# Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready
for IncusOS lab deployments. The result is identical to a local Proxmox
setup (like a Beelink mini PC) but with more resources and accessed
via a WireGuard tunnel instead of LAN.

## Prerequisites

- A Hetzner dedicated server (server auction recommended)
  - Intel CPU with VT-x/VT-d (nested virtualization)
  - 32+ cores, 128+ GiB RAM
  - 2+ disks (ZFS mirror for system, extra disks for VM storage)
- An SSH key pair on your workstation
- A VNC client (for the Proxmox installer)
- This repository cloned locally

## Workflow

The setup is split into a manual guide and an automated script:

### 1. Manual: rent server and install Proxmox

Follow [hetzner-setup.md](hetzner-setup.md) sections 1-2:

- Pick and order a server from the Hetzner auction
- Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
- Fix the network interface name, reboot, verify SSH works

### 2. Manual: set up SSH alias

Follow [hetzner-setup.md](hetzner-setup.md) section 3.1-3.3:

```bash
ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version   # Must succeed
```

### 3. Automated: configure everything else

```bash
hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute
```

The script interactively configures: repos and updates, private bridge
(vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown,
and API tokens for `incusos-proxmox`.

### 4. Deploy IncusOS VMs

```bash
cp envs/hetzner/proxmox.yaml.example envs/hetzner/proxmox.yaml
# Fill in the API token from step 3

export PROXMOX_TOKEN_SECRET="<token>"
bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
                    envs/hetzner/lab-cluster.yaml
```

## What's in this directory

| File | Description |
|------|-------------|
| [hetzner-setup.md](hetzner-setup.md) | Manual guide: server selection, Proxmox install, SSH setup |
| [proxmox-setup](proxmox-setup) | Interactive script: repos, networking, storage, WireGuard, firewall, API tokens |

## Network architecture

```
Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
```

- **vmbr0**: Public interface (SSH + WireGuard only after firewall lockdown)
- **vmbr1**: Private bridge for VMs (10.10.0.0/24, NAT to internet)
- **wg0**: WireGuard tunnel for workstation access (10.10.99.0/24)
- VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

## Related files

- [`envs/hetzner/`](../) -- Proxmox connection configs and lab definitions
- [`envs/README.md`](../../README.md) -- Multi-target concept explanation