You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/guides/containers/lxd_web_servers.md
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -154,7 +154,7 @@ If you have a specific hard drive or partition you’d like to use for the whole
154
154
`Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:`
155
155
```
156
156
157
-
Metal As A Service (MAAS) is outside the scope of this document. Accept the defaults for this next bit.
157
+
Metal As A Service (MAAS) is outside the scope of this document. Accept the defaults for this.
158
158
159
159
```
160
160
Would you like to connect to a MAAS server? (yes/no) [default=no]:
@@ -170,7 +170,7 @@ What should the new bridge be called? [default=lxdbr0]: `
170
170
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
171
171
```
172
172
173
-
If you want to use IPv6 on your LXD containers, you can turn on this next option. That is up to you, but you mostly shouldn’t need to. I think. I tend to leave it on out of laziness.
173
+
If you want to use IPv6 on your LXD containers, you can turn on this next option. That is up to you, but you mostly shouldn’t need to.
174
174
175
175
```
176
176
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
@@ -228,7 +228,7 @@ Before we do anything else with containers, you need to be able to access your p
228
228
229
229
The other LXD guide will show you how to do this with the *iptables* firewall, if that’s what you want to do. I tend to use the CentOS default firewall: *firewalld*. So that’s what we’re doing, this time.
230
230
231
-
`firewalld` is configured via the `firewall-cmd` command. **The absolute first thing we want to do,** before we open any ports, is make sure that your containers can be assigned their IP addresses automatically:
231
+
`firewalld` is configured via the `firewall-cmd` command. **The absolute first thing we want to do,** before we open any ports, is making sure that your containers can be assigned their IP addresses automatically:
@@ -303,13 +303,13 @@ If for some reason you need a fully privileged container (and you mostly shouldn
303
303
304
304
For this tutorial, you’ll need three containers:
305
305
306
-
We’ll call them “proxy-server” (for the container that will be directing web traffic to the other two containers), “nginx-server”, and “apache-server”. Yes, I’ll be showing you how to reverse proxy to both *nginx* and *apache*-based servers. Things like *docker* or NodeJS apps we can wait with until I figure that out myself.
306
+
We’ll call them “proxy-server” (for the container that will be directing web traffic to the other two containers), “nginx-server”, and “apache-server”. Yes, I’ll be showing you how to reverse proxy to both *nginx* and *apache*-based servers.
307
307
308
308
We’ll start by figuring out which image we want to base our containers on. For this tutorial, we’re just using Rocky Linux. Using Alpine Linux, for example, can result in much smaller containers (if storage is a concern), but that’s beyond the scope of this particular document.
309
309
310
310
### Finding the Image You Want
311
311
312
-
Here’s the short, short method for starting a container with Rocky Linux:
312
+
Here’s the quick method for starting a container with Rocky Linux:
313
313
314
314
```bash
315
315
lxc launch images:rockylinux/8/amd64 my-container
@@ -382,7 +382,7 @@ That should give you output that looks a bit like this (though, if you opted to
382
382
383
383
So the other guide linked at the beginning of this one has a whole tutorial on how to set LXC/LXD up to work with Macvlan. This is especially useful if you’re running a local server, and you want each container to have an IP address visible on the local network.
384
384
385
-
When you’re running on a VPS, you don’t often have that option. In fact, you might only have one single IP address that you’re allowed to work with. No biggie. The default networking configuration is designed to accommodate this sort of limitation; answering the `lxd init` questions as I specified above *should* take care of everything.
385
+
When you’re running on a VPS, you don’t often have that option. In fact, you might only have one single IP address that you’re allowed to work with. The default networking configuration is designed to accommodate this sort of limitation; answering the `lxd init` questions as I specified above *should* take care of everything.
386
386
387
387
Basically, LXD creates a virtual network device called a bridge (usually named “lxdbr0”), and all containers get connected to that bridge by default. Through it, they can connect to the internet via your host’s default network device (ethernet, wi-fi, or a virtual network device provided by your VPS). Somewhat more importantly, all of the containers can connect to each other.
388
388
@@ -406,7 +406,7 @@ lxc stop mycontainer
406
406
lxc restart mycontainer
407
407
```
408
408
409
-
Hey, even Linux needs to reboot sometimes. And heck, you can actually start, stop, and restart all containers at once with the following commands.
409
+
Even Linux needs to reboot sometimes. You can actually start, stop, and restart all containers at once with the following commands.
410
410
411
411
```bash
412
412
lxc start --all
@@ -446,7 +446,7 @@ Finally, if you've opened a shell into a container, you leave it the same way yo
446
446
447
447
#### Copying Containers
448
448
449
-
Now, if you have a container you’d like to replicate with minimal effort, you don’t need to start a brand new one and install all of your base applications again. That’d be silly. Just run:
449
+
Now, if you have a container you’d like to replicate with minimal effort, you don’t need to start a brand new one and install all of your base applications again. That requires extra work that is not needed. Just run:
450
450
451
451
```bash
452
452
lxc copy my-container my-other-container
@@ -496,7 +496,7 @@ You won’t be able to delete the container if it’s running, so you can either
496
496
lxc delete my-container --force
497
497
```
498
498
499
-
Now, thanks to tab -command-completion, user error, and the fact that “d” sits next to “s” on most keyboards, you can accidentally delete containers. This is known, in the business, as THE BIG OOPS. (Or at least it’ll be known as THE BIG OOPS when I’m done here.)
499
+
Now, thanks to tab -command-completion, user error, and the fact that “d” sits next to “s” on most keyboards, you can accidentally delete containers.
500
500
501
501
To defend against that, you can set any container to be “protected” (making the process of deleting them take an extra step) with this command:
Then, jump into each container, and start working.
520
520
521
521
You’ll also need a text editor for every container. By default, Rocky Linux comes with *vi*, but if you want to simplify your life, *nano* will do. You can install it in each container before you open them up.
522
522
@@ -601,7 +601,7 @@ Exit the shell for now, and let's start on the Nginx server.
601
601
602
602
While this technique *does* work (your web apps and websites will get the users' real IPs), Apache's own access logs *will not show the right IPs.* They'll usually show the IP of the container that your reverse proxy is in. This is apparently a problem with how Apache logs things.
603
603
604
-
I've found loads of solutions on Google, and none of them have actually worked for me. Watch this space for someone much smarter than I am to figure it out. In the meantime, you can check the proxy server's access logs if you need to see the IP addresses yourself, or check the logs of whatever web app you're installing.
604
+
You can check the proxy server's access logs if you need to see the IP addresses yourself, or check the logs of whatever web app you're installing.
605
605
606
606
### The Nginx website server
607
607
@@ -782,9 +782,9 @@ Let's break that down a little:
782
782
783
783
The `proxy_protocol` bit in the `listen` variables is *essential* for the proxy server to work. Never leave it out.
784
784
785
-
For every LXD/website configuration file, you'll need to change the `upstream`, `server`, `server_name`, and `proxy_pass` settings accordingly. The text after "http://" in `proxy-pass` must match the txt that comes after the `upstream` text.
785
+
For every LXD/website configuration file, you'll need to change the `upstream`, `server`, `server_name`, and `proxy_pass` settings accordingly. The text after "http://" in `proxy-pass` must match the text that comes after the `upstream` text.
786
786
787
-
Reload the server with `systemctl restart nginx`, then point your browser at whatever domain you're using instead of `apache.server.test`. If you see a page that looks like this, you're golden:
787
+
Reload the server with `systemctl restart nginx`, then point your browser at whatever domain you're using instead of `apache.server.test`. If your page looks like this, you have success:
788
788
789
789

790
790
@@ -801,7 +801,7 @@ Just kinda repeat the process. Create a file just like before:
801
801
nano /etc/nginx/conf.d/nginx-server.conf
802
802
```
803
803
804
-
Add the approriate text:
804
+
Add the appropriate text:
805
805
806
806
```
807
807
upstream nginx-server {
@@ -825,7 +825,7 @@ server {
825
825
}
826
826
```
827
827
828
-
Again, reload the proxy server, point your browser at the appropriate address, and hope to whatever deity your prefer that you see this:
828
+
Again, reload the proxy server, point your browser at the appropriate address, and hope that you see this:
829
829
830
830

0 commit comments