caplam

I started an answer on configuring plex through reverse proxy as i struggled to set it up. but i don't think it's necessary. Does your server runs correctly ? Is it accessible from the outside and the inside ? If yes where is the trouble? FYI i can't resolve metadata.plex.tv neither. And when you like online at dns stuff, dns tools,... there is no record for metadata.plex.tv I wonder how your pc can resolve it. Perhaps its just some weird thing from plex which should resolve locally like their plex.direct links.

I finally managed to adjust some docker settings. for the default subnet you give me this example in json format: { "default-address-pools":[ {"base":"172.30.0.0/16","size":24}, {"base":"172.31.0.0/16","size":24} ] }I tried creating the daemon.json file in /boot/config/docker and restarting docker but that doesn't work. When i googled i see the people advice to add DOCKER_OPT="--argument1 --argument2 ..." in /boot/configdocker.cfg but i didn't find howto convert the json into arguments. in fact there is a much more easy (and secure option). in the docker.cfg you add DOCKER_OPTS="--config-file=/boot/config/docker/daemon.json" you can place and name the file as you want as soon as it's accessible to the docker daemon. The best part is that you can validate the file before restarting the daemon: dockerd --validate --config-file=/boot/config/docker/daemon.jsonand from the docker docs here is the full list of configurable options { "allow-direct-routing": false, "authorization-plugins": [], "bip": "", "bip6": "", "bridge": "", "builder": { "gc": { "enabled": true, "defaultKeepStorage": "10GB", "policy": [ { "keepStorage": "10GB", "filter": ["unused-for=2200h"] }, { "keepStorage": "50GB", "filter": ["unused-for=3300h"] }, { "keepStorage": "100GB", "all": true } ] } }, "cgroup-parent": "", "containerd": "/run/containerd/containerd.sock", "containerd-namespace": "docker", "containerd-plugins-namespace": "docker-plugins", "data-root": "", "debug": true, "default-address-pools": [ { "base": "172.30.0.0/16", "size": 24 }, { "base": "172.31.0.0/16", "size": 24 } ], "default-cgroupns-mode": "private", "default-gateway": "", "default-gateway-v6": "", "default-network-opts": {}, "default-runtime": "runc", "default-shm-size": "64M", "default-ulimits": { "nofile": { "Hard": 64000, "Name": "nofile", "Soft": 64000 } }, "dns": [], "dns-opts": [], "dns-search": [], "exec-opts": [], "exec-root": "", "experimental": false, "features": { "cdi": true, "containerd-snapshotter": true }, "fixed-cidr": "", "fixed-cidr-v6": "", "group": "", "host-gateway-ip": "", "hosts": [], "proxies": { "http-proxy": "http://proxy.example.com:80", "https-proxy": "https://proxy.example.com:443", "no-proxy": "*.test.example.com,.example.org" }, "icc": false, "init": false, "init-path": "/usr/libexec/docker-init", "insecure-registries": [], "ip": "0.0.0.0", "ip-forward": false, "ip-masq": false, "iptables": false, "ip6tables": false, "ipv6": false, "labels": [], "live-restore": true, "log-driver": "json-file", "log-format": "text", "log-level": "", "log-opts": { "cache-disabled": "false", "cache-max-file": "5", "cache-max-size": "20m", "cache-compress": "true", "env": "os,customer", "labels": "somelabel", "max-file": "5", "max-size": "10m" }, "max-concurrent-downloads": 3, "max-concurrent-uploads": 5, "max-download-attempts": 5, "mtu": 0, "no-new-privileges": false, "node-generic-resources": [ "NVIDIA-GPU=UUID1", "NVIDIA-GPU=UUID2" ], "pidfile": "", "raw-logs": false, "registry-mirrors": [], "runtimes": { "cc-runtime": { "path": "/usr/bin/cc-runtime" }, "custom": { "path": "/usr/local/bin/my-runc-replacement", "runtimeArgs": [ "--debug" ] } }, "seccomp-profile": "", "selinux-enabled": false, "shutdown-timeout": 15, "storage-driver": "", "storage-opts": [], "swarm-default-advertise-addr": "", "tls": true, "tlscacert": "", "tlscert": "", "tlskey": "", "tlsverify": true, "userland-proxy": false, "userland-proxy-path": "/usr/libexec/docker-proxy", "userns-remap": "" }Of course you need dig to find the meaning of certain.

