# Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready
for IncusOS lab deployments. The result is identical to a local Proxmox
setup (like a Beelink mini PC) but with more resources and accessed
via a WireGuard tunnel instead of LAN.

## Prerequisites

- A Hetzner dedicated server (server auction recommended)
  - Intel CPU with VT-x/VT-d (nested virtualization)
  - 32+ cores, 128+ GiB RAM
  - 2+ disks (ZFS mirror for system, extra disks for VM storage)
- An SSH key pair on your workstation
- This repository cloned locally

## Quickstart

### 1. Install Proxmox on the server

Order the server, boot the rescue system, and install Proxmox via
`installimage` or ISO. See [hetzner-setup.md](hetzner-setup.md) section 2
for details.

### 2. Run the setup helper

```bash
# Add SSH config entry for the server (see hetzner-setup.md section 5)
# Then run the interactive setup:
hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute
```

The script configures repositories, private networking, ZFS storage,
WireGuard tunnel, firewall, and API tokens -- everything needed to
deploy VMs.

### 3. Deploy IncusOS VMs

```bash
# Copy and edit the connection config
cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 2

# Deploy a 3-node cluster
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml
```

## What's in this directory

| File | Description |
|------|-------------|
| [hetzner-setup.md](hetzner-setup.md) | Comprehensive step-by-step guide |
| [proxmox-setup](proxmox-setup) | Interactive helper script (automates the guide) |

## Network architecture

```
Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
```

- **vmbr0**: Public interface (SSH + WireGuard only after firewall lockdown)
- **vmbr1**: Private bridge for VMs (10.10.0.0/24, NAT to internet)
- **wg0**: WireGuard tunnel for workstation access (10.10.99.0/24)
- VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

## Related files

- [`incusos/targets/hetzner/`](../incusos/targets/hetzner/) -- Proxmox connection configs and lab definitions
- [`incusos/targets/README.md`](../incusos/targets/README.md) -- Multi-target concept explanation