Maarten
594467ddf6
Validates full end-to-end deployment: OC + 3-node Incus cluster, OVN overlay, HAProxy HA pair, AWX on K3s, Prometheus/Grafana stack. New files: - hetzner/hetzner-lab-guide.md — complete end-to-end deployment guide - incusos/targets/hetzner/awx.yaml — AWX deploy config (hz-node-03, 10.10.0.122) - incusos/targets/hetzner/haproxy.yaml — HAProxy deploy config (VIP 10.10.0.200) Script fixes discovered during Hetzner deployment: - deploy-awx: parse target_remote correctly (was reading target_node key); add RESUME flag support; fix target_node passthrough to incus launch; fix aether_url sed to not strip :8443 port - deploy-observability: fix --remote flag (was --cluster-remote in docs), fix --resume to clearly skip phases 1-5 including node-exporters - hetzner/proxmox-setup: state detection improvements from full run - incusos-proxmox, deploy-haproxy: minor fixes from Hetzner testing Guide covers known Aether v6.4.202 workarounds: - HAProxy ACL bug (OVN LB DNAT-only, source IP not VIP) - AWX cluster binding API bug (DB workaround documented) - OVN SNAT unreliable for net-prod containers (offline install procedure) - node-exporter manual deploy when --resume skips phase 5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| README.md | ||
| hetzner-lab-guide.md | ||
| hetzner-setup.md | ||
| proxmox-setup | ||
README.md
Hetzner Dedicated Server Setup
Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.
Prerequisites
- A Hetzner dedicated server (server auction recommended)
- Intel CPU with VT-x/VT-d (nested virtualization)
- 32+ cores, 128+ GiB RAM
- 2+ disks (ZFS mirror for system, extra disks for VM storage)
- An SSH key pair on your workstation
- A VNC client (for the Proxmox installer)
- This repository cloned locally
Workflow
The setup is split into a manual guide and an automated script:
1. Manual: rent server and install Proxmox
Follow hetzner-setup.md sections 1-2:
- Pick and order a server from the Hetzner auction
- Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
- Fix the network interface name, reboot, verify SSH works
2. Manual: set up SSH alias
Follow hetzner-setup.md section 3.1-3.3:
ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version # Must succeed
3. Automated: configure everything else
hetzner/proxmox-setup --host hetzner-lab --dry-run # Preview
hetzner/proxmox-setup --host hetzner-lab # Execute
The script interactively configures: repos and updates, private bridge
(vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown,
and API tokens for incusos-proxmox.
4. Deploy IncusOS VMs
cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 3
export PROXMOX_TOKEN_SECRET="<token>"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
incusos/targets/hetzner/lab-cluster.yaml
What's in this directory
| File | Description |
|---|---|
| hetzner-setup.md | Manual guide: server selection, Proxmox install, SSH setup |
| proxmox-setup | Interactive script: repos, networking, storage, WireGuard, firewall, API tokens |
Network architecture
Internet
|
| Public IP (e.g. 5.9.x.x)
v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
| |
| WireGuard tunnel
| |
[vmbr1: 10.10.0.1/24] Your workstation
| (10.10.99.2)
┌─────┼─────┐
| | |
VM-01 VM-02 VM-03
.101 .102 .103
- vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
- vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
- wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
- VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)
Related files
incusos/targets/hetzner/-- Proxmox connection configs and lab definitionsincusos/targets/README.md-- Multi-target concept explanation