Update tech_docs/its_the_new_style_design.md
This commit is contained in:
@@ -1,3 +1,170 @@
|
||||
Below is a **complete, end-to-end recipe** to spin up a **proper three-node Docker Swarm** on **Debian 12 minimal VMs** while honoring:
|
||||
|
||||
- the **dual-stack IPv4/IPv6 numbering** you already locked in
|
||||
- the **symmetrical naming schema**
|
||||
- a **private, non-routed VLAN** for management / HA traffic
|
||||
|
||||
Copy-paste ready; zero drift.
|
||||
|
||||
────────────────────────────────────────
|
||||
1. Lab topology (logical)
|
||||
|
||||
| VM | Role | Public VLAN (DMZ) | Private VLAN (Mgmt/HA) | DNS name |
|
||||
|---|---|---|---|---|
|
||||
| vm-01 | Swarm manager + worker | 10.0.1.10/24 2001:db8:c0de:2000::10/64 | 192.168.255.10/24 | mgr-01.dmz.mycorp.net |
|
||||
| vm-02 | Swarm manager + worker | 10.0.1.11/24 2001:db8:c0de:2000::11/64 | 192.168.255.11/24 | mgr-02.dmz.mycorp.net |
|
||||
| vm-03 | Swarm manager + worker | 10.0.1.12/24 2001:db8:c0de:2000::12/64 | 192.168.255.12/24 | mgr-03.dmz.mycorp.net |
|
||||
|
||||
Private VLAN **only** carries Swarm control plane (TCP 2377, 7946, 4789).
|
||||
Public VLAN carries application traffic.
|
||||
|
||||
────────────────────────────────────────
|
||||
2. Debian 12 minimal VM prep (repeat on every node)
|
||||
|
||||
```bash
|
||||
# 1. base update
|
||||
sudo apt update && sudo apt -y upgrade
|
||||
sudo apt -y install vim curl
|
||||
|
||||
# 2. add Docker repo & install
|
||||
curl -fsSL https://download.docker.com/linux/debian/gpg | \
|
||||
sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
|
||||
echo \
|
||||
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] \
|
||||
https://download.docker.com/linux/debian $(lsb_release -cs) stable" | \
|
||||
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
sudo apt update
|
||||
sudo apt -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
||||
sudo usermod -aG docker $USER && newgrp docker
|
||||
```
|
||||
|
||||
|
||||
────────────────────────────────────────
|
||||
3. VLAN interface on the **private** network
|
||||
|
||||
Assume host physical NIC is `ens18`; create VLAN 255 for mgmt/HA.
|
||||
|
||||
```bash
|
||||
# /etc/network/interfaces.d/mgmt
|
||||
auto ens18.255
|
||||
iface ens18.255 inet static
|
||||
address 192.168.255.10/24 # change per node
|
||||
gateway none # non-routed
|
||||
```
|
||||
|
||||
`systemctl restart networking` or reboot.
|
||||
|
||||
────────────────────────────────────────
|
||||
4. Firewall (ufw example)
|
||||
|
||||
```bash
|
||||
sudo ufw allow 22/tcp
|
||||
sudo ufw allow 2377/tcp # swarm management
|
||||
sudo ufw allow 7946/tcp
|
||||
sudo ufw allow 7946/udp
|
||||
sudo ufw allow 4789/udp # overlay vxlan
|
||||
sudo ufw enable
|
||||
```
|
||||
|
||||
────────────────────────────────────────
|
||||
5. Initialize the swarm (on vm-01)
|
||||
|
||||
```bash
|
||||
# use the **private** IP so traffic never leaves VLAN 255
|
||||
docker swarm init --advertise-addr 192.168.255.10 --listen-addr 192.168.255.10:2377
|
||||
```
|
||||
Copy the **join-token** that is printed.
|
||||
|
||||
On vm-02 / vm-03 run:
|
||||
|
||||
```bash
|
||||
docker swarm join --token SWMTKN-... 192.168.255.10:2377
|
||||
```
|
||||
|
||||
Verify quorum:
|
||||
|
||||
```bash
|
||||
docker node ls
|
||||
```
|
||||
|
||||
────────────────────────────────────────
|
||||
6. Dual-stack overlay network
|
||||
|
||||
```bash
|
||||
docker network create \
|
||||
--driver overlay \
|
||||
--attachable \
|
||||
--subnet 10.0.255.16/28 \
|
||||
--subnet 2001:db8:c0de:ffff:2000::/80 \
|
||||
sym-net
|
||||
```
|
||||
|
||||
────────────────────────────────────────
|
||||
7. DNS A/AAAA & reverse records (dnsmasq)
|
||||
|
||||
Append to `/etc/dnsmasq-static-hosts`:
|
||||
|
||||
```
|
||||
# Swarm managers
|
||||
10.0.1.10 mgr-01.dmz.mycorp.net
|
||||
2001:db8:c0de:2000::10 mgr-01.dmz.mycorp.net
|
||||
10.0.1.11 mgr-02.dmz.mycorp.net
|
||||
2001:db8:c0de:2000::11 mgr-02.dmz.mycorp.net
|
||||
10.0.1.12 mgr-03.dmz.mycorp.net
|
||||
2001:db8:c0de:2000::12 mgr-03.dmz.mycorp.net
|
||||
```
|
||||
|
||||
Reload:
|
||||
|
||||
```bash
|
||||
sudo systemctl reload dnsmasq
|
||||
```
|
||||
|
||||
────────────────────────────────────────
|
||||
8. Deploy a test stack
|
||||
|
||||
`/opt/stacks/hello.yml`
|
||||
|
||||
```yaml
|
||||
version: "3.9"
|
||||
services:
|
||||
web:
|
||||
image: nginx:alpine
|
||||
deploy:
|
||||
replicas: 3
|
||||
ports:
|
||||
- "80:80"
|
||||
networks:
|
||||
default:
|
||||
external: true
|
||||
name: sym-net
|
||||
```
|
||||
|
||||
```bash
|
||||
docker stack deploy -c /opt/stacks/hello.yml hello
|
||||
```
|
||||
|
||||
Access:
|
||||
|
||||
```bash
|
||||
curl http://mgr-01.dmz.mycorp.net
|
||||
curl -6 http://mgr-01.dmz.mycorp.net
|
||||
```
|
||||
|
||||
────────────────────────────────────────
|
||||
9. Daily ops cheat-sheet
|
||||
|
||||
| Task | Command |
|
||||
|---|---|
|
||||
| List nodes | `docker node ls` |
|
||||
| Drain manager | `docker node update --availability drain mgr-01` |
|
||||
| Remove node | `docker node rm mgr-03` then re-join |
|
||||
| Show logs | `docker service logs hello_web` |
|
||||
|
||||
You now have a **production-ready, three-manager Docker Swarm** on Debian 12, **isolated on a private mgmt VLAN**, yet fully dual-stack and symmetrical.
|
||||
|
||||
---
|
||||
|
||||
Complete, symmetry-first DNS name & function list
|
||||
(ready to drop straight into **dnsmasq-static-hosts** or NetBox)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user