Swag Stack

[devilliersjohnny]

Hi all

Have been attempting to get a linuxserver SWAG stack running using the gluetun vpn after the struggle of getting the docker secrets up and running ( amazingly poorly documented ) got the vpn service up and running telling me that it was connected

Following is a running stack for Swag (minus my login details)

version: '3' 
services:
# Portainer
  portainer:
    image:  portainer/portainer-ce
    container_name: portainer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer_data:/data
    ports:
      - 8000:8000
      - 9000:9000
    restart: always 
# Pihole - DNS Management System
  pihole:
    container_name: pihole
    hostname: RPi4
    image: pihole/pihole
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 67:67/udp
      - 8080:80/tcp
      - 4443:443/tcp
    environment:
      - TZ=${TZ}
      - WEBPASSWORD=${WEBPASSWORD}
      - ServerIP=192.168.101.35
    # Volumes store your data between container upgrades
    volumes:
      - ./pihole/etc-pihole/:/etc/pihole/
      - ./pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    dns:
      - 127.0.0.1
      - 1.1.1.1
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
## gluetun vpn
#  gluetun:
#    image: qmcgaw/gluetun
#    container_name: gluetun
#    cap_add:
#      - NET_ADMIN
#    network_mode: bridge
#    secrets:
#      - openvpn_user
#      - openvpn_password
#    environment:
#      - OPENVPN_USER=bla
#      - OPENVPN_PASSWORD=nla
#      - OPENVPN_CLIENTKEY=openvpn_clientkey
#      - OPENVPN_CLIENTCRT=openvpn_clientcrt
#      - TZ=${TZ}
#      - VPNSP=${VPNSP}
#      - REGION=${OVPNReg}
#      - CYBERGHOST_GROUP=${OVPNGroup}
#      - SERVER_HOSTNAME=${OVPNServer} 
#      - FIREWALL_OUTBOUND_SUBNETS=${EXTRA_SUBNETS}
#      - BLOCK_ADS=on
#    volumes:
#      - ./gluetun:/gluetun
#      - ./secrets/client.key:/gluetun/client.key:ro
#      - ./secrets/client.crt:/gluetun/client.crt:ro
#    ports:
#      - 8888:8888/tcp # HTTP proxy
#      - 8888:8888/udp # HTTP proxy
#      - 8388:8388/tcp # Shadowsocks
#      - 8388:8388/udp # Shadowsocks
#      - 8081:8000/tcp # Built-in HTTP control server
#    restart: always
## DuckDNS - public ip tracker
  duckdns:
    image:  ghcr.io/linuxserver/duckdns
    container_name: duckdns
    environment:
      - PUID=${PUID} #optional
      - PGID=${PGID} #optional
      - TZ=${TZ}
      - SUBDOMAINS=${DNSDOMAIN} 
      - TOKEN=${DUCKDNSTOKEN}
      - LOG_FILE=false #optional
    volumes:
      - ./duckdns:/config #optional
    restart: unless-stopped
# Cloudflare DDNS
  cloudflare-ddns:
    image: oznu/cloudflare-ddns:latest
    container_name: cloudflare-ddns
    restart: always
    environment:
      - API_KEY=${CLOUDFLARE_API_KEY}
      - ZONE=${CLOUDFLARE_ZONE}
      - SUBDOMAIN=${CLOUDFLARE_SUBDOMAIN}
      - PUID=${PUID}
      - PGID=${PGID}
      - PROXIED=${CLOUDFLARE_PROXIED}
    restart: always
# Wireguard - Remote Access to server     
  wireguard:
    image: linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - SERVERURL=${DNSDOMAIN}.duckdns.org #optional
      - SERVERPORT=51820 #optional
      - PEERS=10 #optional
      - PEERDNS=auto #optional
      - INTERNAL_SUBNET=10.13.13.0 #optional
    volumes:
      - ./wireguard-server/config:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped
# Nextcloud - like google drive but free and self hosted    
  nextcloud:
    image: ghcr.io/linuxserver/nextcloud
    container_name: nextcloud
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./nextcloud/config:/config
      - ./nextcloud/data:/data
    depends_on:
      - mariadb
    restart: unless-stopped
# Maria db for nextcloud content    
  mariadb:
    image: ghcr.io/linuxserver/mariadb
    container_name: mariadb
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - TZ=${TZ}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=ncuser
      - MYSQL_PASSWORD=${NCPASSWORD}
    volumes:
      - ./mariadb:/config
    restart: unless-stopped 
# Plex - Media Server 
  plex:
    image: ghcr.io/linuxserver/plex
    container_name: plex
    network_mode: host
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - VERSION=docker
    volumes:
      - ./plex:/config
      - ${EXTERNALSTORAGE}/Media:/External Media
    restart: unless-stopped  
# Bitwarden
  bitwarden:
    image: bitwardenrs/server
    container_name: bitwarden
    environment:
      WEBSOCKET_ENABLED: ${WEBSOCKET_ENABLED}
      SIGNUPS_ALLOWED: ${SIGNUPS_ALLOWED}
      ADMIN_TOKEN: ${ADMIN_TOKEN}
      DOMAIN: https://${DOMAIN_HTTPS}
    volumes: 
      - ./bw-data:/data
    restart: always
# Heidmal GUI Interface for server
  heimdall:
    image: ghcr.io/linuxserver/heimdall
    container_name: heimdall
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./heimdall:/config
    restart: unless-stopped    
# Swag Webserver software    
  swag:
    image: ghcr.io/linuxserver/swag
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - URL=${CLOUDFLARE_ZONE}
      - SUBDOMAINS=wildcard
      - VALIDATION=dns
      - DNSPLUGIN=cloudflare
      - EMAIL=${EMAIL}
      - CERTPROVIDER=zerossl
    volumes:
      - ./swag:/config
    ports:
      - 443:443
      - 80:80
    restart: unless-stopped

