NethServer 8: planning an evolution

Yes, there is a developer documentation:

https://docs.nethserver.org/projects/nethserver-devel/en/latest/building_rpms.html

Also I think @mrmarkuz, @giacomo, @stephdl and @davidep could hep if you have questions on building an own rpm.

2 Likes

@tessierp
@m.traeumner

They can also give helpful pointers about adding to the Modules WIki, how the Module ā€œappearsā€ in Cockpit, and much more!

My 2 cents
Andy

Thanks for the info @Andy_Wismer @m.traeumner. I may try that when I get more time. Right now I’m still trying to get things setup… Working during the day, working on setting my new server environment sometimes at night, taking care of my son… No excuses but if I can help I’ll do it. But I cannot make any promises just yet. Just don’t want to create any expectations or promises I can’t make.

2 Likes

@tessierp

Not creating expectations or pressure in any form.
Just providing pointers, so you can make your own free decision… :slight_smile:

2 Likes

I know. I do like to help when I can. And I strongly believe in Open Source. The help anyone gives me I use that for myself and to help others around me as well. It is all in the spirit of sharing, that is how we evolve. The strength of collaboration.

3 Likes

Interesting discussion :grinning:

Briefly thinking about the top-level how see two major directions:

  • containerized: every (group of) module(s) are distributed as (and run in) containers.
  • or (as is) run services in user-sessions.

In the end it can be a hybrite setup deploying them both…

I think it fair to say Docker dominates the container space, but it is not the only option. (LXC?)
For the running the services on the server as-is one could consider distro-agnostic packaging with more ā€œsand-boxedā€ properties. Not being very familiar with them found 3 options:

  • Flattpack: most used to distribute desktop applications which kind of run sand-boxed. Developed by the gnome team
  • AppImage: most used to distribute complete user applications (such as games). Interesting to note is, it are actually iso (CD) files which get mounted and run sand-boxed.
  • Snappy: aimed to distribute server applications/services. On first sight it seem to be the best fit (if you aim at distro-agnostic packaging), As @Andy_Wismer mentioned above it does not have wide adoption outside the Ubuntu eco-system, and they are the main (sole?) developers of it. (I’m completely unfamiliar with snappy…)

@mark_nl

Hi Mark

Canonical does nou open source the code behind the shop, so no other ā€œshopā€ for snaps exist…
Narrow minded view of open source…

And not the only bad decision from Canonical…

My 2 cents
Andy

And for anyone who says: Yes, but it works: I just say, sure, so does Windows… :slight_smile:

@mark_nl I like Docker but there are other solutions indeed. I experimented with Kubernetes and while the learning curve is steeper, I do think it is way more powerful.

A microservice approach is the way of the future. It just makes installing everything easier and if ever you have a problem or something goes corrupt, no problem you just bring your image and you get up and running fast. Even from a development stand point, who wants to install a SQL server on his machine anything, why not containerize it? There applications are endless.

1 Like

Yes I see those advantages too. :slight_smile: Probably because I’m quite conservative also see some disadvantages:

  • Multiple similar services running in the containers, such as running a db in them where it can easily be done by one forked daemon.
  • Burden of maintenance from the developer side. Instead of relying on a distro (package manger) to supply updates of common used services (applications) the publisher of a container might have do more work here ( or am I mistaken ? )

As said: tend to be a bit traditional :sweat: so convince me ohter-wize! :upside_down_face:

You are right!
Only the client side is open, not de server side.
Did not realize it’s impossible to set up you own repo. :fearful:

@mark_nl

Actually, from the perspective of a developer I see nothing but benefits. Take for example, you no longer have to maintain DEPLOYMENT DOCUMENTS, and assist during rollbacks. It really makes you life easier… Yes you do need to preparer the packages and all but usually the rest is handled by a DevOps Specialist unless you know how to do that yourself.

As for the other problem, it all comes down the flexibility and how you want to configure your microservice. In the configuration you either specify local DB or remote DB. It all comes down to flexibility and configuration. And a DB is just one example.

Good to read. Should have mentioned am not a software developer…

__ OT __
The software wizz-kids yell at me regularly if I write some code:
Why didn’t you put this in a class !
And on my turn yell back why do you put everything in a class with those stupid getters and setters while it basically is a function…
Lose the argument most times though…

@mark_nl

There is specific use for things like, for example, C (procedural programming), for many other apps, I would go with classes. It gives you the possibility to reuse code more efficiently like a container (classes), it has a specific use / purpose. The getters and setters if to get you specific data but you still have functions inside to accomplish work. Classes also allow you to better protect your code through public protected and private accessors (public for everyone, protected accessible but all derived classes, private only accessible by the class implementing it)… Btw, getters in C# for example, translate to functions that just give you access to a specific piece of information.

One of the reason why you wouldn’t use an object oriented language is for speed but the speed advantages of procedural programming over object oriented diminished over the years but yes it still maintains an edge. Like I said, depending on what you do, it is better to chose one over the other. It is like for C# and .NET CORE. It is amazing in many regards, EF CORE (ORM) is super fast now, comparable to Dapper in terms of speeds, faster than NODE.JS… Makes development of Restful APIs easy. I prefer it over Node.JS or Python’s / Django. However, would I use C# for, lets say, a system that requires to respond quickly at a given interval? Maybe not because then the garbage collector would come in and ruin your day. But are trying to make better (Garbage collection) each time so who knows in the future… Oh and now you can use C# and .NET CORE on any platform! Including Linux!! I’m certainly very happy about that.

