42 lines
1.3 KiB
Markdown
42 lines
1.3 KiB
Markdown
# Hetzner Setup Context
|
|
|
|
paths:
|
|
- envs/hetzner/*
|
|
- envs/hetzner/setup/*
|
|
|
|
## Network Topology
|
|
|
|
Hetzner dedicateds have a single public IP with MAC filtering.
|
|
VMs cannot use public IPs directly.
|
|
|
|
- **vmbr0**: Public interface (SSH + WireGuard only)
|
|
- **vmbr1**: Private bridge (10.10.0.0/24) with NAT masquerading to internet
|
|
- **wg0**: WireGuard tunnel (10.10.99.0/24) for workstation access
|
|
- VMs get IPs in 10.10.0.x range, gateway 10.10.0.1 (Proxmox host)
|
|
|
|
### IP Ranges
|
|
|
|
| Range | Purpose |
|
|
|-------|---------|
|
|
| 10.10.0.1 | Proxmox host (on vmbr1) |
|
|
| 10.10.0.101-113 | IncusOS VMs |
|
|
| 10.10.0.200+ | OVN external IPs (future) |
|
|
| 10.10.10.0/24 | OVN overlay (future, inside VMs) |
|
|
| 10.10.99.1 | WireGuard server |
|
|
| 10.10.99.2+ | WireGuard clients |
|
|
|
|
### Key Differences from Beelink Target
|
|
|
|
- **No VLAN** -- dedicated private bridge instead
|
|
- **API method preferred** -- WireGuard adds latency to SSH sessions
|
|
- **ZFS storage** -- local-zfs (ZFS pool) instead of local-lvm (LVM thin)
|
|
- **Larger VMs** -- 8 cores, 16 GiB RAM, 100 GiB disk (vs 4C/4G/50G)
|
|
- **WireGuard required** -- no direct LAN access to VMs
|
|
|
|
### proxmox-setup Script
|
|
|
|
`envs/hetzner/setup/proxmox-setup` runs from the workstation over SSH.
|
|
All commands executed via `ssh <host> <command>`.
|
|
Follows same conventions as other scripts: setup_colors, info/warn/error,
|
|
--dry-run, --yes flags.
|