secrets:
  openvpn_user:
    file: ./secrets/openvpn_user
  openvpn_password:
    file: ./secrets/openvpn_password
  openvpn_clientkey:
    file: ./secrets/client.key
  openvpn_clientcrt:
    file: ./secrets/client.crt     
    
networks:
  default:
    external:
      name: ${NETWORK_NAME}

Have attempted many different variations on this to attempt to get the system running however am unable to any advice is welcome

[devilliersjohnny]

Apologies for the poor formatting around the gluetun container... git hub seems to take all commented out and change it to headings?!
And seems to get rid of spacing in docker-compose.yml as well ...

[qdm12]

No problem I fixed it, you need to use

\```yml
codehere
\```

without the backslashes

Also I removed your Openvpn credentials I think you left them by mistake. Not to worry too much though since you need those two files as well for Cyberghost.

[devilliersjohnny]

Thanks for the speedy response and formatting!

The main road block I seem to be hitting is that pihole is a host as well as gluetun...
Cannot seem to find a work around to having both run on the same machine simultaneously??
Could you please suggest a method for this?

[qdm12]

amazingly poorly documented

What problems did you encounter?
Documentation is at https://github.com/qdm12/gluetun/wiki/Docker-secrets

The rest depends on what you use to run (docker run, swarm, kubernetes etc.) and each has their documentation, it's expected the user can go read that documentation which can change with time.

[devilliersjohnny]

It is well documented well enough on your side, but is confusing when reading from dockers side?! They don't really define locations or specific conventions to use secrets, during my online search there where between 3 and 5 different ways of attempting the process, well that is if you don't count the differences (run, swarm ....) as I said did manage to figure out how to do this

Thanks

[qdm12]

Ha I agree. Someone wanted support for secrets file, and it was not a trivial journey for me either to be fair.

Note you can change the environment variables to change the internal paths of secret files so that you could also just bind mount it, if Docker secrets are too 'strange'. That's what we need to do for container systems outside Docker, like Kubernetes doesn't handle secrets the same way as Docker ugh.