What I am saying is, there is a right tool for everything. :slight_smile:

1 Like

Well, i am kinda worried, becouse i like too much NethServer! :stuck_out_tongue:

This topic worries me more than the other about RedHat/IBM behaviour. Hahaha! Anyway i wanto to point out @Andy_Wismer introduced me to OpenSense, and boy, its awesome! So, why not consider FreeBSD, it has been around and stable for a lot of time.

So, that beeing said, i would like to add that, at least here in Brazil, most of my clients are replacing Firewalls for router boxes from tplink and cisco, like RV320. And i saw people here saying that some NAS has some modules that can do wonders… okey, i get that, and i saw some really awesome NAS indeed.

The idea of having NethServer 8 be just a solid base to run or orchestrate multiple services… is VERY cool… so why not having two solutions? This and a All in One Server?! :slight_smile: I know its too much to ask, lol… but i would love to manage all my nethservers (7) from my only laptop! :smiley: hahaha

3 Likes

@ssabbath

Hi

Even though some NAS include ā€œusableā€ firewall functions, there’s still the caveat:

Internet Problem, box needs a reboot.
All File users (It IS a NAS, mainly!) will get disconected because of a problem not directly affecting them at that moment…

A dedicated box can be rebooted (cable network funky, Fiber interrupted, etc…), without interrupting ANY other services…

My 2 cents
Andy

2 Likes

NS has invested big time in cockpit to be the base for web-ui, for good reasons because it integrates much of the Linux based distro’s application interfaces. In the end of day (like it or not… I do) it depends on systemd. This kinda puts all BSD’s out off the scope…

For the mortals among us, which includes me, solutions like OpenSense and pfSence and the like are awesome however (IMHO) the needed knowledge threshold to set it up in a reasonable way surpasses NS philosophy. Note do not say they are hard to use once you know what you are doing with a particular setting.

To keep the conversation going, could NS stay a all-in-one server which teams-up with a firewall on dedicate hardware? Meaning one administration interface face?

3 Likes

I agree with you @mark_nl. While I did venture into this OPNSense world and it is great, Nethserver offers a more simplistic approach that would work better for many.

As for changing to FreeBSD, personally I wouldn’t go that route. Many say it is more secure, it has been a round a long time, and I’ve seen a lot of debates on security comparing FreeBSD with Linux and there was never a clear winner. I have chosen OPNSense because I needed a bit more and yes I did have less of a hard time with VPN. VPN never fully worked for me with Nethserver and it worked well right away with OPNSense. That being said, if I would have to do anything from the command line (if it didn’t have a good UI) I would be lost because I know LINUX best.

Perhaps it is just me but there are way more Linux stuff around and while FreeBSD may have been around a bit more, Linux is catching up very fast, it is very secure and you have so much choice out there in terms of distribution. I would compare JAVA to C#. C#, while younger, is not much more advanced and offers way more features than Java… I guess Oracle is to blame for that.

If there was an equivalent to OPNSense offered using Linux, I would go with that over FreeBSD. Again it has nothing to do with me being against it but that there is way more knowledge out there in terms of Linux stuff…

Last but not least, I don’t know if I have been unlucky but there is the matter of community support. Reaching out to the OPNSense community is A PAIN! If you are too junior or you have a question elites just don’t care to answer because they see it is a newb question, GOOD LUCK getting any kind of help. I have been lucky to have @Andy_Wismer help me who has a lot of experience (and yes Thank you Andy!!). If I would have to poke around OPNSense at the command line, it would be more difficult even because of what I explained… I would also like to say, I can’t remember what system I wanted to install almost two years ago, it was also based on FreeBSD and the support was HORRIBLE! I was not asking for anyone to do my work for me but, at least some kind of collaboration like we have here. So like I said, I don’t know if I was unlucky but so far everything FreeBSD related has left me with a bitter taste. Again I mean no offense to those who like FreeBSD, these are just my observations based on experience.

That being said, I do hope Nethserver sticks around and I do hope it remains Linux based.

1 Like

To answer that question, it could be but it could make things difficult if they need to move on to a new technology which could come in conflict with something else you use in Nethserver. It would involve challenges. I’m not saying it is impossible but you are talk working with another team. It would definitely slow things down. Again not impossible. The other good question is with whom? The only two top firewall systems are there are pFSense and OPNSense as far as I could see that are free. Well pFSense has been acquired by Netgear and they have done shady stuff so, I don’t even consider it ā€œOpen Sourceā€ anymore. That leaves OPNSense which is FreeBSD based which would be a challenge.

2 Likes

If talking about dedicated, free Linux firewalls (Open Source!), there’s also IPfire…

But IMHO, it’s a bit behind (GUI, etc) even if actively developped.

My 2 cents
Andy

2 Likes

Ohh yeah!!! How could I forget, I remember seeing that a while ago. I dismissed it at the time because it just looked so hard to use. But yes I presume this could be an alternative one day… The UI feels very old indeed.

IPfire is a pain, but last time i tested it didnt had transparent https proxy… so… long time ago! :stuck_out_tongue: