I'm not much of a hardware man with respect to specing cases and fans and tend to go with more of what I find online as suggestions.
What is your use expected NFS performance? If you're client devices are connecting via Wifi, even with a good wireless AC connection, you won't see a bottleneck due to VM I/O overhead coming from a pair of SATA Hard drives, especially with large block transfers like backups.
While you certainly can build your solution as you propose, for what you're going to do, especially with respect to running a router on the box, it is a better security practice to have separate VMs hosting the various services. The effective reduction in attack profile is not dramatic when you properly configure your box, but, it's still not beyond what your hardware can do. Most Hypervisors or VM Hosts have the ability to define a virtual network internally, allowing the router VM to have it's internal vNIC share a virtual broadcast domain with the NFS VM on a vNIC if you want. Some even allow you to configure that virtual switch to have an external NIC tied to it. It's going to depend on how you do it. If you're planning on using KVM, I'm not as familiar with it for direct configuration, though, I've used VirtualBox a bunch for similar setups. I use HyperV on the bare metal because I'm familiar with it, and it's free. You can certainly install a minimal Linux OS on the box, lock it down, and then run KVM on that to define your VMs. I'd lock down the base OS with respect to network access and, instead, route all network I/O to the VMs. If you've got a little gigabit switch laying around, you can use the external NICs to have it do the traffic passing between the VMs if you're worried about the virtual packet overhead, though that's usually not needed. I've seen that done in cases where admins are enforcing strict traffic control however.
There are a lot of ways to do this. I prefer to do VM isolation for everything largely due to security, and also because it makes some aspects of managing things easier. I can customize each VM to optimally support it's desired function. Configuring each VM OS for maximum security is easier as each only has to have open the specific ports required for it's function. Troubleshooting is easier because you don't have to deal with OS level interactions between services as well. For your configuration, 4GB of RAM should be fine. If you're configuring Linux to run without an XServer or display manager, then that's plenty. I try to have multiple GB of RAM for gateway routers because I like to setup small WAN caches to help with keeping the traffic going. I also tend to use software appliances, which also have a bit of extra overhead in them. Wile Proxy caches aren't nearly as effective as they used to be, they still have a place. There is still a lot of common static bits of web out there that can be cached and served up quickly. Half a gig to a gig of cache area is usually more than enough to catch 90% of that, and can certainly take a bite out of your WAN traffic load. With a 1 gig WAN connection, it won't seem like a big deal, and it probably isn't, but, it's still something that I commonly configure.
Again, your way will certainly work, and if that's a way you feel comfortable doing it, then do it.
Facebook
Twitter