From 4b3e1a0baf1925108645165d1a1ef7a276879c5a Mon Sep 17 00:00:00 2001 From: kappa Date: Thu, 11 Sep 2025 10:17:40 +0900 Subject: [PATCH] docs: Update PROJECT_DOCUMENTATION.md with Podman + Quadlet automation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Complete rewrite of project documentation focusing on Podman containerization and systemd-based auto-start using Quadlet. Key improvements: - Replace Cloudflare R2 log streaming with container automation - Add comprehensive kernel tuning for production workloads - Implement rootless container with privileged port binding - Document complete auto-start system with 40-second boot time - Include troubleshooting, security considerations, and operations guide - Validate all configurations through reboot testing System: Debian 13 (Trixie) + Podman 5.4.2 + Quadlet + systemd Ports: 80 (HTTP), 81 (Admin UI), 443 (HTTPS) Auto-start: βœ… Verified with full reboot test πŸ€– Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- PROJECT_DOCUMENTATION.md | 516 ++++++++++++++++++++++----------------- 1 file changed, 295 insertions(+), 221 deletions(-) diff --git a/PROJECT_DOCUMENTATION.md b/PROJECT_DOCUMENTATION.md index 1a5fc83..56e8cd9 100644 --- a/PROJECT_DOCUMENTATION.md +++ b/PROJECT_DOCUMENTATION.md @@ -1,266 +1,340 @@ -# Nginx Proxy Manager + Cloudflare R2 둜그 μ‹œμŠ€ν…œ ꡬ좕 λ¬Έμ„œ +# Nginx Proxy Manager μžλ™ν™” ꡬ좕 λ¬Έμ„œ ## πŸ“… ν”„λ‘œμ νŠΈ κ°œμš” -**μž‘μ—…μΌ**: 2025λ…„ 9μ›” 10일 -**μ„œλ²„**: debian-jp-tyo-3 (100.115.167.93) -**λͺ©μ **: Nginx Proxy Manager 둜그λ₯Ό Cloudflare R2에 μ‹€μ‹œκ°„μœΌλ‘œ μ—…λ‘œλ“œν•˜μ—¬ CrowdSec λ³΄μ•ˆ 뢄석 μ‹œμŠ€ν…œκ³Ό 연동 +**μž‘μ—…μΌ**: 2025λ…„ 9μ›” 11일 +**μ„œλ²„**: AWS EC2 Instance (3.35.209.51) +**OS**: Debian 13 (Trixie), Kernel 6.12.41 +**λͺ©μ **: Podman + Quadlet을 ν™œμš©ν•œ nginx-proxy-manager μžλ™ μ‹€ν–‰ μ‹œμŠ€ν…œ ꡬ좕 -## πŸ—οΈ ꡬ좕 μ™„λ£Œ ν•­λͺ© +## πŸ—οΈ μ‹œμŠ€ν…œ μ•„ν‚€ν…μ²˜ -### 1. μ‹œμŠ€ν…œ ν™˜κ²½ μ„€μ • +### 1. μ»¨ν…Œμ΄λ„ˆ λŸ°νƒ€μž„ +- **Podman 5.4.2**: Rootless μ»¨ν…Œμ΄λ„ˆ 엔진 +- **Quadlet**: systemd 기반 μ»¨ν…Œμ΄λ„ˆ μ˜€μΌ€μŠ€νŠΈλ ˆμ΄μ…˜ +- **systemd**: μ„œλΉ„μŠ€ μžλ™ μ‹œμž‘ 및 관리 -#### 1.1 μ„œλ²„ κΈ°λ³Έ μ„€μ • -- **호슀트λͺ… λ³€κ²½**: npm-jp-tko3 β†’ debian-jp-tyo-3 -- **νƒ€μž„μ‘΄ μ„€μ •**: UTC β†’ Asia/Tokyo (JST) -- **μ‹œμŠ€ν…œ**: Debian 13 (trixie), Kernel 6.12.43 +### 2. λ„€νŠΈμ›Œν¬ ꡬ성 +- **포트 바인딩**: 80 (HTTP), 81 (관리 UI), 443 (HTTPS) +- **λ„€νŠΈμ›Œν¬ λ°±μ—”λ“œ**: netavark (Podman κΈ°λ³Έ) +- **DNS**: pastaλ₯Ό ν†΅ν•œ λ„€νŠΈμ›Œν¬ 격리 -#### 1.2 μ‹œμŠ€ν…œ νŠœλ‹ -**컀널 νŒŒλΌλ―Έν„° μ΅œμ ν™”** (`/etc/sysctl.d/99-container-tuning.conf`) +## πŸ”§ μ‹œμŠ€ν…œ μ„€μ • + +### 1. 컀널 νŠœλ‹ μ„€μ • + +**파일**: `/etc/sysctl.d/99-container-tuning.conf` ```bash # λ©”λͺ¨λ¦¬ 관리 -vm.swappiness=10 # μŠ€μ™‘ μ‚¬μš©λ₯  μ΅œμ†Œν™” -vm.dirty_ratio=15 # 더티 νŽ˜μ΄μ§€ λΉ„μœ¨ -vm.vfs_cache_pressure=50 # μΊμ‹œ μ••λ ₯ κ°μ†Œ +vm.swappiness=10 +vm.dirty_ratio=15 +vm.vfs_cache_pressure=50 # λ„€νŠΈμ›Œν¬ μ΅œμ ν™” (ν”„λ‘μ‹œ μ›Œν¬λ‘œλ“œ) -net.core.somaxconn=65535 # μ—°κ²° 큐 크기 -net.core.netdev_max_backlog=5000 # λ„€νŠΈμ›Œν¬ 백둜그 -net.ipv4.tcp_fin_timeout=30 # TCP μ—°κ²° μ’…λ£Œ μ‹œκ°„ -net.ipv4.tcp_max_syn_backlog=8192 # SYN 백둜그 크기 -net.ipv4.ip_unprivileged_port_start=80 # 특ꢌ 포트 ν—ˆμš© +net.core.somaxconn=65535 +net.core.netdev_max_backlog=5000 +net.ipv4.tcp_fin_timeout=30 +net.ipv4.tcp_max_syn_backlog=8192 +net.ipv4.ip_unprivileged_port_start=80 # μ»¨ν…Œμ΄λ„ˆ μ΅œμ ν™” -kernel.pid_max=4194304 # μ΅œλŒ€ PID 수 -vm.max_map_count=262144 # λ©”λͺ¨λ¦¬ 맀핑 수 -fs.file-max=2097152 # μ΅œλŒ€ 파일 수 +kernel.pid_max=4194304 +vm.max_map_count=262144 +fs.file-max=2097152 ``` -**μ‹œμŠ€ν…œ λ¦¬μ†ŒμŠ€ μ œν•œ** (`/etc/systemd/system.conf.d/limits.conf`) +**핡심 μ„€μ •**: +- `net.ipv4.ip_unprivileged_port_start=80`: rootless μ»¨ν…Œμ΄λ„ˆμ—μ„œ 포트 80 μ‚¬μš© ν—ˆμš© +- `vm.swappiness=10`: μŠ€μ™‘ μ‚¬μš©λ₯  μ΅œμ†Œν™”λ‘œ μ»¨ν…Œμ΄λ„ˆ μ„±λŠ₯ ν–₯상 +- `net.core.somaxconn=65535`: λŒ€μš©λŸ‰ μ—°κ²° 처리λ₯Ό μœ„ν•œ μ†ŒμΌ“ 큐 ν™•μž₯ + +### 2. systemd λ¦¬μ†ŒμŠ€ μ œν•œ + +**파일**: `/etc/systemd/system.conf.d/limits.conf` ```bash +[Manager] DefaultLimitNOFILE=65536 DefaultLimitNPROC=65536 DefaultLimitCORE=infinity