[qdm12]

Have attempted many different variations on this to attempt to get the system running however am unable to any advice is welcome

1. What are you trying to achieve with gluetun? Why is it in this big docker-compose.yml if you don't connect other services through it also?
2. What doesn't work? Does it fail connecting? Share your logs please

[devilliersjohnny]

Pulling portainer (portainer/portainer-ce:)...
latest: Pulling from portainer/portainer-ce
94cfa856b2b1: Pull complete
49d59ee0881a: Pull complete
c99b6abcbe37: Pull complete
Digest: sha256:f133bfdd9646f48a8ddb54b9555070f628caa530924045eeff8144a32de2dcc7
Status: Downloaded newer image for portainer/portainer-ce:latest
Pulling gluetun (qmcgaw/gluetun:)...
latest: Pulling from qmcgaw/gluetun
595b0fe564bb: Pull complete
c5d05106accb: Pull complete
e711fa1d00cb: Pull complete
Digest: sha256:a470e1aa8ad8844708cfce00701c9b7250405a1ae132bc2b92ae1d53016cc8e2
Status: Downloaded newer image for qmcgaw/gluetun:latest
Pulling pihole (pihole/pihole:)...
latest: Pulling from pihole/pihole
aceecb32d1c3: Pull complete
208d49c0abc2: Pull complete
0d3fe530c66a: Pull complete
a9b44cf88df1: Pull complete
fe9f1fa5a5e0: Pull complete
113626093de2: Pull complete
20749e2af08b: Pull complete
52ccd329e28b: Pull complete
Digest: sha256:d2f764c4531515a1b93d5a8d1d82272ddc961e580f19c84ed764e4fa863823b1
Status: Downloaded newer image for pihole/pihole:latest
Pulling duckdns (ghcr.io/linuxserver/duckdns:)...
latest: Pulling from linuxserver/duckdns
4370ee8f7f4f: Pull complete
9fa44409acc3: Pull complete
eb8febdbbb85: Pull complete
088f589b2308: Pull complete
4187cd865d64: Pull complete
d4b8691f8926: Pull complete
c82a2d0f86a6: Pull complete
a5469e13ee36: Pull complete
Digest: sha256:df760f6c51eb3c02271d804a63c6c9b56ff1fc648cb521cf37f8a778ec65735a
Status: Downloaded newer image for ghcr.io/linuxserver/duckdns:latest
Pulling cloudflare-ddns (oznu/cloudflare-ddns:latest)...
latest: Pulling from oznu/cloudflare-ddns
b538f80385f9: Pull complete
edc3b64c551f: Pull complete
9b8081b58360: Pull complete
13551083c4ae: Pull complete
a180b4b854a6: Pull complete
Digest: sha256:19bd73d8aea9641dc329ec18ae693b2b9c33ff7cdc007f368266ce584446f995
Status: Downloaded newer image for oznu/cloudflare-ddns:latest
Pulling wireguard (linuxserver/wireguard:)...
latest: Pulling from linuxserver/wireguard
d576d43a24f2: Already exists
6ea65a5b75bf: Already exists
5b383599f2d9: Already exists
832fccb8c4ea: Already exists
093dd7da3cd1: Already exists
c6ce93cc69dd: Already exists
7b0cad5c85c4: Already exists
9a175925e948: Pull complete
3b6c2d571220: Pull complete
Digest: sha256:b131d5972e2b417bf5dec376a11a95fa9cb532f70aa5e741797268d90ac84c1c
Status: Downloaded newer image for linuxserver/wireguard:latest
Pulling mariadb (ghcr.io/linuxserver/mariadb:)...
latest: Pulling from linuxserver/mariadb
d576d43a24f2: Already exists
6ea65a5b75bf: Already exists
5b383599f2d9: Already exists
832fccb8c4ea: Already exists
093dd7da3cd1: Already exists
c6ce93cc69dd: Already exists
7b0cad5c85c4: Already exists
97945d9bd1bc: Pull complete
c542d019ab69: Pull complete
Digest: sha256:b94bbca146a0b5ff8cb1f4bd3835120906ebe5ea7174f121220a98d6f3a65156
Status: Downloaded newer image for ghcr.io/linuxserver/mariadb:latest
Pulling nextcloud (ghcr.io/linuxserver/nextcloud:)...
latest: Pulling from linuxserver/nextcloud
