maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/hetzner
History
Maarten 9a87261823 Fix nag detection: PVE 9 effectively disabled the subscription popup 
PVE 9.1 changed the JS condition to check for 'NoMoreNagging' status
(case-sensitive compare after toLowerCase), which never matches. The
subscription API returns status "notfound" which is truthy, so the
nag dialog condition is always false. Detect PVE major version and
skip nag check for PVE >= 9.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 		2026-03-02 16:53:32 +01:00
..
README.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
hetzner-setup.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
proxmox-setup Fix nag detection: PVE 9 effectively disabled the subscription popup 2026-03-02 16:53:32 +01:00

README.md

Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.

Prerequisites

  • A Hetzner dedicated server (server auction recommended)
    • Intel CPU with VT-x/VT-d (nested virtualization)
    • 32+ cores, 128+ GiB RAM
    • 2+ disks (ZFS mirror for system, extra disks for VM storage)
  • An SSH key pair on your workstation
  • A VNC client (for the Proxmox installer)
  • This repository cloned locally

Workflow

The setup is split into a manual guide and an automated script:

1. Manual: rent server and install Proxmox

Follow hetzner-setup.md sections 1-2:

  • Pick and order a server from the Hetzner auction
  • Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
  • Fix the network interface name, reboot, verify SSH works

2. Manual: set up SSH alias

Follow hetzner-setup.md section 3.1-3.3:

ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version   # Must succeed

3. Automated: configure everything else

hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute

The script interactively configures: repos and updates, private bridge (vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown, and API tokens for incusos-proxmox.

4. Deploy IncusOS VMs

cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 3

export PROXMOX_TOKEN_SECRET="<token>"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml

What's in this directory

File Description
hetzner-setup.md Manual guide: server selection, Proxmox install, SSH setup
proxmox-setup Interactive script: repos, networking, storage, WireGuard, firewall, API tokens

Network architecture

Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
  • vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
  • vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
  • wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
  • VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

Related files