DefaultLimitMEMLOCK=infinity ``` -### 2. Nginx Proxy Manager μ„€μΉ˜ (Podman + Quadlet) - -#### 2.1 μ»¨ν…Œμ΄λ„ˆ μ„œλΉ„μŠ€ -- **npm-app.service**: Nginx Proxy Manager 메인 μ• ν”Œλ¦¬μΌ€μ΄μ…˜ -- **npm-db.service**: MariaDB 10.11 λ°μ΄ν„°λ² μ΄μŠ€ -- **λ„€νŠΈμ›Œν¬**: Podman μ‚¬μš©μž λ„€νŠΈμ›Œν¬ (npm) -- **포트**: 80, 81 (κ΄€λ¦¬μž), 443 - -#### 2.2 데이터 디렉토리 -``` -/home/kaffa/nginx-proxy-manager/ -β”œβ”€β”€ data/ # NPM 데이터 -β”œβ”€β”€ letsencrypt/ # SSL μΈμ¦μ„œ -β”œβ”€β”€ db/ # MariaDB 데이터 -└── data/logs/ # 둜그 파일 -``` - -### 3. Cloudflare R2 연동 - -#### 3.1 rclone μ„€μΉ˜ 및 μ„€μ • -**μ„€μΉ˜λœ 버전**: rclone v1.60.1-DEV - -**μ„€μ • 파일** (`~/.config/rclone/rclone.conf`): -```ini -[cloudflare-r2] -type = s3 -provider = Cloudflare -access_key_id = 90b141de4479101392691a20c60d2696 -secret_access_key = [REDACTED] -endpoint = https://d8e5997eb4040f8b489f09095c0f623c.r2.cloudflarestorage.com -region = auto -``` - -#### 3.2 R2 버킷 ꡬ쑰 -``` -npm-logs/ -└── debian-jp-tyo-3/ - └── 2025-09-10/ - β”œβ”€β”€ npm_access.log - β”œβ”€β”€ npm_error.log - β”œβ”€β”€ fallback_access.log - β”œβ”€β”€ fallback_error.log - β”œβ”€β”€ npm-app-recent.log - └── npm-db-recent.log -``` - -### 4. 둜그 슀트리밍 μ‹œμŠ€ν…œ - -#### 4.1 둜그 μˆ˜μ§‘ 슀크립트 -**λ°±μ—… 슀크립트** (`/home/kaffa/scripts/npm-log-backup.sh`) -- 일일 λ°±μ—…μš© (μ••μΆ• μ•„μΉ΄μ΄λΈŒ) -- systemd νƒ€μ΄λ¨Έλ‘œ μžλ™ μ‹€ν–‰ -- 둜컬 λ°±μ—… 7일 보관 - -**μ‹€μ‹œκ°„ 슀트리밍 슀크립트** (`/home/kaffa/scripts/npm-log-streamer.sh`) -- CrowdSec용 μ‹€μ‹œκ°„ μ—…λ‘œλ“œ (μ••μΆ• μ—†μŒ) -- 1λΆ„ 간격 동기화 -- μ—λŸ¬ 볡ꡬ 둜직 포함 - -#### 4.2 μ£Όμš” κΈ°λŠ₯ +### 3. μ‚¬μš©μž μ„œλΉ„μŠ€ ν™œμ„±ν™” ```bash -# 둜그 μˆ˜μ§‘ μ†ŒμŠ€ -- Podman μ»¨ν…Œμ΄λ„ˆ λ‚΄λΆ€ 둜그 -- systemd journal (npm-app, npm-db) -- 호슀트 마운트 둜그 파일 - -# μ—…λ‘œλ“œ νŠΉμ§• -- κ°œλ³„ 파일 μ—…λ‘œλ“œ (μ••μΆ• μ—†μŒ) -- μž¬μ‹œλ„ 둜직 (3회) -- νƒ€μž„μ•„μ›ƒ 보호 (300초) -- μ‹€νŒ¨ μ‹œ 계속 μž‘λ™ +# μ‚¬μš©μž μ„œλΉ„μŠ€ 영ꡬ ν™œμ„±ν™” (둜그인 없이 μžλ™ μ‹œμž‘) +sudo loginctl enable-linger admin ``` -#### 4.3 systemd μ„œλΉ„μŠ€ -**npm-log-backup.timer**: 일일 λ°±μ—… (00:00) -**npm-log-streamer.service**: μ‹€μ‹œκ°„ 슀트리밍 (μƒμ‹œ 가동) +## πŸ“¦ Quadlet μ„€μ • -### 5. 