• 2 Posts
  • 34 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle










  • I set up custom bash scripts collecting information (df, docker json, smartCTL etc) Either parse existing json info or assemble json strings and push it to Homeassistant REST api (cron) In Homeassistant data is turned into sensors and displayed. HA sends messages of sensors fail.
    Info served in HA:

    • HDD/SSD (size, smartCTL errors, spin up/down, temperature etc)
    • Availability/health of docker services
    • CPU usage/RAM/temperature
    • Network interface/throughput/speed/connections
    • fail2ban jails

    Trying to keep my servers as barebones as possible. Additional services/apps put strain on CPU/RAM etc. Found out most of data necessary for monitoring is either available (docker json, smartCTL json) or can be easily caught, e.g.

    df -Pht ext4 | tail -n +2 | awk '{ print $1}

    It was fun learning and defining what must be monitored or not, and building a custom interface in HA.











  • I’m using network overlays for individual containers and separation.
    Secondly fail2ban installed on host to secure docker services. Ban FORWARDING chains specific to docker instead of INPUT chains. [fail2ban docker](Configure Fail2Ban for a Docker Container – seifer.guru) Use 2FA for services if available.

    Rootless docker has limitations when it comes to port exposing, storage drivers, network overlays etc.

    The host is auto-updating security batches but rebooted manually only.
    Docker containers are updated manually too. I built all containers from file and don’t pull them because most are modified (plugins, minimizing sizes, dedicated user rights etc.)