Install instructions for vyos podman deployment

[cavanaug]

It would be really ideal if you had instructions on how to configure/deploy this on the vyos host via podman. Think if it as sort of the if this was automatically delivered with vyos and was the default ui model.

[xTITUSMAXIMUSX]

We don't recommend installing VyM this on VyOS itself. With that said, nothing is stopping you from deploying this however you want to use it. There are multiple paths to setting this up on vyos with podman, but for us to pick one wouldn't be wise. Depends on what kind of network you choose, which leads to what kind of firewall rules to use. Is the user using zone based firewall? is it the old standard firewall? If they chose to to create a network, what IP range did they choose? Then what static IP's need to be selected for each pod?

There are a lot of variables for this and this was just a few examples, but I think we can give a general guide on what needs to be set in terms of of the pods and its environment variables and persistent storage, but leave it up to the user on how it is deploy in the environment.

[mihakralj]

reference to initial (working) config: mihakralj/vyos-ls1046a-build#43 (comment)

[felbinger]

I agreen with @xTITUSMAXIMUSX, this adds too much complexity to the router and if possible you should not deploy VyM on VyOS.
However I tested it anyway, because for people with just one VyOS instance it might be the convincing argument to switch from something like OPNsense.

The linked post summarized it quiet well and was followed mostly.

In case you configured VRF's and GRT has no internet access, you can use the following command to download the images.

sudo ip vrf exec internet /opt/vyatta/bin/vyatta-op-cmd-wrapper add container image postgres:15-alpine
sudo ip vrf exec internet /opt/vyatta/bin/vyatta-op-cmd-wrapper add container image ghcr.io/community-vyprojects/vymanager-frontend:beta
sudo ip vrf exec internet /opt/vyatta/bin/vyatta-op-cmd-wrapper add container image ghcr.io/community-vyprojects/vymanager-backend:beta

For testing purpose I set up VyM in my management VRF using:

set container network vymanager prefix '10.0.0.248/29'
set container network vymanager vrf 'management'

set container name vymanager-postgres image 'postgres:15-alpine'
set container name vymanager-postgres network vymanager address 10.0.0.250
set container name vymanager-postgres volume data destination '/var/lib/postgresql/data'
set container name vymanager-postgres volume data source '/config/vymanager/postgres'
mkdir -p /config/vymanager/postgres
set container name vymanager-postgres environment POSTGRES_DB value 'vymanager'
set container name vymanager-postgres environment POSTGRES_USER value 'vymanager'
set container name vymanager-postgres environment POSTGRES_PASSWORD value 'vymanager_secure_password'

set container name vymanager-backend image 'ghcr.io/community-vyprojects/vymanager-backend:beta'
set container name vymanager-backend network vymanager address 10.0.0.251
set container name vymanager-backend environment DATABASE_URL value 'postgresql://vymanager:vymanager_secure_password@10.0.0.250:5432/vymanager'
set container name vymanager-backend environment FRONTEND_URL value 'http://10.0.0.252:3000'
set container name vymanager-backend environment SSH_ENCRYPTION_KEY value 'your-ssh-encryption-key-change-in-production'

set container name vymanager-frontend image 'ghcr.io/community-vyprojects/vymanager-frontend:beta'
set container name vymanager-frontend network vymanager address 10.0.0.252
set container name vymanager-frontend environment DATABASE_URL value 'postgresql://vymanager:vymanager_secure_password@10.0.0.250:5432/vymanager'
set container name vymanager-frontend environment BACKEND_URL value 'http://10.0.0.251:8000'
set container name vymanager-frontend environment BETTER_AUTH_SECRET value 'your-super-secret-key-change-in-production'
set container name vymanager-frontend environment BETTER_AUTH_URL value 'http://10.0.0.252:3000'
set container name vymanager-frontend environment FRONTEND_URL value 'http://10.0.0.252:3000'
set container name vymanager-frontend environment TRUSTED_ORIGINS value 'http://10.0.0.252:3000'
set container name vymanager-frontend environment NODE_ENV value 'production'
set container name vymanager-frontend environment VYMANAGER_ENV value 'production'

But this doesn't seam to work. I will take a look into this and report the result.