문제 ν•΄κ²° λ‚΄μ—­ - -#### 5.1 R2 μ—°κ²° 문제 -**문제**: TLS handshake μ‹€νŒ¨ -**원인**: 잘λͺ»λœ API 자격증λͺ… -**ν•΄κ²°**: -- API Token λŒ€μ‹  S3 ν˜Έν™˜ Access Key/Secret Key μ‚¬μš© -- 32자리 Access Key ID ν˜•μ‹ μ€€μˆ˜ -- μ˜¬λ°”λ₯Έ Account ID둜 μ—”λ“œν¬μΈνŠΈ μˆ˜μ • - -#### 5.2 rootless μ»¨ν…Œμ΄λ„ˆ 포트 바인딩 -**문제**: 포트 80 바인딩 κΆŒν•œ 였λ₯˜ -**ν•΄κ²°**: `net.ipv4.ip_unprivileged_port_start=80` μ„€μ • - -#### 5.3 슀크립트 μ—λŸ¬ νŒμ • 둜직 -**문제**: rclone 좜λ ₯ ν…μŠ€νŠΈ νŒŒμ‹±μœΌλ‘œ 잘λͺ»λœ μ‹€νŒ¨ νŒμ • -**ν•΄κ²°**: Exit code 기반 νŒμ •μœΌλ‘œ λ³€κ²½ (0=성곡) - -## πŸ“Š μ„±λŠ₯ 및 λΉ„μš© 뢄석 - -### ν˜„μž¬ 운영 ν˜„ν™© -- **μ—…λ‘œλ“œ λΉˆλ„**: 1λΆ„λ‹Ή 6-8개 파일 -- **일일 μ—…λ‘œλ“œ**: μ•½ 8,640개 파일 -- **μ›”κ°„ 데이터**: μ•½ 2.81GB -- **성곡λ₯ **: 99.93% - -### μ›”κ°„ λΉ„μš© μ˜ˆμƒ +### 1. 디렉토리 ꡬ쑰 ``` -μŠ€ν† λ¦¬μ§€: $0.042 (2.81GB Γ— $0.015) -PUT μž‘μ—…: $0.78 (172,800회 Γ— $4.50/백만) -총 λΉ„μš©: $0.822/μ›” (μ•½ 1,200원) +~/.config/containers/systemd/ +└── nginx-proxy-manager.container ``` -### λΉ„μš© μ΅œμ ν™” λ°©μ•ˆ -1. **ν˜„μž¬ (4개 파일)**: $0.82/μ›” -2. **500개 파일 μ‹œ**: $102/μ›” β†’ μ£ΌκΈ° μ‘°μ • ν•„μš” -3. **ꢌμž₯**: μ€‘μš”λ„λ³„ μ°¨λ“± μ—…λ‘œλ“œ +### 2. Quadlet μ„€μ • 파일 -## πŸ”§ μœ μ§€λ³΄μˆ˜ λͺ…λ Ήμ–΄ +**파일**: `~/.config/containers/systemd/nginx-proxy-manager.container` +```ini +[Unit] +Description=Nginx Proxy Manager +Wants=network-online.target +After=network-online.target +RequiresMountsFor=%t/containers -### μ„œλΉ„μŠ€ 관리 +[Container] +Image=docker.io/jc21/nginx-proxy-manager:latest +ContainerName=nginx-proxy-manager +AutoUpdate=registry +PublishPort=80:80 +PublishPort=81:81 +PublishPort=443:443 +Volume=nginx-proxy-manager-data:/data +Volume=nginx-proxy-manager-letsencrypt:/etc/letsencrypt +Environment=DISABLE_IPV6=true + +[Service] +Restart=always +TimeoutStartSec=900 + +[Install] +WantedBy=default.target +``` + +### 3. Quadlet μž‘λ™ 원리 +1. Quadlet이 `.container` νŒŒμΌμ„ 읽어 systemd μ„œλΉ„μŠ€ 파일 μžλ™ 생성 +2. systemdκ°€ μƒμ„±λœ μ„œλΉ„μŠ€λ₯Ό `default.target`에 등둝 +3. λΆ€νŒ… μ‹œ μžλ™μœΌλ‘œ μ»¨ν…Œμ΄λ„ˆ μ‹œμž‘ + +## πŸš€ μ„€μΉ˜ 및 배포 절차 + +### 1. κΈ°λ³Έ μ‹œμŠ€ν…œ μ„€μ • +```bash +# μ‹œμŠ€ν…œ μ—…λ°μ΄νŠΈ +sudo apt update + +# Podman μ„€μΉ˜ +sudo apt install -y podman + +# μ‚¬μš©μž lingering ν™œμ„±ν™” +sudo loginctl enable-linger admin +``` + +### 2. 