Thank you again for your answer and its quality 😃 It must be time consuming. The least i can do is trying to be as clear as you. 1-Portainer Like all people here i started with only unraid to manage containers and portainer was just to have a quick look. Then i installed compose plugin but i don't find it very convenient. So i decided to transition my compose stacks to portainer. For now the majority of single containers remains under unraid control. I have second thought about portainer: mainly the way it stores compose and env files. It's really a pain when you setup a new stack : if there is an error it changes the directory of the compose file before the next try. So now when i setup a new stack i set it first with a single hello world container and then modify it with web editor. 2-Watchtower The advantage of watchtower is that it takes dependancies in a stack into account before upgrading. I also noticed there are lifecycle hooks which permit to launch scripts before or after upgrade. I don't use it for now but it's on my roadmap. 3-Docker Networks I have to remove and setup again all my docker networks but some are more tricky than others. I will also disable all ipv6 settings for docker. it's just awful to manage and my new isp doesn't even provide ipv6 connectivity. For example the nexcloud-aio network on which you have very little control or authentik which fire itself a container outside of its network. It came to my attention that when you publish a port for a container this port is accessible by default on all the host interfaces. So if the host has an interface (or subinterface ) in each vlan you can unwillingly open ports in vlans you don't intend to => i need to review my settings for that. Thank you for the daemon.json trick i ignored you can put it under /boot/config/docker {"base":"172.30.0.0/16","size":24} : does that mean that it will create /24 networks inside the /16 pool. In which case one pool would suffice. I thought this file resides in /etc/docker and need to be created at boot time with a script. If it's done automatically when you put it in /boot/config/docker it's more convenient. 4-Hostnames, DNS I don't think i can use labels for that. My reverse proxy is caddy and is running as opnsense plugin. In my lan i already use macvlan with static ip and hostnames in unbound/dnsmasq. It makes it convenient for firewall rules (using an alias). 5-Databases Until now i have only one mariadb instance which holds several databases. The others are in separate instances. I have mysql, postgres, mongodb and tsdb. For some i even have separate instance only for making daily dumps of the database. By the way i see too many times in compose files database used with the latest tag. It's an awful idea as it may (and certainly will) breaks the database through an update.

hello, Thank you for your answer. I understand the mechanism but made a mistake (actually 2) : i didn't realize that automatic docker network address provisioning exhausted the 172.16.0.0/12 range. I never setup the pool range on docker network because automatic assignment is convenient. i won't use it anymore. Now i have many containers (more than 100; see the screenshot) and new containers are deployed with portainer stack and i transition old ones with stacks too. So each stack create a default docker network which makes numerous docker networks. I also have to reconfigure many containers as i turned off health monitoring when it killed my ssd in no time in unraid 6.8. So what i will do is to delete custom docker networks and recreate them with a /24 (to keep it simple). This way i can stay in the 172.16 range. I also didn't realize that 192.168.48.0/20 overlap with 192.168.50.0/24 I don't know why docker network pickup by default a /16 network. It doesn't make much sense.Who would put his containers in such a large network ? For the vpn : remote lan is 192.168.50.0/24 protocol is openvpn and tunnel address is 10.8.0.0/24. The 2nd site router which is the server has a route to my main site LAN. The problem is that this router is an asus xd6 which doesn't offer many possibilities (if i remember correctly i didn't find a tuning for tunnel network mask). My main site router (opnsense) has also a route to the remote site lan through the openvpn gateway. And of course firewall rules which let pass only traffic to the backup server. Next addition to my container apps could be phpipam to help manage network addresses. Before moving on to redoing my docker custom networks i need some better understanding. There are so many possibilities. I like to use hostnames in my network and i setup my dns servers (unbound as recursive and dnsmasq for local resolution) and reverse proxy to use hostnames for everything. I have to review each one my containers and decide where i want to put them taking into account which of other containers they need to communicate with and of course if they need to be accessible from the outside. Doing this using hostnames is much more convenient. I can put a container in a bridge network attached to unraid interface or subinterface; it can be in a macvlan network which has an unraid parent interface (or sub interface). It's easy for single container app but gets more complicated in a stack when you have a webserver, a database, a redis, a worker,... And if you have several databases mysql, postgres,... you have to decide if you setup a single instance for all databases or an instance for each database or a mix of that. Stacks are also more convenient for backups and upgrades as you can have dependancy between containers. Unraid should really improve on that and docker in general. You were refering to daemon.json. I don't have that file in my system and if i create one i will have to do it each time i reboot. It can certainly be done with user script but not very convenient. I also started to manage container updates with watchtower and docker labels. I have to do it for all my containers and add backup before update. I discovered docker labels not a long time ago. It offers many possibilities to automate things. So all that to say that my journey through containers, networking and security is long and i constantly learn new things that i have to ingest. The more i learn the more i have to spend time on old things i setup long time ago to improve confidentiality, availability, integrity and ease of use. I'm far from having all these things setup as i want.

