Proxmox setup reverse proxy for containers

[lebanaht95]

Hi guys,

I have Proxmox 6 and I am planning a setup for my system like that:

- Proxmox host should be a "clean" system, means nothing but Proxmox direct installed.
- I have 5 IPv4 and /64 IPv6 and 4 domains: 1 IPv4 for Proxmox host, 4 IPv4 for 4 domains. Each domain and its subdomains pointed to by same IPv4 and v6.
- Each domain comes with subdomains for different self hosted services/apps each runs in own LXC container, for example Wordpress run alone in 1 container and pointed to by blog.xxx.com)
- To redirect traffic to service/app on subdomain: Each domain assigned to 1 container, this container has nginx installed and works as reverse proxy, redirect traffic to corresponding container.

So the system can be described like this:

- x.x.30.62 ... is the IPv4 for Proxmox, x.x.30.63 .... are IPv4 for domain, and assigned to reverse-proxy-container.
- Slave containers (like 1.1, 1.2, 2.1 ...) have kind of internal network so they can talk to each other. They use some kind of NAT network to reach the outside world.

After a few hours tinkering I think this plan is not possible because Proxmox network doesn't work like that. What do you think, is the plan feasible? If not, how would you suggest to setup the it?

 

[LnxBil]

If not, how would you suggest to setup the it?

You need a network of the proxy containers AND the "behind" containers.

I usually setup like this:

vmbr0 -> public network
vmbr1 -> private network

the proxy machine does have two NICs (in each network) and then is able to reverse proxy the connections.

One note of your graphic, the word "bridged" should be changed to "enslaved", because you have only one bridge vmbr0. You also have to setup routing - depending on your network provider - for your proxy IP addresses.

 

[Mattias Hedman]

I have just done something similar, I setup an docker-host machine using Debian 10, on there I installed docker and docker-compose.
After that I installed Linuxserver.io Letsencrypt container that is an reverse proxy container, loads of ready made proxy scripts.
It is working beutifully perfect for me.

And as @LnxBil says use the bridges like he says.