컀널 νŠœλ‹ 적용 +```bash +# 컀널 νŒŒλΌλ―Έν„° μ„€μ • +sudo tee /etc/sysctl.d/99-container-tuning.conf << EOF +# [μœ„μ˜ 컀널 νŠœλ‹ μ„€μ • λ‚΄μš©] +EOF + +# systemd λ¦¬μ†ŒμŠ€ μ œν•œ μ„€μ • +sudo mkdir -p /etc/systemd/system.conf.d +sudo tee /etc/systemd/system.conf.d/limits.conf << EOF +# [μœ„μ˜ systemd μ„€μ • λ‚΄μš©] +EOF + +# 컀널 νŒŒλΌλ―Έν„° μ¦‰μ‹œ 적용 +sudo sysctl -p /etc/sysctl.d/99-container-tuning.conf +``` + +### 3. Quadlet μ„€μ • 배포 +```bash +# Quadlet 디렉토리 생성 +mkdir -p ~/.config/containers/systemd + +# nginx-proxy-manager μ„€μ • 파일 생성 +cat > ~/.config/containers/systemd/nginx-proxy-manager.container << EOF +# [μœ„μ˜ Quadlet μ„€μ • λ‚΄μš©] +EOF + +# systemd 데λͺ¬ μž¬λ‘œλ“œ +systemctl --user daemon-reload + +# μ„œλΉ„μŠ€ μ‹œμž‘ +systemctl --user start nginx-proxy-manager.service +``` + +## πŸ“Š λ¦¬λΆ€νŒ… ν…ŒμŠ€νŠΈ κ²°κ³Ό + +### λΆ€νŒ… νƒ€μž„λΌμΈ (2025-09-11 ν…ŒμŠ€νŠΈ) +``` +01:13:13 - μ‹œμŠ€ν…œ μ…§λ‹€μš΄ μ‹œμž‘ +01:13:17 - nginx-proxy-manager 정상 μ’…λ£Œ +-- λ¦¬λΆ€νŒ… -- +01:13:53 - nginx-proxy-manager μžλ™ μ‹œμž‘ (λΆ€νŒ… ν›„ 40초) +01:13:58 - μ„œλΉ„μŠ€ μ™„μ „ μ€€λΉ„ μ™„λ£Œ +``` + +### κ²€μ¦λœ κΈ°λŠ₯ +- βœ… **μžλ™ μ‹œμž‘**: λΆ€νŒ… ν›„ 40초 λ§Œμ— μ„œλΉ„μŠ€ μ‹œμž‘ +- βœ… **포트 바인딩**: 80, 81, 443 포트 정상 바인딩 +- βœ… **컀널 νŒŒλΌλ―Έν„° μœ μ§€**: λ¦¬λΆ€νŒ… 후에도 λͺ¨λ“  μ„€μ • μœ μ§€ +- βœ… **μ„œλΉ„μŠ€ μ•ˆμ •μ„±**: systemdλ₯Ό ν†΅ν•œ μžλ™ μž¬μ‹œμž‘ +- βœ… **μ»¨ν…Œμ΄λ„ˆ 생성**: μƒˆλ‘œμš΄ μ»¨ν…Œμ΄λ„ˆ ID둜 정상 생성 + +## πŸ”§ 운영 관리 + +### μ„œλΉ„μŠ€ 관리 λͺ…λ Ήμ–΄ ```bash # μ„œλΉ„μŠ€ μƒνƒœ 확인 -systemctl --user status npm-app npm-db npm-log-streamer +systemctl --user status nginx-proxy-manager.service -# 둜그 슀트리밍 μž¬μ‹œμž‘ -systemctl --user restart npm-log-streamer.service +# μ„œλΉ„μŠ€ 쀑지/μ‹œμž‘/μž¬μ‹œμž‘ +systemctl --user stop nginx-proxy-manager.service +systemctl --user start