Add a wireguard network with hades as a router #12
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
OpenTofu plan for dsekt-infra No changes. Your infrastructure matches the configuration.📝 Plan generated in Create OpenTofu plan #48 |
I think default is 100, which we're sometimes reaching now it seems like. At least twenty has been erroring and it seems like that's why. Found out you can see current connection count by database using `select datname, numbackends from pg_stat_database;` and it seems we have a reasonable number of connections per system yet the total is circa 80.
foodelevator
force-pushed
the
wireguard
branch
from
b4befec to
38b9324
Compare
Hades is the only host in the hetzner private network that needs to have wireguard installed. The others route packets to hades due to a routing rule set in hetzner. Hades forwards packets between the wireguard subnet (10.83.1.0/24) and the hetzner subnet (10.83.0.0/24). Currently one peer has been set up, mjukglass, but _Arkaden_ in META is apparently behind a NAT so we could add that as well so people can SSH to it (probably through a proxy (probably traefik) so we don't need to add people to the wireguard network).
foodelevator
force-pushed
the
wireguard
branch
from
38b9324 to
ae7723c
Compare
RafDevX
approved these changes
Dec 20, 2024
|
This might need rebasing(?) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hades is the only host in the hetzner private network that needs to have wireguard installed. The others route packets to hades due to a routing rule set in hetzner. Hades forwards packets between the wireguard subnet (10.83.1.0/24) and the hetzner subnet (10.83.0.0/24).
Currently one peer has been set up, mjukglass, but Arkaden in META is apparently behind a NAT so we could add that as well so people can SSH to it (probably through a proxy (probably traefik) so we don't need to add people to the wireguard network).
Hades was chosen semi-arbitrarily. I thought it would be good to use one of the servers rather than ares or artemis.
This is already deployed btw :)