Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplenty 2cca6a7dc0 Stage 1 base config/hardening toolset, applied and verified on pve1

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.

2026-07-21 05:44:50 +00:00

1.9 KiB

Raw Permalink Blame History

Networking

pve1 as built (Stage 1, current)

Single NIC (2.5GbE), single bridge vmbr0 on the flat LAN (192.168.2.0/24), no VLANs. There is no corosync or Ceph traffic to separate yet — this node isn't clustered. Segmentation for Stage 1 is done at the firewall, not the network: scripts/deploy-firewall.sh restricts SSH (22) and the web UI (8006) to the management CIDR via the PVE datacenter firewall (default-deny inbound otherwise). That's sufficient until Stage 2 needs actual separate physical/VLAN paths for corosync and Ceph traffic — see below.

Target design (Stage 2, future cluster)

Required separation

Keep these on logically separate networks/VLANs, ideally separate NICs:

Management — web UI (8006), SSH
Corosync — cluster quorum. Low, consistent latency (well under 5ms) matters more than bandwidth. Never share with VM/storage traffic.
Ceph public — VM-to-OSD traffic (once Ceph is live)
Ceph cluster/backend — OSD-to-OSD replication, heaviest load

Practical layout

2x 10/25GbE bonded or split:

Link pair A → Ceph (public + backend, or split further if 4 NICs available)
Link pair B → management + corosync + VM traffic, with corosync on its own VLAN even when sharing a physical NIC with the rest

Cluster join requirements

All nodes reachable to each other on SSH (22) and the corosync network
Same PVE version across nodes
NTP-synced clocks

Firewall

Proxmox's built-in firewall operates at datacenter and node level. Default-deny, then whitelist:

SSH from the management network/VLAN only
Web UI (8006) from the management network/VLAN only
Corosync ports between cluster nodes
Ceph ports between cluster nodes (once Ceph is live)

Enforce the network separation above at the firewall — corosync and Ceph traffic shouldn't be reachable from the VM network even if they end up sharing a physical link.

See config/pve-firewall/ for a starting rule set.

1.9 KiB Raw Permalink Blame History