nginx-proxy-manager.service +systemctl --user restart nginx-proxy-manager.service -# 둜그 확인 -journalctl --user -u npm-log-streamer.service -f - -# μˆ˜λ™ 둜그 동기화 -/home/kaffa/scripts/npm-log-streamer.sh sync - -# R2 μ—°κ²° ν…ŒμŠ€νŠΈ -/home/kaffa/scripts/npm-log-streamer.sh test -``` - -### R2 μž‘μ—… -```bash -# μ—…λ‘œλ“œλœ 파일 확인 -rclone ls cloudflare-r2:npm-logs/ - -# 버킷 리슀트 -rclone lsd cloudflare-r2: - -# μˆ˜λ™ μ—…λ‘œλ“œ -rclone copy file.log cloudflare-r2:npm-logs/path/ -``` - -### λͺ¨λ‹ˆν„°λ§ -```bash -# μ—…λ‘œλ“œ 톡계 -grep -c 'SUCCESS:' /home/kaffa/logs/npm-streamer.log - -# 졜근 둜그 -tail -f /home/kaffa/logs/npm-streamer.log - -# λ””μŠ€ν¬ μ‚¬μš©λŸ‰ -du -sh /home/kaffa/nginx-proxy-manager/data/logs/ -``` - -## πŸš€ ν–₯ν›„ κ°œμ„  사항 - -### 단기 κ°œμ„  -1. CrowdSec 연동 ꡬ성 및 ν…ŒμŠ€νŠΈ -2. 둜그 필터링 κ·œμΉ™ 적용 (μ€‘μš” 둜그 μš°μ„ ) -3. μ•Œλ¦Ό μ‹œμŠ€ν…œ ꡬ좕 (μ—…λ‘œλ“œ μ‹€νŒ¨ μ‹œ) - -### μž₯κΈ° κ°œμ„  -1. 둜그 뢄석 λŒ€μ‹œλ³΄λ“œ ꡬ좕 -2. μžλ™ μŠ€μΌ€μΌλ§ (둜그 양에 λ”°λ₯Έ μ£ΌκΈ° μ‘°μ •) -3. 닀쀑 지역 λ°±μ—… (μž¬ν•΄ 볡ꡬ) -4. 둜그 μ••μΆ• 아카이빙 (30일 이상) - -## πŸ“ νŠΈλŸ¬λΈ”μŠˆνŒ… κ°€μ΄λ“œ - -### R2 μ—°κ²° μ‹€νŒ¨ -```bash -# 자격증λͺ… 확인 -cat ~/.config/rclone/rclone.conf - -# 직접 μ—°κ²° ν…ŒμŠ€νŠΈ -rclone lsd cloudflare-r2: --verbose - -# λ„€νŠΈμ›Œν¬ 확인 -curl -v https://[account-id].r2.cloudflarestorage.com -``` - -### μ„œλΉ„μŠ€ μž¬μ‹œμž‘ 루프 -```bash # μ„œλΉ„μŠ€ 둜그 확인 -journalctl --user -u npm-log-streamer.service -n 50 +journalctl --user -u nginx-proxy-manager.service -f -# 슀크립트 κΆŒν•œ 확인 -ls -la /home/kaffa/scripts/ - -# μˆ˜λ™ μ‹€ν–‰ ν…ŒμŠ€νŠΈ -bash -x /home/kaffa/scripts/npm-log-streamer.sh sync -``` - -### 둜그 λˆ„λ½ -```bash # μ»¨ν…Œμ΄λ„ˆ μƒνƒœ 확인 podman ps -# 둜그 파일 쑴재 확인 -podman exec npm-app ls -la /data/logs/ - -# 마운트 확인 -ls -la /home/kaffa/nginx-proxy-manager/data/logs/ +# 포트 바인딩 확인 +ss -tlnp | grep ':80\|:81\|:443' ``` +### μ»¨ν…Œμ΄λ„ˆ 관리 +```bash +# μ»¨ν…Œμ΄λ„ˆ λ‚΄λΆ€ μ ‘κ·Ό +podman exec -it nginx-proxy-manager /bin/bash + +# λ³Όλ₯¨ 확인 +podman volume ls + +# μ»¨ν…Œμ΄λ„ˆ 둜그 확인 +podman logs nginx-proxy-manager + +# 이미지 μ—…λ°μ΄νŠΈ (AutoUpdate=registry둜 