Hello, I'm trying to troubleshoot an issue and don't understand several things happening on my server. I have 2 sites. On my main site i have an unraid server with many containers, an opnsense router. On a secondary site i have a proxmox server with lxc containers and vms, an asus router. The 2 sites communicate through an openvpn tunnel since at least a year without trouble. Since last week troubles arise: no backup from remote homeassistant vm to my unraid server no backup from remote proxmox to my proxmox backup server container on unraid On the remote site the lan address is 192.168.50.0/24 On my main site : LAN: 192.168.2.0/25 (unraid is 192.168.2.50 no bonding no bridging) IOT : 192.169.10.0/24 SERVER: 192.168.20.0/24 DMZ: 192.168.30.0/24 unraid has a sub interface on each of these vlans. I have containers setup with templates and others setup with stacks in portainer. When i was trying to find the cause of communication error i found that: ping from my main router to remote home assistant vm was OK ping from my laptop to remote home assistant vm on LAN was OK ping from remote home assistant vm to unraid was NOK ping from unraid to home asisstant vm was NOK For the last one here is the result: ping 192.168.50.10 PING 192.168.50.10 (192.168.50.10) 56(84) bytes of data. From 192.168.48.1 icmp_seq=1 Destination Host Unreachable From 192.168.48.1 icmp_seq=2 Destination Host Unreachable From 192.168.48.1 icmp_seq=3 Destination Host Unreachable From 192.168.48.1 icmp_seq=4 Destination Host UnreachableSo i was quite confused as i don't have any address on my site nor on the remote site that looks like 192.168.48.1 I discover that address was in fact used by a docker network using default bridge driver. As soon as i bring the stack down communications between unraid and the remote site were ok. So here is the first thing i don't understand : why docker picked up that network address. All the other networks created the same way have an address like : 172.17.0.0/16 for the default docker0 network and 172.x.0.0/16 for custom bridge networks where x starts at 18. If i bring the stack up this time it picked up a custom bridge network like that : 192.168.32.0/20 With that network address there is no communication problem. Attached is my unraid routing table. The second thing i don't understand : why the hell unraid got an answer from 192.168.48.1 when pinging 192.168.50.10 ? Second attachment is my unraid routing table at the time the incriminated stack picked up an adress on 192.168.48.0 network (i don't remember the network mask) The 3rd attachement is the result of trace route before bringing down the stack and after

Hello, I have a i9-12900h (alder lake). I use igpu in plex, jellyfin, tdarr, immich containers. I have installed gpu stat and intel gpu top. All is working correctly. Today i switched from i915 to XE driver. Since then then gpu stats doesn't display anything. here is the result intel_gpu_top: intel_gpu_top No device filter specified and no discrete/integrated i915 devices foundCan we display gpu statistics when using xe driver ? edit: I didn't notice at first but transcoding was working jellyfin but not in plex. And i also noticed that after reboot my usb stick died so i transfered the license to another one and restored a backup from last night. So i'm now back to i915 driver and all is working correctly. Is there a way to have xe driver fully functionnal ?

Leaving the transition apart it seems to me that using idevices without icloud is very difficult as it is deeply integrated in ios. it's used for documents, photos, backup and sync of apps, backup of iphones It's feasible but if your device capacity is too small for holding your documents and photos it will not be convenient as you'll have to manually manage which doc has to be available offline. I do it for docs using nextcloud. The downside is managing offline availability. I also use calendar through a caldav account on my nextcloud and so on for contacts with a card dav account. For the photos i use immich with an external library and no upload of photos from the phone (it's made by a docker ). If i should not use photos anymore i could make my phone upload photos to immich and delete them from photos. Of course you have to manage the initial upload of your existing library. I don't know if you can retrieve albums that way. Of course you have to verify that other sync you may have with icloud fit in the basic account. And finally for the backup you have to use finder or itunes on a pc. I don't know a replacement for icloud wireless backup.

