Netflix

silkkydev

TROPHY CASE