# Proxmox Base Cluster — SNS Networking

**Entity:** SNS Networking · **Status:** Buildable now

## What it is

A single-node (expandable to cluster) Proxmox VE hypervisor that hosts all on-prem
VMs and LXC containers. This is the foundation — everything else in `infra/` runs
on top of this or connects to it.

## Stack

| Component | Software | FOSS | Notes |
|-----------|----------|------|-------|
| Hypervisor | Proxmox VE 8.x | Yes | Debian-based, KVM + LXC |
| Storage | ZFS (local) | Yes | Mirror or RAIDZ1 depending on disk count |
| Networking | Linux bridge + VLANs | Yes | `vmbr0` = management, `vmbr1` = services |
| Backup | Proxmox Backup Server (PBS) | Yes | Separate VM or separate box |
| Templates | Cloud-init images (Debian 12, Rocky 9, Ubuntu 24.04) | Yes | Pulled and prepped with `virt-customize` |
| Automation | Ansible + Proxmox API | Yes | `community.general.proxmox*` modules |

## Topology

```
┌─────────────────────────────────────────────┐
│  Proxmox VE Host (bare metal)               │
│                                             │
│  vmbr0 (mgmt, VLAN 1)    vmbr1 (services, VLAN 10+) │
│  ├── LXC: dns (Pi-hole/AdGuard)            │
│  ├── LXC: nginx-proxy (reverse proxy)      │
│  ├── VM: gitea (code hosting)              │
│  ├── VM: monitoring (Prometheus+Grafana)   │
│  ├── VM: app-01 (general workloads)        │
│  └── VM: pbs (Proxmox Backup Server)       │
│                                             │
│  ZFS pool: rpool (OS) + datapool (VMs)     │
└─────────────────────────────────────────────┘
        │
        ├── WireGuard tunnel → Linode (bastion)
        └── Tailscale mesh (management access)
```

## Build Steps

1. **Install Proxmox VE** on bare metal (Debian netinstall + Proxmox repo, or ISO).
2. **Configure ZFS** — mirror for 2 disks, RAIDZ1 for 3+. Separate `rpool` (OS) from
   `datapool` (VM storage).
3. **Networking** — create `vmbr0` (management) and `vmbr1` (service VLAN). Tag VLANs
   at the switch if physical segregation exists.
4. **Disable enterprise repo, enable no-subscription repo** — remove nag popup.
5. **Cloud-init templates** — download base images, convert to templates:
   ```bash
   wget https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2
   qm create 9000 --memory 2048 --net0 virtio,bridge=vmbr1 --name debian12-template
   qm importdisk 9000 debian-12-generic-amd64.qcow2 datapool
   qm set 9000 --scsihw virtio-scsi-pci --scsi0 datapool:vm-9000-disk-0
   qm set 9000 --ide2 datapool:cloudinit --boot c --bootdisk scsi0
   qm template 9000
   ```
6. **PBS** — install Proxmox Backup Server (separate VM or LXC). Point PVE's storage
   config at it. Schedule nightly backups.
7. **Ansible bootstrap** — run base hardening playbook against all new VMs (SSH keys,
   UFW, fail2ban, unattended-upgrades).

## Security Posture

- **Management access:** Tailscale or WireGuard only. Proxmox web UI not exposed to WAN.
- **SSH:** key-only, no password auth, port 22 behind Tailscale/WireGuard.
- **Firewall:** Proxmox host firewall enabled. Default deny inbound. Allow only
  Tailscale/WireGuard + VLAN inter-traffic as needed.
- **Updates:** `apt` auto-security-updates on host. Manual kernel updates (reboot required).
- **Backups:** PBS with encryption at rest. Retention: 7 daily, 4 weekly, 3 monthly.

## Upgrade Path

- **Multi-node cluster:** Add a second Proxmox host, enable HA with Ceph or shared ZFS-over-iSCSI.
- **Ceph storage:** When local ZFS capacity or redundancy isn't enough.
- **SDN:** Proxmox SDN module for VXLAN overlays if VLAN count gets unmanageable.