Archived
beatzaplentyandClaude Sonnet 4.6
4aadef8e97
- Root README.md: new, describes overall repo layout (proxmox/, pihole/, scripts/) and secret-scanning workflow - Root CLAUDE.md: new, cross-section guardrails and instructions for adding new machine types; references proxmox/CLAUDE.md and pihole/ section-specific rules - pihole/README.md: new, covers scripts usage, notable DHCP/PXE config, EFI VM requirements (VirtIO RNG, Secure Boot), and secrets handling - proxmox/README.md: add repo-context note pointing back to root README Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
58 lines
2.6 KiB
Markdown
58 lines
2.6 KiB
Markdown
> Part of the [debian-configuration](../README.md) repo — see the root README for repo-wide layout and secret-scanning setup.
|
|
|
|
# Proxmox Configuration
|
|
|
|
Base configuration and hardening toolset for Proxmox VE hosts, plus planning
|
|
docs for eventually growing this into a 3-node HA/Ceph cluster. See
|
|
`docs/00-overview.md` for the staging: **Stage 1** (base config/hardening,
|
|
applies to any host — active) vs. **Stage 2** (multi-node HA/Ceph — future,
|
|
deferred).
|
|
|
|
## Goals
|
|
|
|
- Stage 1: a reusable, idempotent base-hardening toolset (`scripts/`) that
|
|
can be run against any new Proxmox host — repo/updates, SSH, firewall, PVE
|
|
user/access hardening — verified with `scripts/audit.sh`.
|
|
- Stage 2 (future): 3-node cluster, quorum via corosync, HA-managed VMs
|
|
backed by Ceph. Needs dedicated hardware node 1 (`pve1`, an ASUS PN53 mini
|
|
PC) doesn't have — see `docs/01-hardware-node1.md`.
|
|
|
|
See `CLAUDE.md` for the guardrails Claude Code follows when working
|
|
against these hosts (`pve1` is production and off-limits by default;
|
|
`pve-test` is the sandbox).
|
|
|
|
## Repo layout
|
|
|
|
- `docs/` — planning docs: hardware layout, storage migration, networking,
|
|
security hardening, node roles. Read `docs/00-overview.md` first, then
|
|
`docs/05-node-roles.md` for what `pve1`/`pve-test` actually are.
|
|
- `scripts/` — scripts to apply configuration on a node (SSH hardening, repo
|
|
switch, firewall, updates, wifi/bond networking, etc). Idempotent, safe
|
|
to re-run. `scripts/bootstrap.sh` runs the full Stage 1 sequence end to
|
|
end; `scripts/audit.sh` verifies it (read-only).
|
|
`scripts/setup-wifi-bond-network.sh` reproduces `pve-test`'s wifi
|
|
network (see `docs/06-pve-test-wifi-network.md`). `scripts/lib/` holds
|
|
shared helpers (`common.sh`) sourced by the other scripts.
|
|
- `config/` — reference config files/snippets to drop onto a node (firewall
|
|
rules, sshd config, etc.).
|
|
|
|
## Quick start (Stage 1, on a fresh node)
|
|
|
|
```
|
|
MGMT_CIDR=192.168.2.0/24 ./scripts/bootstrap.sh
|
|
./scripts/create-admin-user.sh <username>
|
|
# then enable 2FA for that user + root@pam via the web UI
|
|
./scripts/audit.sh
|
|
```
|
|
|
|
## Status
|
|
|
|
`pve1` built (ASUS PN53 mini PC, ZFS mirror boot+VM storage, single
|
|
2.5GbE NIC) and already running production VMs/CTs. Stage 1 base
|
|
hardening applied and verified (`scripts/audit.sh` all green): enterprise
|
|
repos removed, SSH key-only + fail2ban, unattended security upgrades,
|
|
PVE firewall (mgmt-only), subscription nag disabled, named admin user
|
|
(`wayne@pve`) created. Remaining manual step: enable 2FA/TOTP for
|
|
`wayne@pve` and `root@pam` via the web UI. Stage 2 (cluster/Ceph) not
|
|
started — needs nodes 2/3 on hardware that can actually support it.
|