maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/hetzner/README.md

2.8 KiB
Raw Blame History

Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.

Prerequisites

  • A Hetzner dedicated server (server auction recommended)
    • Intel CPU with VT-x/VT-d (nested virtualization)
    • 32+ cores, 128+ GiB RAM
    • 2+ disks (ZFS mirror for system, extra disks for VM storage)
  • An SSH key pair on your workstation
  • This repository cloned locally

Quickstart

1. Install Proxmox on the server

Order the server, boot the rescue system, and install Proxmox via installimage or ISO. See hetzner-setup.md section 2 for details.

2. Run the setup helper

# Add SSH config entry for the server (see hetzner-setup.md section 5)
# Then run the interactive setup:
hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute

The script configures repositories, private networking, ZFS storage, WireGuard tunnel, firewall, and API tokens -- everything needed to deploy VMs.

3. Deploy IncusOS VMs

# Copy and edit the connection config
cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 2

# Deploy a 3-node cluster
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml

What's in this directory

File Description
hetzner-setup.md Comprehensive step-by-step guide
proxmox-setup Interactive helper script (automates the guide)

Network architecture

Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
  • vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
  • vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
  • wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
  • VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

Related files