4370ee8f7f4f: Already exists
9fa44409acc3: Already exists
eb8febdbbb85: Already exists
088f589b2308: Already exists
4187cd865d64: Already exists
d4b8691f8926: Already exists
7a0125648a9d: Pull complete
d5ea5dae586f: Pull complete
ca2cce00a8d3: Pull complete
45a8277f479f: Pull complete
Digest: sha256:a8231b7cb99019e68a4fbd0072cfbe27a273deff61c64b094ca127f0edab4649
Status: Downloaded newer image for ghcr.io/linuxserver/nextcloud:latest
Pulling plex (ghcr.io/linuxserver/plex:)...
latest: Pulling from linuxserver/plex
2827f67167f2: Pull complete
579906ca240e: Pull complete
9e5fb4844afe: Pull complete
70554f25e70b: Pull complete
b088bca3fe79: Pull complete
4d689e775eaa: Pull complete
8551d462a9f2: Pull complete
77f5a4fc59fc: Pull complete
5dd38dca5899: Pull complete
Digest: sha256:2cc5e82ac80a70351f6e7b0a80cf1a412d9b7f34da921ad2e2f5521879b3c5cb
Status: Downloaded newer image for ghcr.io/linuxserver/plex:latest
Pulling bitwarden (bitwardenrs/server:)...
latest: Pulling from bitwardenrs/server
83c5cfdaa538: Pull complete
f9fa4e5f4a47: Pull complete
65cf7529e6fd: Pull complete
46c70713c145: Pull complete
736d4e42673d: Pull complete
c1cf86df4959: Pull complete
4c7cecedffbb: Pull complete
6b4d06434aaa: Pull complete
e0eba7d14fe4: Pull complete
0b366b62db1b: Pull complete
1589d3cf3ccb: Pull complete
8c80131ac44e: Pull complete
25693fe35b00: Pull complete
928f0d9c3d2b: Pull complete
16a7c0107704: Pull complete
8411ac6c4055: Pull complete
0e84160d8781: Pull complete
040c7f57b50b: Pull complete
0dee8cefddf1: Pull complete
6f7122d7e31a: Pull complete
a6b19c32c3cc: Pull complete
68e688a07660: Pull complete
Digest: sha256:316db1f9c52aad974c35c982e6541b52cad3f8810e1574d0f3abaad3112a89db
Status: Downloaded newer image for bitwardenrs/server:latest
Pulling heimdall (ghcr.io/linuxserver/heimdall:)...
latest: Pulling from linuxserver/heimdall
bba528f16f91: Pull complete
37b2aeb200eb: Pull complete
4e99f7c7b112: Pull complete
20c24c6c626e: Pull complete
1f59e065c7c4: Pull complete
780fb7b23cdd: Pull complete
821e727eec50: Pull complete
15463a6d03fa: Pull complete
4135f7ba457c: Pull complete
e209ad1e2c68: Pull complete
Digest: sha256:e2785400973bb6395eaebdc85c832c0e7ce8ed489b0c9e86222a25ec8f74b72b
Status: Downloaded newer image for ghcr.io/linuxserver/heimdall:latest
Pulling swag (ghcr.io/linuxserver/swag:)...
latest: Pulling from linuxserver/swag
4370ee8f7f4f: Already exists
9fa44409acc3: Already exists
eb8febdbbb85: Already exists
088f589b2308: Already exists
4187cd865d64: Already exists
d4b8691f8926: Already exists
506e1b27918e: Pull complete
fd3ed3436e65: Pull complete
10e23bc9404e: Pull complete
9119761319a5: Pull complete
Digest: sha256:e42d256b70b7f1f5cc5e9d1ac079ad28d0a2de96491f6f53fa91dfa8603bf491
Status: Downloaded newer image for ghcr.io/linuxserver/swag:latest
Creating cloudflare-ddns ... done
Creating portainer       ... done
Creating gluetun         ... done
Creating duckdns         ...
Creating swag            ... error
Creating bitwarden       ...
Creating wireguard       ...
Creating mariadb         ...
Creating heimdall        ...
Creating wireguard       ... error
Creating pihole          ...
Creating duckdns         ... error
ERROR: for swag  Cannot create container for service swag: conflicting options: port publishing and the container type network mode

