97 lines
3.2 KiB
Markdown
97 lines
3.2 KiB
Markdown
# Hetzner Dedicated Server Setup
|
|
|
|
Turn a Hetzner bare metal dedicated server into a Proxmox host ready
|
|
for IncusOS lab deployments. The result is identical to a local Proxmox
|
|
setup (like a Beelink mini PC) but with more resources and accessed
|
|
via a WireGuard tunnel instead of LAN.
|
|
|
|
## Prerequisites
|
|
|
|
- A Hetzner dedicated server (server auction recommended)
|
|
- Intel CPU with VT-x/VT-d (nested virtualization)
|
|
- 32+ cores, 128+ GiB RAM
|
|
- 2+ disks (ZFS mirror for system, extra disks for VM storage)
|
|
- An SSH key pair on your workstation
|
|
- A VNC client (for the Proxmox installer)
|
|
- This repository cloned locally
|
|
|
|
## Workflow
|
|
|
|
The setup is split into a manual guide and an automated script:
|
|
|
|
### 1. Manual: rent server and install Proxmox
|
|
|
|
Follow [hetzner-setup.md](hetzner-setup.md) sections 1-2:
|
|
|
|
- Pick and order a server from the Hetzner auction
|
|
- Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
|
|
- Fix the network interface name, reboot, verify SSH works
|
|
|
|
### 2. Manual: set up SSH alias
|
|
|
|
Follow [hetzner-setup.md](hetzner-setup.md) section 3.1-3.3:
|
|
|
|
```bash
|
|
ssh-copy-id root@<public-ip>
|
|
# Add "Host hetzner-lab" entry to ~/.ssh/config
|
|
ssh hetzner-lab pvesh get /version # Must succeed
|
|
```
|
|
|
|
### 3. Automated: configure everything else
|
|
|
|
```bash
|
|
hetzner/proxmox-setup --host hetzner-lab --dry-run # Preview
|
|
hetzner/proxmox-setup --host hetzner-lab # Execute
|
|
```
|
|
|
|
The script interactively configures: repos and updates, private bridge
|
|
(vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown,
|
|
and API tokens for `incusos-proxmox`.
|
|
|
|
### 4. Deploy IncusOS VMs
|
|
|
|
```bash
|
|
cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
|
|
# Fill in the API token from step 3
|
|
|
|
export PROXMOX_TOKEN_SECRET="<token>"
|
|
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
|
|
incusos/targets/hetzner/lab-cluster.yaml
|
|
```
|
|
|
|
## What's in this directory
|
|
|
|
| File | Description |
|
|
|------|-------------|
|
|
| [hetzner-setup.md](hetzner-setup.md) | Manual guide: server selection, Proxmox install, SSH setup |
|
|
| [proxmox-setup](proxmox-setup) | Interactive script: repos, networking, storage, WireGuard, firewall, API tokens |
|
|
|
|
## Network architecture
|
|
|
|
```
|
|
Internet
|
|
|
|
|
| Public IP (e.g. 5.9.x.x)
|
|
v
|
|
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
|
|
| |
|
|
| WireGuard tunnel
|
|
| |
|
|
[vmbr1: 10.10.0.1/24] Your workstation
|
|
| (10.10.99.2)
|
|
┌─────┼─────┐
|
|
| | |
|
|
VM-01 VM-02 VM-03
|
|
.101 .102 .103
|
|
```
|
|
|
|
- **vmbr0**: Public interface (SSH + WireGuard only after firewall lockdown)
|
|
- **vmbr1**: Private bridge for VMs (10.10.0.0/24, NAT to internet)
|
|
- **wg0**: WireGuard tunnel for workstation access (10.10.99.0/24)
|
|
- VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)
|
|
|
|
## Related files
|
|
|
|
- [`incusos/targets/hetzner/`](../incusos/targets/hetzner/) -- Proxmox connection configs and lab definitions
|
|
- [`incusos/targets/README.md`](../incusos/targets/README.md) -- Multi-target concept explanation
|