Details

The containers do all start as expected and can communicate with each other, however the container network cannot reach or be reached from outside. Not sure how to investigate whats going on. This might be a weird edge case with vrf and netns usage.

Backend Logs

🚀 Starting VyManager API (Multi-Instance Architecture)

📦 Initializing database connection...
✓ Database connection pool created
✓ Authentication middleware enabled
✓ Session middleware enabled
✓ Session cleanup task started
✓ SSE banner poller started

🧹 Session cleanup task started (timeout: 30min, interval: 5min)
✓ Revocation bus listening

✓ API Ready

VyOS instances are managed through the database.
Users connect to instances via the web UI (/sites page).

INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)

Frontend Logs

🚀 Starting VyManager Frontend...
⏳ Waiting for PostgreSQL...
✅ PostgreSQL is ready!
📦 Generating Prisma Client...
[177B blob data]
For more information, see: https://pris.ly/prisma-config

Prisma schema loaded from prisma/schema.prisma

✔ Generated Prisma Client (v6.19.3) to ./node_modules/@prisma/client in 462ms

Start by importing your Prisma Client (See: https://pris.ly/d/importing-client)

Tip: Interested in query caching in just a few lines of code? Try Accelerate today! https://pris.ly/tip-3-accelerate

[45B blob data]
📋 Applying existing migrations...
[177B blob data]
For more information, see: https://pris.ly/prisma-config

[cavanaug]

I agreen with @xTITUSMAXIMUSX, this adds too much complexity to the router and if possible you should not deploy VyM on VyOS. However I tested it anyway, because for people with just one VyOS instance it might be the convincing argument to switch from something like OPNsense.

This is exactly the use case I am interested in. I am currently sort of pfsense refugee looking for a new home. I could move to opnsense, but honestly Im tired of dealing with the various differences between bsd and linux.

The vyos llm optimized documentation is a significant aid in configuring things for someone not super familiar with vyos commands etc. Long ago I had an edge router (vyatta based) that I only used as a super basic router for my home network. Ive significantly expanded my home network/lab over the years with pfsense configuring with multiple vlans for isolation of iot gunk, guest network (kids friends etc), traffic shaping, etc.

Vyos has more core features/capabilities than what I need for my homelab, but it is missing the UI that would make my life much easier.

I know that vyos is really targeted for larger and much more complex environments than my home/homelab. Obviously the following suggestion is a bit self serving and may not align with what vyos wants to do and which customer base they want to encourage/support, but damn, it would be sooooo nice for someone like me...

With the advent of VyM I think there is opportunity to really capture the advanced home user and homelab enthusiast segment. I could envision something like a VyOS-HomeLab edition, which is a prepacked LTS with an included VyM (maybe sqlite based). Im not thinking a full VyOS feature set, im thinking a removal of advanced enterprise grade features. Things like site to site vpn, advanced flow statistics, enterprise auth integration and anything beyond a homelab could be removed. It would keep things like vlans, firewall, add things like tailscale/wireguard, pihole, VyM, and maybe have a recommend blueprint for a home layout (vlans for guest, iot etc).

Now something like this while super valuable to more advanced home users it may not grow the community in the direction you want. You could get a large volume of advanced home users, but these are nowhere near the same as advanced enterprise grade users. But the question becomes what does the vyos community gain from this type of solution, is there a way this helps vyos revenue streams? Does it help with testing, does it help with training/growing user base. Is it worth it to maintain a mini feature reduced version?? Is the juice worth the squeeze??? Only thing I could envision is if you guys restricted the api model for this mini-release and sold a mobile app to aid with configuration, charge $20 for the app.