maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/hetzner
History
Maarten 68daf96e61 Fix nag detection: check for community-scripts dpkg hook and pve-nag-buster 
The previous detection only checked for void({ in proxmoxlib.js, which
is the manual sed method. The community-scripts post-install uses a
different approach: a persistent dpkg hook (/etc/apt/apt.conf.d/no-nag-script)
that calls /usr/local/bin/pve-remove-nag.sh after every package update.
That script patches data.status lines from "!== 'active'" to
"== 'NoMoreNagging'".

Now checks (in order):
1. Community-scripts hook files (no-nag-script, pve-remove-nag.sh)
2. pve-nag-buster dpkg hooks
3. void({ JS patch (manual method)
4. Nag text removed entirely

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 		2026-03-02 17:11:56 +01:00
..
README.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
hetzner-setup.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
proxmox-setup Fix nag detection: check for community-scripts dpkg hook and pve-nag-buster 2026-03-02 17:11:56 +01:00

README.md

Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.

Prerequisites

  • A Hetzner dedicated server (server auction recommended)
    • Intel CPU with VT-x/VT-d (nested virtualization)
    • 32+ cores, 128+ GiB RAM
    • 2+ disks (ZFS mirror for system, extra disks for VM storage)
  • An SSH key pair on your workstation
  • A VNC client (for the Proxmox installer)
  • This repository cloned locally

Workflow

The setup is split into a manual guide and an automated script:

1. Manual: rent server and install Proxmox

Follow hetzner-setup.md sections 1-2:

  • Pick and order a server from the Hetzner auction
  • Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
  • Fix the network interface name, reboot, verify SSH works

2. Manual: set up SSH alias

Follow hetzner-setup.md section 3.1-3.3:

ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version   # Must succeed

3. Automated: configure everything else

hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute

The script interactively configures: repos and updates, private bridge (vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown, and API tokens for incusos-proxmox.

4. Deploy IncusOS VMs

cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 3

export PROXMOX_TOKEN_SECRET="<token>"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml

What's in this directory

File Description
hetzner-setup.md Manual guide: server selection, Proxmox install, SSH setup
proxmox-setup Interactive script: repos, networking, storage, WireGuard, firewall, API tokens

Network architecture

Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
  • vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
  • vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
  • wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
  • VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

Related files