Yeah I think were on the same track, what I can think of is to do this;

• Set up firewall rules on my LAN router (which hosts the Wireguard server), restricting access to the Wireguard client coming in from the VPS.
• Set up firewall rules on the cloud provider to restrict access to anything but my public IP where the Wireguard server is hosted.
• Do the same in the VPS host internal firewall.
• Configure the Wireguard server and client config to only allow access to the IPs relevant for the clustering.
• Set up CrowdSec as part of Pangolin, it’s an integrated feature
• Move the Newt + service containers exposed via Pangolin to their own isolated VLAN in order to further harden the environment around them
• Configure Nomad and Consul tokens to only allow the VPS to register the Pangolin services and nothing else

But I think that’s kind of where the problem lies; if we’re talking about external firewalls applied on the cloud provider, then I need an external IP for my homelab network to use in the rules, which defeats the point of Pangolin to begin with. And if we’re talking about the firewall inside the VPS, like ufw or whatever, then that would be forfeit if a bad actor would gain root access on that host, they would just disable the rules. This is kind of where my thinking is at currently.

deleted by creator

Interesting read, it does seem like time to start looking at horizontally scaling the workers based on request pressure. Having a dynamic number of workers that can do the database updates and then quickly release the mutex should increase throughput.

That’s interesting, I’ll have to look into that again, they seem to have a server location option that is EU which looks nice, I’ll just need to find out which countries that actually refers to.

I created an account on Scaleway just to check prices, which seem to be the same as Hetzner. But looking around online I find that people are heavily in favor of Hetzner over Scaleway due to reliability and service, so I’m leaning more toward Hetzner.

Is the 1€/month price permanent or a limited time deal where it will go up later? Because I didn’t see that kind of pricing on their site which wouldn’t go up to 12€/month after a year.

"Bob’s steak and video, how can I help you? "