maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/hetzner
History
Maarten a7eb09e248 Fix detection: PVE 9 deb822 repos, ZFS partition matching, WireGuard state 
Tested against live aether-lab host. Fixes:

1. Repo detection: PVE 9 uses .sources (deb822) format, not .list files.
   Now checks both formats, reads Enabled: field for deb822 enterprise
   repos, and greps for pve-no-subscription across all formats.

2. Available disk detection: zpool status shows partition names
   (nvme0n1p3), not whole-disk names. Now strips partition suffix to
   get parent disk, correctly excluding system pool disks. Also detects
   existing partition tables (linux_raid_member, etc.) on available
   disks and warns about them.

3. WireGuard detection: empty output from "wg show" piped through
   "head -1" produced empty string (not "none"), which was parsed as
   active. Now explicitly checks for empty output.

4. Storage apply: detects and warns about disks with existing
   partitions, offers to wipe before ZFS pool creation. Default pool
   name changed to "vm-storage" (since "local-zfs" is the system pool).

5. Repo apply: handles both .list and .sources formats for disabling
   enterprise repos. Generates correct deb822 format for PVE 9 when
   adding no-subscription repo.

6. Fixed invalid syntax: "for f in ... 2>/dev/null; do" is not valid
   bash -- removed the redirect, file existence is checked with -f.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 		2026-03-02 16:46:31 +01:00
..
README.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
hetzner-setup.md Restructure Hetzner guide: manual install only, hand off to proxmox-setup 2026-03-02 16:09:58 +01:00
proxmox-setup Fix detection: PVE 9 deb822 repos, ZFS partition matching, WireGuard state 2026-03-02 16:46:31 +01:00

README.md

Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.

Prerequisites

  • A Hetzner dedicated server (server auction recommended)
    • Intel CPU with VT-x/VT-d (nested virtualization)
    • 32+ cores, 128+ GiB RAM
    • 2+ disks (ZFS mirror for system, extra disks for VM storage)
  • An SSH key pair on your workstation
  • A VNC client (for the Proxmox installer)
  • This repository cloned locally

Workflow

The setup is split into a manual guide and an automated script:

1. Manual: rent server and install Proxmox

Follow hetzner-setup.md sections 1-2:

  • Pick and order a server from the Hetzner auction
  • Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
  • Fix the network interface name, reboot, verify SSH works

2. Manual: set up SSH alias

Follow hetzner-setup.md section 3.1-3.3:

ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version   # Must succeed

3. Automated: configure everything else

hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute

The script interactively configures: repos and updates, private bridge (vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown, and API tokens for incusos-proxmox.

4. Deploy IncusOS VMs

cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 3

export PROXMOX_TOKEN_SECRET="<token>"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml

What's in this directory

File Description
hetzner-setup.md Manual guide: server selection, Proxmox install, SSH setup
proxmox-setup Interactive script: repos, networking, storage, WireGuard, firewall, API tokens

Network architecture

Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103
  • vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
  • vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
  • wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
  • VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

Related files