μžλ™) +podman auto-update +``` + +### μ‹œμŠ€ν…œ νŒŒλΌλ―Έν„° 확인 +```bash +# 컀널 νŒŒλΌλ―Έν„° 확인 +cat /proc/sys/net/ipv4/ip_unprivileged_port_start +cat /proc/sys/vm/swappiness +cat /proc/sys/net/core/somaxconn + +# Lingering μƒνƒœ 확인 +loginctl show-user admin | grep Linger + +# μ„œλΉ„μŠ€ μ˜μ‘΄μ„± 확인 +systemctl --user list-dependencies nginx-proxy-manager.service +``` + +## πŸ›‘οΈ λ³΄μ•ˆ 고렀사항 + +### 1. Rootless μ»¨ν…Œμ΄λ„ˆ +- 루트 κΆŒν•œ 없이 μ»¨ν…Œμ΄λ„ˆ μ‹€ν–‰ +- 호슀트 μ‹œμŠ€ν…œκ³Ό 격리된 μ‚¬μš©μž λ„€μž„μŠ€νŽ˜μ΄μŠ€ +- λ³΄μ•ˆ 취약점 영ν–₯ λ²”μœ„ μ΅œμ†Œν™” + +### 2. λ„€νŠΈμ›Œν¬ 격리 +- pastaλ₯Ό ν†΅ν•œ λ„€νŠΈμ›Œν¬ λ„€μž„μŠ€νŽ˜μ΄μŠ€ 격리 +- μ»¨ν…Œμ΄λ„ˆλ³„ 독립적인 λ„€νŠΈμ›Œν¬ μŠ€νƒ +- λΆˆν•„μš”ν•œ 포트 λ…ΈμΆœ 차단 + +### 3. μžλ™ μ—…λ°μ΄νŠΈ +- `AutoUpdate=registry`: λ ˆμ§€μŠ€νŠΈλ¦¬μ—μ„œ μ΅œμ‹  이미지 μžλ™ κ°±μ‹  +- λ³΄μ•ˆ 패치 μžλ™ 적용 +- `podman auto-update` λͺ…λ ΉμœΌλ‘œ μˆ˜λ™ μ—…λ°μ΄νŠΈ κ°€λŠ₯ + +## πŸ“ˆ μ„±λŠ₯ μ΅œμ ν™” + +### 1. λ©”λͺ¨λ¦¬ 관리 +- `vm.swappiness=10`: λ©”λͺ¨λ¦¬ μš°μ„  μ‚¬μš©μœΌλ‘œ I/O λŒ€κΈ° μ‹œκ°„ κ°μ†Œ +- `vm.dirty_ratio=15`: μ“°κΈ° μ„±λŠ₯ μ΅œμ ν™” +- `vm.vfs_cache_pressure=50`: νŒŒμΌμ‹œμŠ€ν…œ μΊμ‹œ νš¨μœ¨μ„± ν–₯상 + +### 2. λ„€νŠΈμ›Œν¬ μ„±λŠ₯ +- `net.core.somaxconn=65535`: λŒ€μš©λŸ‰ λ™μ‹œ μ—°κ²° 처리 +- `net.core.netdev_max_backlog=5000`: λ„€νŠΈμ›Œν¬ νŒ¨ν‚· 처리 μ΅œμ ν™” +- `net.ipv4.tcp_fin_timeout=30`: TCP μ—°κ²° μ’…λ£Œ μ‹œκ°„ 단좕 + +### 3. μ»¨ν…Œμ΄λ„ˆ μ΅œμ ν™” +- `kernel.pid_max=4194304`: λŒ€μš©λŸ‰ ν”„λ‘œμ„ΈμŠ€ 지원 +- `fs.file-max=2097152`: 파일 λ””μŠ€ν¬λ¦½ν„° ν•œκ³„ ν™•μž₯ +- `vm.max_map_count=262144`: λ©”λͺ¨λ¦¬ 맀핑 μ˜μ—­ ν™•μž₯ + +## πŸ” νŠΈλŸ¬λΈ”μŠˆνŒ… + +### μ„œλΉ„μŠ€ μ‹œμž‘ μ‹€νŒ¨ +```bash +# μ„œλΉ„μŠ€ μƒνƒœ 및 둜그 확인 +systemctl --user status nginx-proxy-manager.service --no-pager +journalctl --user -u nginx-proxy-manager.service -n 20 + +# Quadlet μ„€μ • 검증 +/usr/libexec/podman/quadlet --user --dryrun + +# 포트 좩돌 확인 +ss -tlnp | grep ':80\|:81\|:443' +``` + +### 포트 바인딩 μ‹€νŒ¨ +```bash +# 컀널 νŒŒλΌλ―Έν„° 확인 +cat /proc/sys/net/ipv4/ip_unprivileged_port_start + +# μˆ˜λ™μœΌλ‘œ 컀널 νŒŒλΌλ―Έν„° 적용 +sudo sysctl