In my case, I don’t need the isolation of a VM, really I’m just looking to separate the service I’m running into something manageable and easy to move between hosts. I could do a VM for each, but I’d be adding overhead and power requirements without much benefit.
And really that’d all it comes down to for me. Each service is its own LXC, from stuff most self-hosters use, to random one-offs I write. Managing it all stays in ansible for everything, and the structure is quite a bit simpler.
When I do want to bring it elsewhere, I van package it up clean and toss that on a new LXC somewhere else quickly, like an 80 core monster with $16k in GPU thats already getting pushed hard, and knowing it will be of almost no impact to its main job while adding the service it needs.
I do still have VMs, but that is to do things like dealing with windows. Especially specific versions, like a piece of software for some work stuff that requires XP or server 2008 specifically. Its pretty isolated though, not even allowed network access out. All my writes are to a thumb drive if I need to get something out of it (which is uniquely set as the thumb drive its allowed to see).
So nothing that I couldn’t do a bunch of other ways, this is just the structure thats working best for me.
Ah - yeah ive got trunk to each of the machines in my clusters, 9 vlans total, and of course I can add more whenever this way. I’m a bit of a glutton for naming and numbering structure too, so the purpose of the service determines which VLAN its on. Like Home Assistant has just about its own vlan, with sensors and misc tools in support of it all there. A different one for IoT devices by others (that I will never trust with internet access, so its initiate from another VLAN on the FW only, outbound can’t be initiated from any device on it, etc), one for work thats part of a site-to-site with work, with a few ports on the switch allocated that I can just plug in ad hoc, etc.
Definitely helps to have the range to play it this way!
Its well worth it IMO, makes service segregation so much easier. It may help to toss a router off your main network, and start experimenting that way, give you a decent place to mess things up - which is, again purely my opinion, one of the best ways to learn.
deleted by creator
In my case, I don’t need the isolation of a VM, really I’m just looking to separate the service I’m running into something manageable and easy to move between hosts. I could do a VM for each, but I’d be adding overhead and power requirements without much benefit.
And really that’d all it comes down to for me. Each service is its own LXC, from stuff most self-hosters use, to random one-offs I write. Managing it all stays in ansible for everything, and the structure is quite a bit simpler.
When I do want to bring it elsewhere, I van package it up clean and toss that on a new LXC somewhere else quickly, like an 80 core monster with $16k in GPU thats already getting pushed hard, and knowing it will be of almost no impact to its main job while adding the service it needs.
I do still have VMs, but that is to do things like dealing with windows. Especially specific versions, like a piece of software for some work stuff that requires XP or server 2008 specifically. Its pretty isolated though, not even allowed network access out. All my writes are to a thumb drive if I need to get something out of it (which is uniquely set as the thumb drive its allowed to see).
So nothing that I couldn’t do a bunch of other ways, this is just the structure thats working best for me.
deleted by creator
Ah - yeah ive got trunk to each of the machines in my clusters, 9 vlans total, and of course I can add more whenever this way. I’m a bit of a glutton for naming and numbering structure too, so the purpose of the service determines which VLAN its on. Like Home Assistant has just about its own vlan, with sensors and misc tools in support of it all there. A different one for IoT devices by others (that I will never trust with internet access, so its initiate from another VLAN on the FW only, outbound can’t be initiated from any device on it, etc), one for work thats part of a site-to-site with work, with a few ports on the switch allocated that I can just plug in ad hoc, etc.
Definitely helps to have the range to play it this way!
deleted by creator
Its well worth it IMO, makes service segregation so much easier. It may help to toss a router off your main network, and start experimenting that way, give you a decent place to mess things up - which is, again purely my opinion, one of the best ways to learn.