Hello everyone! During one of those illuminated evenings, I got the idea to move my small server in Scaleway to some more powerful server in Hetzner.
If I will make the move, I am thinking of splitting the server in various VMs, to host different services that belongs to different trust boundaries, for example:
A Lemmy/writefreely instance
Vaultwarden/Gitea
Wireguard tunnel to my home infrastructure
Blogs, and other convenience services
In order to achieve the best level of separation, I was thinking of using VMs.
My default choice would be Proxmox, because I used it in the past, and because I generally trust it, however I am trying to evaluate multiple options, and maybe someone has good or better experiences to share.
Other options I thought about are:
Run everything in Docker. I am going to do this nevertheless, but Docker escapes are always possible, especially with public facing images that I did not write myself and/or that require a host volume.
KVM directly? I am OK even without a GUI to be honest. I am not aware if there is some ansible module or even better Terraform provider for this, it would be great. (EDIT: I found https://registry.terraform.io/providers/dmacvicar/libvirt/0.7.1 which seems awesome!)
jumping on the proxmox bandwagon. I run proxmox too, and it's great. Aside from the occasional nag to get a premium licence, it's completely free and open source.
This is how I run my whole home set up. Pretty much everything is virtualized through proxmox with Debian VMs or LXCs. Also proxmox backup server is incredibly easy to set up and give you great piece of mind.
Yeah, probably this is the way I will go, to be honest. I just wanted to bounce some ideas in case I was missing out on some other technology, and a few people mentioned some stacks in this threat which are pretty obscure to me, so nice to look into them and compare!
Do you use just plain bash to script it? I saw that there is a Terraform provider and that looks actually interesting to me basically similar functionality to proxmox, but less software.
Not parent commenter, but I use ansible + plain bash scripts/virsh/XML definitions to manage my libvirt instances/"cluster", it just works.
I have been running Proxmox on the side/at work, I like it as well but never took the time to dive in the API/automation side of things. libvirt is simpler but still powerful.
Personally, after looking at what the industry wants; I would start my homelab trying to automate it with Ansible/Terraform. libvirt should be decent, and if you want to go over to BSD, I think ansible supports bhyve? If not, libvirt definitely runs on BSD so you could just automate that
I work in security, so there is no really devops/sysadmin prospect for me. That said, I use ansible and (mostly) terraform professionally and for my lab, so that's a good idea nevertheless. I don't have much BSD experience, what do you think are the key reasons to go that route instead of Linux?
For me, it's a personal decision. I find BSD more cohesive. That is subjective and has been debated for a decade now. I also find bhyve a bit easier to use, albeit the features are newer and more in number in KVM (for example: bhyve until very recently didn't have VirtIO drivers, so Windows machines would be useless on it).
I'm interested in working in Security myself. Would you be able to tell me a little more about your work? Also, what role/path in security would you recommend for a Cloud admin/System Admin?
In the places where I've had to make similar decisions, I've used the need for 'advanced' features to make the call. If I'm looking for storage or networking redundancy, or I've been interested in running multiple hosts systems, or I've been looking to play with overlay networks, then I'll grab Ovirt, Proxmox, VSphere, or Openstack (depending). When I just want something simple-ish, I just KVM / Podman on a Linux machine.
Good point, I don't have any advanced use case, except maybe some slightly more complex network setup. Probably this is achievable with KVM too (and/or some firewall-fu). I would like to have fully IaC, so I don't have to click through guis, so the availability of Terraform providers might be a dealbreaker (which I didn't look yet for Proxmox, for example).
If you're looking at trying something different give XCP-NG a try. Its a fork of XenServer. Great piece of software. Nothing wrong with Proxmox either.
Yeah that is true, but at the same time I always felt a bit uncomfortable with using a VM which shares resources with who knows what else. I also like the idea of having for example one VM acting as VPN, firewall, rev proxy, while other VMs behind that do not have internet connection at all (inbound). It is somewhat achievable even with VPSs, but it's more complex IMO.
I am conflicted though, and I did consider VPSs to be clear.
The resources are shared, sure, but there's complete logical isolation. Your VM can't see others, and they can't see you (barring any exploit or misconfiguration, but that can happen with physical servers just as well).
Personally I have all my services running in separate containers in one VM. Same separation, just at a different level.