You can't do that. If the docker.img gets corrupted you recreate it and use previous apps to reinstall your containers. With a good connection it's very quick. I'll add that if your docker.img is 600G you probably have a misconfiguration on one or several docker. Mine is around 100G for around 100 containers. You have to verify paths used on your dockers. One is probably writing on a path it shouldn't.

It depends on what you want to achieve. You can replace iCloud to backup photos with immich or nextcloud but you will loose some functionnalities. Apple photos works with icloud; it manages pretty well what is stored on the phone and what is in the cloud if your photos library exceeds your phone capacity. If you want to have an extra backup you can use a docker like icloud drive sync (don't remember the exact name) to download your icloud photos on your server. For now i still have icloud but i have my phone upload all photos to my nextcloud as backup and i also download photos from icloud to my server and mount the resulting folder in immich as external library.

I have bridging disabled and vlans enabled on eth0 interface. My unraid doesn't listen on eth0.20. You have to go to network settings/ interface extra and exclude the interfaces on which you don't want your server to listen.

depending on your nextcloud version you could try occ web (nextcloud app). Easier to use than to remember the cli syntax of occ commands. From my experience AIO in unraid is very stable. In the past i installed regular version of nextcloud but there were always php files to edit. With AIO i didn't had a single issue once setup and the backup is very convenient. The more important is to set it up correctly particularly for folder ownership and permissions.

thank you for your answer. I didn't had the notification. I will add comments tomorrow. i had not seen the networking changes in 7 but now it makes more sense. I have more work to do to have my server properly setup. It's a long process as i move from a flat network to segmented one. I have to figure out where to put the devices and the services. I think i will also transition to portainer with stacks to have better control of docker networks (like in compose but with a nice gui) But as i have over 70 running containers it's quite long to test.

I want to enhance my security and so i started to segment my network. I have set up these vlans: 1: mgmt (where unraid host listening) 9: home 10: iot 20: server 30: dmz 40: guest My unraid host has 4 interfaces 2x10Gbe, 2x2,5Gbe For now eth0 is a 10Gbe interface (the other is passed through to security onion vm as monitoring interface The 2,5 Gbe interfaces are not used (except one for vpro which doesn't play nice if using it for "classic" network). I created subinteraces in vlan on eth0 (eth0.10, eth0.20, eth0.30) I don't use bond or bridge in network settings. I use docker macvlan (cool for observability) and host access to custom network. With these settings i should have vhost0 as default interface for vm. But i can choose between eth0 or vibr0 (i don't understand the interest of that one) However vhost0 (as well as vhost0.10,...) exists but are not selectable. This was not the case with unraid 6.12.x where vhost0 was used as parent interface for vm. vhostX interfaces have the same mac@ than parent interface and unifi network server (and other network stuff) doesn't like that. As i understand vhost interface is the way virtio-net driver handle network connection for the guest os. So why unraid (since V7 i think) offers eth interfaces to vm ? For the apps published what would you use: a docker bridge on eth0.10 or a macvlan on eth0.10? For those containers in a stack i'll use several networks depending on the service (frontend, backend).

Since you are using aio you should stop the containers from aio interface and then change timezone from here. Timezone change The timezone for Nextcloud is currently set to Europe/Paris. Please note: You can change the timezone when your containers are stopped.

afaik auxiliary adresse should be the address of your unraid server interface in vlan6. Obviously you can't give that address to container. edit: auxiliary address is normally used exclude ip from docker dhcp. I don't use it as i always assign containers addresses manually. So if you want use this address for your docker container you first have disable ip assignement for your eth0.6 subinterface. I suppose you'll have to delete and recreate your network.