ERROR: for wireguard  Cannot create container for service wireguard: conflicting options: port publishing and theCreating bitwarden       ... error

ERROR: for pihole  Cannot create container for service pihole: conflicting options: hostname and the network mode

ERROR: for duckdns  Cannot start service duckdns: Container 37efb3128182b4c1227508ff7f8d0cfba5d8b952c091588b11a50f4944fed773 is restarting, wait until the container is running

Creating heimdall        ... error
 new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown
Creating mariadb         ... error
ERROR: for heimdall  Cannot start service heimdall: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown

ERROR: for mariadb  Cannot start service mariadb: OCI runtime create failed: container_linux.go:364: creating newCreating plex            ... error
t /proc/5277/ns/net: no such file or directory: unknown

ERROR: for plex  Cannot start service plex: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown

ERROR: for swag  Cannot create container for service swag: conflicting options: port publishing and the container type network mode

ERROR: for wireguard  Cannot create container for service wireguard: conflicting options: port publishing and the container type network mode

ERROR: for pihole  Cannot create container for service pihole: conflicting options: hostname and the network mode

ERROR: for duckdns  Cannot start service duckdns: Container 37efb3128182b4c1227508ff7f8d0cfba5d8b952c091588b11a50f4944fed773 is restarting, wait until the container is running

ERROR: for bitwarden  Cannot start service bitwarden: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown

ERROR: for heimdall  Cannot start service heimdall: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown

ERROR: for mariadb  Cannot start service mariadb: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown

ERROR: for plex  Cannot start service plex: OCI runtime create failed: container_linux.go:364: creating new parent process caused: container_linux.go:1998: running lstat on namespace path "/proc/5277/ns/net" caused: lstat /proc/5277/ns/net: no such file or directory: unknown
ERROR: Encountered errors while bringing up the project.

johnny @ RPi401 : server $ docker-compose down
Stopping gluetun         ... done
Stopping cloudflare-ddns ... done
Stopping portainer       ... done
Removing plex            ... done
Removing heimdall        ... done
Removing mariadb         ... done
Removing bitwarden       ... done
Removing duckdns         ... done
Removing gluetun         ... done
Removing cloudflare-ddns ... done
Removing portainer       ... done

not to sure on how to share anymore than this

[qdm12]

Ah so you are using network_mode: "service:gluetun" right? (not in the docker-compose.yml you initially shared)

If so, that means they use the network stack of the gluetun container. So technically there is only one host: gluetun. You CANNOT assign a hostname or publish ports in the service definitions, since these are just running processes 'inside' gluetun (by inside, it's a network only inside I mean here). However:

• you can publish ports on gluetun. Since for example plex runs on :32400 on the gluetun host, you can publish port - 32400:32400/tcp on the gluetun service definition and you will be able to access plex through that your host:32400.
• if you need non tunneled containers to access for example plex on 32400, you can use the host gluetun:32400 for that, as long as they are in the same Docker network (gluetun and your non-tunneled container(s))
• for communication between containers tunneled through gluetun, use 127.0.0.1:port. For example if you have containers plex and xyz connected to gluetun, you can use 127.0.0.1:32400 to connect from xyz to plex's 32400 port, as they all run on the same host

I hope that helps!

Also if you feel adventurous, you may want to use https://hub.docker.com/r/qmcgaw/ddns-updater which supports both duckdns and cloudflare for ddns updates 😉 Small note you'll have to set HEALTH_SERVER_ADDRESS=127.0.0.1:9998 or it will conflict with gluetun's health server running on 9999.

[devilliersjohnny]

Yes, that is correct... shared my working stack so that anyone could replicate it and maybe point out if I was making any mistakes and or maybe suggest a fix?! Figured as much on the single host, however am hosting a server on the device that I am attempting to run through gluetun as well.... don't make it easy for myself do I? This is where my technical knowledge is like airtime,,,, it just ran out (;-p)

But following your logic above I should theoretically be able to host anything that does not 1. have its own host network (issue being pihole that automatically runs on 80 and 81) and my webserver ( also 80 + 443 ) changed pihole to (8080) and my plex network mode is also a host?!

Or 2. publish its own ports?

Look you have done incredible work but you are breaking my brain (:-o)

[qdm12]

Yes you have to change each programs internal ports to not conflict with other programs since they all run on the same network host (gluetun). It's sometimes a bit of a pain depending on how well configurable the container is, but there is no alternative.

All containers using gluetun must use network_mode: "service:gluetun". Only gluetun can use the network_mode you want (but not host or it will mess up your host).

Can you update your docker-compose.yml above with the configuration you are trying to run so I can help you fix it? Since the config you have there doesn't use gluetun which is also commented out.