3.2 KiB

Raw Blame History

Hetzner Dedicated Server Setup

Turn a Hetzner bare metal dedicated server into a Proxmox host ready for IncusOS lab deployments. The result is identical to a local Proxmox setup (like a Beelink mini PC) but with more resources and accessed via a WireGuard tunnel instead of LAN.

Prerequisites

A Hetzner dedicated server (server auction recommended)
- Intel CPU with VT-x/VT-d (nested virtualization)
- 32+ cores, 128+ GiB RAM
- 2+ disks (ZFS mirror for system, extra disks for VM storage)
An SSH key pair on your workstation
A VNC client (for the Proxmox installer)
This repository cloned locally

Workflow

The setup is split into a manual guide and an automated script:

1. Manual: rent server and install Proxmox

Follow hetzner-setup.md sections 1-2:

Pick and order a server from the Hetzner auction
Install Proxmox via QEMU in the rescue system (ZFS RAID1 mirror)
Fix the network interface name, reboot, verify SSH works

2. Manual: set up SSH alias

Follow hetzner-setup.md section 3.1-3.3:

ssh-copy-id root@<public-ip>
# Add "Host hetzner-lab" entry to ~/.ssh/config
ssh hetzner-lab pvesh get /version   # Must succeed

3. Automated: configure everything else

hetzner/proxmox-setup --host hetzner-lab --dry-run   # Preview
hetzner/proxmox-setup --host hetzner-lab              # Execute

The script interactively configures: repos and updates, private bridge (vmbr1), ZFS storage on extra disks, WireGuard tunnel, firewall lockdown, and API tokens for incusos-proxmox.

4. Deploy IncusOS VMs

cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Fill in the API token from step 3

export PROXMOX_TOKEN_SECRET="<token>"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
                incusos/targets/hetzner/lab-cluster.yaml

What's in this directory

File	Description
hetzner-setup.md	Manual guide: server selection, Proxmox install, SSH setup
proxmox-setup	Interactive script: repos, networking, storage, WireGuard, firewall, API tokens

Network architecture

Internet
    |
    | Public IP (e.g. 5.9.x.x)
    v
[vmbr0] ──── Proxmox host ──── [wg0: 10.10.99.1/24]
                  |                       |
                  |                  WireGuard tunnel
                  |                       |
             [vmbr1: 10.10.0.1/24]   Your workstation
                  |                  (10.10.99.2)
            ┌─────┼─────┐
            |     |     |
          VM-01 VM-02 VM-03
          .101  .102  .103

vmbr0: Public interface (SSH + WireGuard only after firewall lockdown)
vmbr1: Private bridge for VMs (10.10.0.0/24, NAT to internet)
wg0: WireGuard tunnel for workstation access (10.10.99.0/24)
VMs are accessible from your workstation via WireGuard (routes to 10.10.0.0/16)

incusos/targets/hetzner/ -- Proxmox connection configs and lab definitions
incusos/targets/README.md -- Multi-target concept explanation

3.2 KiB Raw Blame History