---
title: Netmaker
---

<div class="ascii-wrapper">
<pre><code><div align="center">
 __    __    ________    ________    __       __     ______     __    __    ________    _______  
|\_\  |\_\  |\ ______\  |\ ______\  |\_\     /\_\   /\ ____\   |\_\  /\_\  |\ ______\  |\ _____\ 
| XX\ | XX  | XXXXXXXX   \XXXXXXXX  | XX\   /  XX  |\ XXXXXX\  | XX /  XX  | XXXXXXXX  | XXXXXXX\
| XXX\| XX  | XX__         | XX     | XXX\ /  XXX  | XX__| XX  | XX/  XX   | XX__      | XX__| XX
| XXXX\ XX  | XX _\        | XX     | XXXX\  XXXX  | XX __\XX  | XX  XX    | XX _\     | XX __\XX
| XX\XX XX  | XXXXX        | XX     | XX\XX XX XX  | XXXXXXXX  | XXXXX\    | XXXXX     | XXXXXXX\
| XX \XXXX  | XX_____      | XX     | XX \XXX| XX  | XX  | XX  | XX \XX\   | XX_____   | XX  | XX
| XX  \XXX  | XX ____\     | XX     | XX  \X | XX  | XX  | XX  | XX  \XX\  | XX ____\  | XX  | XX
 \XX   \XX   \XXXXXXXX      \XX      \XX      \XX   \XX   \XX   \XX   \XX   \XXXXXXXX   \XX   \XX
                                                                                                 
                                                                                  SA6ANW 20240104
</div></code></pre>
</div>

**Netmaker**<br>
Wireguard VPN & Software Defined Networking

Med Netmaker Kan jag styra kommunikationen precis som jag vill. Det påminner om Tailscale men man har möjlighet att hosta det själv. Jag kör version 0.17.0. 

För att köra netnetmaker
Skapa en `docker-compose.yaml` med följande innehåll

    version: "3.4"

    services:
    netmaker:
        container_name: netmaker
        image: gravitl/netmaker:v0.17.0
        cap_add: 
        - NET_ADMIN
        - NET_RAW
        - SYS_MODULE
        sysctls:
        - net.ipv4.ip_forward=1
        - net.ipv4.conf.all.src_valid_mark=1
        - net.ipv6.conf.all.disable_ipv6=0
        - net.ipv6.conf.all.forwarding=1
        restart: always
        volumes:
        - dnsconfig:/root/config/dnsconfig
        - sqldata:/root/data
        - mosquitto_data:/etc/netmaker
        environment:
        SERVER_NAME: "broker.netmaker.sa6anw.se"
        SERVER_HOST: "81.170.219.67"
        SERVER_API_CONN_STRING: "api.netmaker.sa6anw.se:443"
        COREDNS_ADDR: "81.170.219.67"
        DNS_MODE: "on"
        SERVER_HTTP_HOST: "api.netmaker.sa6anw.se"
        API_PORT: "8081"
        CLIENT_MODE: "on"
        MASTER_KEY: "Masterkey"
        CORS_ALLOWED_ORIGIN: "*"
        DISPLAY_KEYS: "on"
        DATABASE: "sqlite"
        NODE_ID: "netmaker-server-1"
        MQ_HOST: "mq"
        MQ_PORT: "443"
        MQ_SERVER_PORT: "1883"
        HOST_NETWORK: "off"
        VERBOSITY: "1"
        MANAGE_IPTABLES: "on"
        PORT_FORWARD_SERVICES: "dns"
        MQ_ADMIN_PASSWORD: "AdminPassword"
        ports:
        - "51821-51830:51821-51830/udp"
    netmaker-ui:
        container_name: netmaker-ui
        image: gravitl/netmaker-ui:v0.17.0
        depends_on:
        - netmaker
        links:
        - "netmaker:api"
        restart: always
        environment:
        BACKEND_URL: "https://api.netmaker.sa6anw.se"
      caddy:
        image: caddy:2.6.2
        container_name: caddy
        restart: unless-stopped
        volumes:
          - ./Caddyfile:/etc/caddy/Caddyfile
          - caddy_data:/data
          - caddy_conf:/config
        ports:
          - "80:80"
          - "443:443"
    coredns:
        container_name: coredns
        image: coredns/coredns
        command: -conf /root/dnsconfig/Corefile
        depends_on:
        - netmaker
        restart: always
        volumes:
        - dnsconfig:/root/dnsconfig
    mq:
        container_name: mq
        image: eclipse-mosquitto:2.0.15-openssl
        depends_on:
        - netmaker
        restart: unless-stopped
        command: ["/mosquitto/config/wait.sh"]
        environment:
        NETMAKER_SERVER_HOST: "https://api.netmaker.sa6anw.se"
        volumes:
        - ./mosquitto.conf:/mosquitto/config/mosquitto.conf
        - ./wait.sh:/mosquitto/config/wait.sh
        - mosquitto_data:/mosquitto/data
        - mosquitto_logs:/mosquitto/log
    volumes:
    caddy_data: {}
    caddy_conf: {}
    sqldata: {}
    dnsconfig: {}
    mosquitto_data: {}
    mosquitto_logs: {}

