1.3 KiB
1.3 KiB
Hetzner Setup Context
paths:
- hetzner/*
- incusos/targets/hetzner/*
Network Topology
Hetzner dedicateds have a single public IP with MAC filtering. VMs cannot use public IPs directly.
- vmbr0: Public interface (SSH + WireGuard only)
- vmbr1: Private bridge (10.10.0.0/24) with NAT masquerading to internet
- wg0: WireGuard tunnel (10.10.99.0/24) for workstation access
- VMs get IPs in 10.10.0.x range, gateway 10.10.0.1 (Proxmox host)
IP Ranges
| Range | Purpose |
|---|---|
| 10.10.0.1 | Proxmox host (on vmbr1) |
| 10.10.0.101-113 | IncusOS VMs |
| 10.10.0.200+ | OVN external IPs (future) |
| 10.10.10.0/24 | OVN overlay (future, inside VMs) |
| 10.10.99.1 | WireGuard server |
| 10.10.99.2+ | WireGuard clients |
Key Differences from Beelink Target
- No VLAN -- dedicated private bridge instead
- API method preferred -- WireGuard adds latency to SSH sessions
- ZFS storage -- local-zfs (ZFS pool) instead of local-lvm (LVM thin)
- Larger VMs -- 8 cores, 16 GiB RAM, 100 GiB disk (vs 4C/4G/50G)
- WireGuard required -- no direct LAN access to VMs
proxmox-setup Script
hetzner/proxmox-setup runs from the workstation over SSH.
All commands executed via ssh <host> <command>.
Follows same conventions as other scripts: setup_colors, info/warn/error,
--dry-run, --yes flags.