# Runbook: Proxmox VE Hardening

Applies Stage 1 hardening to a fresh Proxmox VE node using the `proxmox-hardening` Ansible role.

## Pre-conditions

- Fresh PVE install with root SSH access
- SSH key already added to root's `authorized_keys`
- Host added to `ansible/inventory/hosts.yml` under the `proxmox` group

## Steps

```bash
# 1. Verify connectivity
cd ansible
ansible-playbook playbooks/ping.yml --limit <hostname>

# 2. Dry-run to preview changes
ansible-playbook playbooks/proxmox.yml --limit <hostname> --check --diff

# 3. Review the diff output, then apply
ansible-playbook playbooks/proxmox.yml --limit <hostname>

# 4. Verify hardening state
ansible-playbook playbooks/proxmox.yml --limit <hostname> --tags audit --check
```

## What gets applied

1. **APT repos** — enterprise source disabled, no-subscription source enabled
2. **SSH hardening** — `PermitRootLogin prohibit-password`, `PasswordAuthentication no`, fail2ban
3. **Datacenter firewall** — default-deny inbound; SSH (22) and web UI (8006) from management CIDR only
4. **Unattended upgrades** — security-only origins, no auto-reboot
5. **Named admin user** — `<proxmox_admin_username>@pve` with Administrator role (one-time)
6. **IPA sudo** — `admins` group gets NOPASSWD sudo for shell and PVE tools
7. **Subscription nag** — cosmetic patch to remove the nag dialog

## Variables to set per-host

In `ansible/inventory/hosts.yml`:
```yaml
pve1.sweet.home:
  proxmox_mgmt_cidr: "192.168.2.0/24"
  proxmox_admin_username: wayne
```

## After hardening

- Log into the PVE web UI as the named admin, change the initial password
- Enable TOTP/2FA for both the named admin and root@pam
- Verify with the audit script: `cd /home/wayne/repos/debian-configuration && proxmox/scripts/audit.sh`
  (will migrate to an Ansible audit task in a future iteration)