Thunderstorm Cluster

Thunderstorm Cluster is a self-hosted Proxmox cluster. It consists of 3 nodes, hosting several LXC containers. Those containers run different services that are mostly web-exposed.

Table of contents

• Nodes
• Network
• Datas

Nodes

Each one of the 3 nodes has a specific usage.

Wolke

This is the main node. It contains the permanent web-exposed services.

LXC

It consists of 4 LXC containers that have their own speciality :

• reverse-proxy : This is the only server to be exposed on the web. It is used as a reverse proxy in order to redirect the traffic to the appropriate service. It allows the cluster to be more securised that if every servers was web-exposed. The services running in itself are :

  • Nginx
  • Pavigen (homemade password generator)
  • Wireguard (VPN)
  • Dydns (homemade script to update the dyndns ip address)

• docker-media : This LXC runs the services about media files like photos, movies, series, etc. There are 2 services running in docker-compose containers :

  • Jellyfin (streaming)
  • Immich (photos backup)

• docker-services : This LXC contains the others services running in docker-compose containers :

  • Vaultwarden (password manager)
  • Forgejo (git forge)
  • Mailcow (mail server)

• file-manager : This LXC run services reliable to file access and sharing :

  • Filebrowser (web interface for file management)
  • Comming soon : SMB (file access directly from your own file explorer)

Cloud

This node is used as a backup server. This are no container or virtual machine running on it. Every day at 3:00 am, a backup is sent from wolke to cloud. This applies to datas ans LXC confiurations and content.

Nubes

This node is not really used yet. It is a test server where features, scripts or configurations are tested.

Network

All of these nodes and containers have a firewall, configured to only accept connection on needed ports. Even if the only server to be web-exposed is the reverse-proxy.

The only way to access the local network is to first connect the VPN (Wireguard, running on reverse-proxy). Then you can connect to SSH and access the Proxmox administration interface (port 8006).

The following diagram shows the network connections between reverse-proxy and others LXC :

THUNDERSTORM NETWORK DIAGRAM

                                             file─manager (10.10.2.4)
                                             ┌─────────────────────┐
                                             │ 445 ─> SMB          │
                                      ┌────> │ 2080 ─> Filebrowser │
 reverse─proxy (10.10.2.1)            │      └─────────────────────┘
┌────────────────────────┐            │                               docker─media (10.10.2.3)
│ 51820 ─> Wireguard     │            │                                ┌──────────────────┐
│ 80, 443 ─> Nginx proxy │ ───────────┼────────────────────────┬─────> │ 8096 ─> Jellyfin │
│ 2222, 587, 993, 25,    │            │                        └─────> │ 2283 ─> Immich   │
│ 465 ─> Nginx stream    │ ────┐      │                                └──────────────────┘
└────────────────────────┘     │      │
                               │      │        docker─services (10.10.2.2)
                               │      │     ┌──────────────────────────────┐
                               │      ├───> │ 3013 ─> Vaultwarden          │
                               │      └───> │ 3000 ─> Forgejo              │
                               ├──────────> │ 2222 ─> SSH Forgejo          │
                               └──────────> │ 25, 587, 993, 465 ─> Mailcow │
                                            └──────────────────────────────┘

Datas

The data storage management is essential in this type of infrastructure. Each node has its own data storage organization.

• Wolke : 1TB RAID1 disk (2 external disks of 1TB), to prevent hardware issues.
• Cloud : 2TB external disk. This is the backup-pool of the datas on wolke, to prevent data loss.
• Nubes : No external disk for now.