# Hetzner Setup Context

paths:
  - hetzner/*
  - incusos/targets/hetzner/*

## Network Topology

Hetzner dedicateds have a single public IP with MAC filtering.
VMs cannot use public IPs directly.

- **vmbr0**: Public interface (SSH + WireGuard only)
- **vmbr1**: Private bridge (10.10.0.0/24) with NAT masquerading to internet
- **wg0**: WireGuard tunnel (10.10.99.0/24) for workstation access
- VMs get IPs in 10.10.0.x range, gateway 10.10.0.1 (Proxmox host)

### IP Ranges

| Range | Purpose |
|-------|---------|
| 10.10.0.1 | Proxmox host (on vmbr1) |
| 10.10.0.101-113 | IncusOS VMs |
| 10.10.0.200+ | OVN external IPs (future) |
| 10.10.10.0/24 | OVN overlay (future, inside VMs) |
| 10.10.99.1 | WireGuard server |
| 10.10.99.2+ | WireGuard clients |

### Key Differences from Beelink Target

- **No VLAN** -- dedicated private bridge instead
- **API method preferred** -- WireGuard adds latency to SSH sessions
- **ZFS storage** -- local-zfs (ZFS pool) instead of local-lvm (LVM thin)
- **Larger VMs** -- 8 cores, 16 GiB RAM, 100 GiB disk (vs 4C/4G/50G)
- **WireGuard required** -- no direct LAN access to VMs

### proxmox-setup Script

`hetzner/proxmox-setup` runs from the workstation over SSH.
All commands executed via `ssh <host> <command>`.
Follows same conventions as other scripts: setup_colors, info/warn/error,
--dry-run, --yes flags.