- Byt till din egen domän
- Sätt lång MASTER_KEY och MQ_ADMIN_PASSWORD

Du behöver också filen `Caddyfile` i samma folder med följande innehåll

    {
            # LetsEncrypt account
            email sa6anw@gmail.com
    }

    # Dashboard
    https://dashboard.netmaker.sa6anw.se {
            # Apply basic security headers
            header {
                    # Enable cross origin access to *.netmaker.sa6anw.se
                    Access-Control-Allow-Origin *.netmaker.sa6anw.se
                    # Enable HTTP Strict Transport Security (HSTS)
                    Strict-Transport-Security "max-age=31536000;"
                    # Enable cross-site filter (XSS) and tell browser to block detected attacks
                    X-XSS-Protection "1; mode=block"
                    # Disallow the site to be rendered within a frame on a foreign domain (clickjacking protection)
                    X-Frame-Options "SAMEORIGIN"
                    # Prevent search engines from indexing
                    X-Robots-Tag "none"
                    # Remove the server name
                    -Server
            }

            reverse_proxy http://netmaker-ui
    }

    # API
    https://api.netmaker.sa6anw.se {
            reverse_proxy http://netmaker:8081
    }

    # MQ
    wss://broker.netmaker.sa6anw.se {
            reverse_proxy ws://mq:8883
    }
- Samma sak här, byt till din domän och mailadress.

Som näst sista filen du behöver är `wait.sh` 

    #!/bin/ash

    wait_for_netmaker() {
    echo "SERVER: ${NETMAKER_SERVER_HOST}"
    until curl --output /dev/null --silent --fail --head \
        --location "${NETMAKER_SERVER_HOST}/api/server/health"; do
        echo "Waiting for netmaker server to startup"
        sleep 1
    done
    }

    main(){
    # wait for netmaker to startup
    apk add curl
    wait_for_netmaker
    echo "Starting MQ..."
    # Run the main container command.
    /docker-entrypoint.sh
    /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf

    }

    main "${@}"

Till sist `mosquitto.conf`

    per_listener_settings false
    listener 8883
    protocol websockets
    allow_anonymous false

    listener 1883
    protocol websockets
    allow_anonymous false

    plugin /usr/lib/mosquitto_dynamic_security.so
    plugin_opt_config_file /mosquitto/data/dynamic-security.json


Sen är det bara att köra `docker-compose up -d`

**Modifiering**<br>
Jag har valt att bryta ut caddy så att jag kan köra fler tjänster med bara en publik IP.

Modifiera `docker-compose.yaml` på följande sätt

    version: "3.4"

    services:
    netmaker:
        container_name: netmaker
        image: gravitl/netmaker:v0.17.0
        cap_add: 
        - NET_ADMIN
        - NET_RAW
        - SYS_MODULE
        sysctls:
        - net.ipv4.ip_forward=1
        - net.ipv4.conf.all.src_valid_mark=1
        - net.ipv6.conf.all.disable_ipv6=0
        - net.ipv6.conf.all.forwarding=1
        restart: always
        volumes:
        - dnsconfig:/root/config/dnsconfig
        - sqldata:/root/data
        - mosquitto_data:/etc/netmaker
        environment:
        SERVER_NAME: "broker.netmaker.sa6anw.se"
        SERVER_HOST: "81.170.219.67"
        SERVER_API_CONN_STRING: "api.netmaker.sa6anw.se:443"
        COREDNS_ADDR: "81.170.219.67"
        DNS_MODE: "on"
        SERVER_HTTP_HOST: "api.netmaker.sa6anw.se"
        API_PORT: "8081"
        CLIENT_MODE: "on"
        MASTER_KEY: "MasterKey"
        CORS_ALLOWED_ORIGIN: "*"
        DISPLAY_KEYS: "on"
        DATABASE: "sqlite"
        NODE_ID: "netmaker-server-1"
        MQ_HOST: "mq"
        MQ_PORT: "443"
        MQ_SERVER_PORT: "1883"
        HOST_NETWORK: "off"
        VERBOSITY: "1"
        MANAGE_IPTABLES: "on"
        PORT_FORWARD_SERVICES: "dns"
        MQ_ADMIN_PASSWORD: "AdminPassword"
        ports:
        - "51821-51830:51821-51830/udp"
    +   - "8081:8081"
      netmaker-ui:
        container_name: netmaker-ui
        image: gravitl/netmaker-ui:v0.17.0
        depends_on:
        - netmaker
        links:
        - "netmaker:api"
        restart: always
        environment:
        BACKEND_URL: "https://api.netmaker.sa6anw.se"
    +   ports:
    +   - "8080:80"
    - caddy:
    -   image: caddy:2.6.2
    -   container_name: caddy
    -   restart: unless-stopped
    -   volumes:
    -     - ./Caddyfile:/etc/caddy/Caddyfile
    -     - caddy_data:/data
    -     - caddy_conf:/config
    -   ports:
    -     - "80:80"
    -     - "443:443"
      coredns:
        container_name: coredns
        image: coredns/coredns
        command: -conf /root/dnsconfig/Corefile
        depends_on:
        - netmaker
        restart: always
        volumes:
        - dnsconfig:/root/dnsconfig
      mq:
        container_name: mq
        image: eclipse-mosquitto:2.0.15-openssl
        depends_on:
        - netmaker
        restart: unless-stopped
        command: ["/mosquitto/config/wait.sh"]
        environment:
        NETMAKER_SERVER_HOST: "https://api.netmaker.sa6anw.se"
        volumes:
        - ./mosquitto.conf:/mosquitto/config/mosquitto.conf
        - ./wait.sh:/mosquitto/config/wait.sh
        - mosquitto_data:/mosquitto/data
        - mosquitto_logs:/mosquitto/log
    +  ports:
    +   - "8883:8883"
    volumes:
    caddy_data: {}
    caddy_conf: {}
    sqldata: {}
    dnsconfig: {}

Filen `Caddyfile` kan du ta bort