Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplenty a854412117 Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path,
Ceph as the future HA storage upgrade, and baseline SSH/firewall
hardening.

2026-07-20 11:45:54 +10:00

1.3 KiB

Raw Blame History

Networking

Required separation

Keep these on logically separate networks/VLANs, ideally separate NICs:

Management — web UI (8006), SSH
Corosync — cluster quorum. Low, consistent latency (well under 5ms) matters more than bandwidth. Never share with VM/storage traffic.
Ceph public — VM-to-OSD traffic (once Ceph is live)
Ceph cluster/backend — OSD-to-OSD replication, heaviest load

Practical layout

2x 10/25GbE bonded or split:

Link pair A → Ceph (public + backend, or split further if 4 NICs available)
Link pair B → management + corosync + VM traffic, with corosync on its own VLAN even when sharing a physical NIC with the rest

Cluster join requirements

All nodes reachable to each other on SSH (22) and the corosync network
Same PVE version across nodes
NTP-synced clocks

Firewall

Proxmox's built-in firewall operates at datacenter and node level. Default-deny, then whitelist:

SSH from the management network/VLAN only
Web UI (8006) from the management network/VLAN only
Corosync ports between cluster nodes
Ceph ports between cluster nodes (once Ceph is live)

Enforce the network separation above at the firewall — corosync and Ceph traffic shouldn't be reachable from the VM network even if they end up sharing a physical link.

See config/pve-firewall/ for a starting rule set.

1.3 KiB Raw Blame History