net.ipv4.ip_unprivileged_port_start=80 + +# 영ꡬ μ„€μ • 확인 +cat /etc/sysctl.d/99-container-tuning.conf +``` + +### μžλ™ μ‹œμž‘ μ‹€νŒ¨ +```bash +# Lingering μƒνƒœ 확인 +loginctl show-user admin | grep Linger + +# Lingering ν™œμ„±ν™” +sudo loginctl enable-linger admin + +# μ„œλΉ„μŠ€ ν™œμ„±ν™” 확인 +systemctl --user is-enabled nginx-proxy-manager.service +``` + +## 🎯 ν™•μž₯ 및 κ°œμ„  λ°©ν–₯ + +### 1. λͺ¨λ‹ˆν„°λ§ μ‹œμŠ€ν…œ +- Prometheus + Grafanaλ₯Ό ν†΅ν•œ μ»¨ν…Œμ΄λ„ˆ λ©”νŠΈλ¦­ μˆ˜μ§‘ +- 둜그 쀑앙화 (ELK Stack λ˜λŠ” Loki) +- μ•Œλ¦Ό μ‹œμŠ€ν…œ (μ„œλΉ„μŠ€ λ‹€μš΄ μ‹œ Slack/이메일 μ•Œλ¦Ό) + +### 2. λ°±μ—… 및 볡ꡬ +- μ»¨ν…Œμ΄λ„ˆ λ³Όλ₯¨ μ •κΈ° λ°±μ—… +- μ„€μ • 파일 버전 관리 (Git) +- μž¬ν•΄ 볡ꡬ 절차 수립 + +### 3. κ³ κ°€μš©μ„± +- 닀쀑 λ…Έλ“œ ν΄λŸ¬μŠ€ν„° ꡬ성 +- λ‘œλ“œ λ°ΈλŸ°μ„œλ₯Ό ν†΅ν•œ νŠΈλž˜ν”½ λΆ„μ‚° +- ν—¬μŠ€μ²΄ν¬ 및 μžλ™ 볡ꡬ + +### 4. λ³΄μ•ˆ κ°•ν™” +- Podman의 SELinux 연동 +- μ»¨ν…Œμ΄λ„ˆ 이미지 취약점 μŠ€μΊ” +- λ„€νŠΈμ›Œν¬ μ •μ±… μ„ΈλΆ„ν™” + ## βœ… ν”„λ‘œμ νŠΈ μ„±κ³Ό -1. **λ³΄μ•ˆ κ°•ν™”**: μ‹€μ‹œκ°„ 둜그 뢄석 기반 ꡬ좕 -2. **λΉ„μš© 효율**: μ›” $0.82 (1,200원)둜 μ—”ν„°ν”„λΌμ΄μ¦ˆκΈ‰ 둜그 관리 -3. **μžλ™ν™”**: 무인 운영 κ°€λŠ₯ν•œ μ‹œμŠ€ν…œ ꡬ좕 -4. **ν™•μž₯μ„±**: 500개 νŒŒμΌκΉŒμ§€ ν™•μž₯ κ°€λŠ₯ν•œ μ•„ν‚€ν…μ²˜ -5. **μ‹ λ’°μ„±**: 99.93% μ—…λ‘œλ“œ 성곡λ₯  +1. **μ™„μ „ μžλ™ν™”**: λΆ€νŒ… μ‹œ 무인 μžλ™ μ‹œμž‘ 달성 +2. **μ•ˆμ •μ„±**: systemd 기반 μ„œλΉ„μŠ€ κ΄€λ¦¬λ‘œ 높은 μ•ˆμ •μ„± 확보 +3. **μ„±λŠ₯ μ΅œμ ν™”**: 컀널 νŠœλ‹μ„ ν†΅ν•œ ν”„λ‘μ‹œ μ›Œν¬λ‘œλ“œ μ΅œμ ν™” +4. **λ³΄μ•ˆ**: Rootless μ»¨ν…Œμ΄λ„ˆλ‘œ λ³΄μ•ˆ μœ„ν—˜ μ΅œμ†Œν™” +5. **μœ μ§€λ³΄μˆ˜μ„±**: Quadlet을 ν†΅ν•œ 선언적 μ„€μ • 관리 + +## πŸ“ 기술 μŠ€νƒ + +- **μ»¨ν…Œμ΄λ„ˆ**: Podman 5.4.2 (Rootless) +- **μ˜€μΌ€μŠ€νŠΈλ ˆμ΄μ…˜**: Quadlet + systemd +- **λ„€νŠΈμ›Œν‚Ή**: netavark + pasta +- **OS**: Debian 13 (Trixie) +- **관리도ꡬ**: systemctl, journalctl, podman CLI --- -*Documentation created: 2025-09-11* -*System operational since: 2025-09-10 17:13 JST* \ No newline at end of file +*Documentation created: 2025-09-11* +*System tested and operational: λ¦¬λΆ€νŒ… ν…ŒμŠ€νŠΈ μ™„λ£Œ* +*Auto-start verification: βœ… 40초 λ§Œμ— μžλ™ μ‹œμž‘ 확인* \ No newline at end of file