chrisl's questions

I've written a backup script in python using tar (via subprocess) to do incremental backups of my files. As some of the full backups are rather big (like my picture folder) and take multiple hours to be finished (over the network to my NAS), I'm worried about what happens, when the server/PC is shutdown/rebooted during the backup.

I guess the script will get a TERM signal on shutdown/reboot. Does tar handle the interruption of the incremental backup gracefully, so that the next call to tar will successfully add all missing files, not retransmitting all previous files?

If it does not, what does this mean for my tar file and the snapshot file used by tar (with the --listed-incremental option)?

The exact command I use is:

tar -vcpzf <target_file> --no-check-device -g <target_snapshot_file> <dir_to_backup>

Note: On my PC I plan to run the script via anacron, though itself checks if a backup is due when executed.

Background: We have a Gitlab instance running, which is reachable over 2 different domains from 2 different networks (that is mandated by the network structure and cannot be changed). Gitlab supports only 1 domain. In the past it worked out of the box, but with the last update the links to the files in a repository are set to the main domain, even when coming from the second domain. So we are able to browse the Gitlab UI through the second domain flawlessly. But as we click on a file in a repository, the domain changes from the second to the main domain (which isn't reachable from the second network), because the links for the files are absolut URLs with the main domain. This means, that we cannot open a file in the Gitlab Web UI from the second domain. The problem is only, that these are absolute links with the wrong domain. With changing the domain by hand we can still display the files.

The Gitlab Support stated, that it is not supported by Gitlab itself, but it should be possible to configure Nginx (which is used by Gitlab) to rewrite the URLs depending on the requesting domain. I couldn't find corresponding results, when search on the web (only about rewriting requested URLs, not the links on the site).

To further describe the structure of the problem, please look at this diagram:

The single Gitlab server is reachable over 2 individual loadbalancers (which act here as routers, since they only point to that one server). They are reachable under their own domain (maindomain.com and seconddomain.com respectively) and only through their own network. The Gitlab instance is configured for the maindomain.com domain and cannot directly be configured for a second domain. The problem described above arises when trying to open a file in the web UI while being connected through the second network and seconddomain.com. All that is embedded into the organizational networks and is not reachable from the internet.

TL;DR: Is it possible to let Nginx rewrite absolute URLs in links on a served website depending on the requesting URL of the website? If yes, how can it be done?

I have a VPS running multiple docker containers. I have a nextcloud instance, which get's SSL/TLS termination by an nginx proxy (certificates from Let'sEncrypt). And I have an openvpn container. In it's docker network I also host further services (own bind dns server and a git server), that I can reach trough the VPN.

Now I also want to reach my nextcloud instance through the VPN. Originally I thought this wouldn't be a problem, since the nextcloud instance can be reached through the internet and the VPN also gives connection to the internet. But unfortunately I cannot reach it. If I curl my server (http or https) through the VPN I get "port 80/443: No route to host". Without connecting the VPN the connection works correctly.

If I use traceroute, I can see, that it correctly reaches the public IP of my VPS. So I conclude, that it is a problem with the routing. The traffic targeted to port 80/443 on the public IP of my VPS don't get forwarded/routed to the nginx proxy container (which exposed the mentioned ports).

As I understood, docker uses firewalld/iptables to route the traffic between and to containers. Thus other rules are applied to the VPN traffic, than the traffic comming from the internet. What do I need to configure how, so that the VPN traffic (server internal) to my public IP address is forwarded correctly to the corresponding container? I would like to maintain constant/unchanged connectivity between VPN & No-VPN states, so that my Nextcloud app does not get confused.

What I have tried: I tried out possibilities of a workaround. I could add an own DNS entry for my nextcloud instance in my VPN DNS server, which points to the IP of the nextcloud app container (where I would loose SSL/TLS termination) or of the nginx proxy. In the last case the nginx proxy does not forward the traffic to the nextcloud container, since it uses a different hostname. I want to leave the proxy configuration unchanged, if possible, since it is automatically filled at container startup/from the letsencrypt companion container. Also the certificates would not match up with the used FQDN. If I try to add a master zone with my real/public DNS name (so that I can use the same FQDN as from the outside), all other domains from that TLD don't get forwarded anymore (Is there a possibility to configure bind for that?).

TL;DR: Traffic from a docker container to the public VPS IP address does not get forwarded to the correct docker container, like traffic from outside does.

If you also need more information about the used containers, I will add links and my docker-compose files.

EDIT:

[root@XXXXXXXX ~]# iptables -S FORWARD
-P FORWARD ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o br-7e5cecc96f4a -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-7e5cecc96f4a -j DOCKER
-A FORWARD -i br-7e5cecc96f4a ! -o br-7e5cecc96f4a -j ACCEPT
-A FORWARD -i br-7e5cecc96f4a -o br-7e5cecc96f4a -j ACCEPT
-A FORWARD -o br-fd56ce52983e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-fd56ce52983e -j DOCKER
-A FORWARD -i br-fd56ce52983e ! -o br-fd56ce52983e -j ACCEPT
-A FORWARD -i br-fd56ce52983e -o br-fd56ce52983e -j ACCEPT
-A FORWARD -o br-f1ef60d84b48 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-f1ef60d84b48 -j DOCKER
-A FORWARD -i br-f1ef60d84b48 ! -o br-f1ef60d84b48 -j ACCEPT
-A FORWARD -i br-f1ef60d84b48 -o br-f1ef60d84b48 -j ACCEPT
-A FORWARD -o br-b396aa5a2d35 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-b396aa5a2d35 -j DOCKER
-A FORWARD -i br-b396aa5a2d35 ! -o br-b396aa5a2d35 -j ACCEPT
-A FORWARD -i br-b396aa5a2d35 -o br-b396aa5a2d35 -j ACCEPT
-A FORWARD -o br-83ac9a15401e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-83ac9a15401e -j DOCKER
-A FORWARD -i br-83ac9a15401e ! -o br-83ac9a15401e -j ACCEPT
-A FORWARD -i br-83ac9a15401e -o br-83ac9a15401e -j ACCEPT
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

I'm running a VPS of a german provider and want to switch from Ubuntu to CentOS. There I tried to install firewalld (was not preinstalled), but it always fails with the error

ERROR: Failed to load nf_conntrack module: modprobe: ERROR: could not find module by name='nf_conntrack'
modprobe: ERROR: could not insert 'nf_conntrack': Function not implemented
modprobe: ERROR: Error running install command for nf_conntrack
modprobe: ERROR: could not insert 'nf_conntrack': Operation not permitted

Obviously the nf_conntrack kernel module was not found. Since this is a VPS, I cannot tinker with the kernel modules. On the support site of my provider I found a list of available kernel modules, for example:

ip_conntrack_netbios_ns
ipt_conntrack   
ip_conntrack   
ip_conntrack_ftp   
ip_conntrack_irc

Since nf_conntrack is not listed here, does that mean, that I cannot use firewalld? Is it possible to run it without this module?

I guess I could use iptables, if I wanted to (it seems to run correctly). But as I have more experience with firewalld, I would like to stick with it.

CentOS Linux release 7.7.1908 (Core)

uname -a: Linux xxxxxx.xxxxxxxx.xxx 3.10.0-042stab140.1 #1 SMP Thu Aug 15 13:32:22 MSK 2019 x86_64 x86_64 x86_64 GNU/Linux