I'm afraid i can't give you a step by step guide as i didn't do it myself. I was in the same situation but figured out that my isp had an option at 2€/month for having a public ipv4. So i didn't have to use ipv6. And i think i couldn't have done that as my registrar doesn't provide a way of dynamically updating AAAA records. I guess you should : - figure out if you have a static or dynamic ipv6 and what kind (/64 or /56). If it's static it should be easy. - open port 443 to your reverse proxy (ipv6). - reverse proxy to your facing service using ipv4 of your upstream server If your ipv6 is dynamic i have no idea how you can do it. You would need to be able to update dynamically ipv6 of your reverse proxy (depends on whether your registar permits it or not). Then you would need to open 443 You better ask on openwrt forums.

you have to reverse proxy to http://ip-of-unraid:port if using bridge or http://ip-of-container:port if using macvlan. You can't grab an ip v6 or v4 by dhcp with docker. It's not related to unraid but docker itslef.

docker can't grab ip from dhcp server. You better have your reverse proxy ilsten on ipv6 and proxying request to upstream servers (containers) via ipv4. I think the better is to completly desactivate ipv6 on docker containers; as the way it's handled by docker and isp providing mostly dynamic ipv6 or even worse only a /64 makes it almost useless.

thanks. I already created fastusr on flash. I'll try with the fuse descriptors. For cpu pinning it will be a journey. I have many dockers running. I reviewed metrics in monitoring (prometheus node exporter and cadvisor) and nothing obvious. Metrics have been recorded till the reboot with no disruption.

From time to time my server is unresponsive. Generally restarting nginx through ssh is enough. But today i couldn't even login with ssh or my kvm. However docker containers were running despite being slow. Luckily a push on the power triggered a graceful shutdown and the collection of diagnostics attached. The error messages started right after the end of the mover action. php-fpm[20495]: [WARNING] [pool www] child 927586 exited on signal 9 (SIGKILL) after 15.844115 seconds from start Not sure about that (with the hour shift) but at the same time i may have had a nextcloud aio backup running (and the mover takes action on the borg backup directory) I don't see in diags obvious reason for that crash. No cpu, memory or storage exhaustion. Do you see any event that might explain that ? dionysos-diagnostics-20250402-1133.zip

if i understood correctly: -your eth0 (unraid host interface) is on 192.168.90.x. -You want your docker container on 192.168.95.x For that you have to give an address to your eth3 interface (192.168.95.200) and create a docker bridge network on this interface. For example my unraid server has an adapter (eth0) on the main network (192.168.2.0/24). I created sub interfaces on other vlan networks (192.168.9.X, 192.168.10.x, 192.168.20.x,...) so i have eth0: 192.168.2.50 eth0.10: 192.168.10.50 i created a docker network on top of eth0.10. it looks like this: docker network inspect iotnet [ { "Name": "iotnet", "Id": "df4c4c20d706c464530aab9130a6bd7febc14090d3f3a4e8dff978404dc3771d", "Created": "2024-12-30T11:37:37.084870493+01:00", "Scope": "local", "Driver": "bridge", "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.23.0.0/16", "Gateway": "172.23.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": {}, "Options": { "com.docker.network.bridge.host_binding_ipv4": "192.168.10.50" }, "Labels": {} } i can't remember the full command but the key option is host_binding_ipv4. It should look like this: docker network create -host_binding_ipv4 192.168.10.50 -driver bridge -name iotnet If you don't specify the host binding ipv4 the docker network will be bound to unraid eth0 ipv4. edit : for reference the official doc on bridge driver an its options

it should be enabled by default. You can view that in system/tasks menu Basically it's the same as in sonarr.

upgrade is done. All went well.😀

thanks. Unfortunately i need to do it several steps as i don't have spare nvme ports. In fact i do need more tweaking as my layout is : nvme0: ssd 2 tb ingest pool (pcie4 x4) nvme1: ssd 1tb cache pool1 (pcie3 x4) nvme2: ssd 1tb cache pool2 (pcie3 x2) i will also move ingest pool ssd to pcie3 x2 and finally have cache pool ssds in pcie4 x4 and pcie3 x4 to have more iops. My ingest pool will be slower but i prefer my cache pool to be quicker as it holds my 65 running containers, 4 vms including a very hungry security onion vm The reason is my actual 1tb ssd are 22110 models which do not fit in pcie4 x4 slot. Replacements ssds are 2280 models.

you could add some config around your promotheus to monitor containers. You could be inspired by that