Setting up a new server with Incus

Incus
1

Hi,
I have been getting my feet wet with lxd over the summer and am now considering to use it on a new server for a small office for which I am the admin. The current server is running all services on bare metal Debian Bullseye, and is configured using Ansible. I am planning to use Debian Bookworm on the new system with Incus. Required services are lan (dhcp, dns, ntp, nftables, fail2ban), authN+authZ (currently Kerberos + OpenLDAP, but will add Keycloak or Authentik), files (NFS and syncthing), mail (dovecot, exim, spamassassin etc.), printing (cups), voice and chat (asterisk, matrix) and web applications (apache2, php-fpm, postgresql, redis).

The lan-services I would keep running on the host as I read that dhcp is better kept at the host. I would also run a reverse proxy on the host, but all other services I would cluster per application into dedicated guests.

I am still struggling with networking: the first service I set up in lxd is asterisk, which is a service that requires ingress as well as egress traffic. I tested various lxd networking settings: bridge, forward, macvlan, but I never succeeded in having a long-term stable network connection between the SIP clients and the Asterisk service on the LXD guest.

Are there any good online resources or books that could help me on my way to set up a host and configure Incus following best practices?

2

Networking is always a tricky one…

For a home/lab network, the main solutions tend to be:

  • macvlan => Very easy but only works if you never need your physical server to interact with the instances. Will not work on wifi.
  • physical bridge => Needs system network reconfiguration to bridge your physical network interface and then have the resulting bridge used for host networking. You should also pin the MAC address to avoid it changing as instances start/stop as that can cause network glitches of 10-30s every time an instance starts/stops. Will not work on wifi.
  • routed bridge => Use the default incusbr0 bridge but then go on whatever machine acts as the router and enter a static route for the IP subnet of incusbr0 with the nexthop/via set to the IP of the server running Incus. This will work on wifi.
1 Like