$ pvecm status
A production-style private cloud built from bare metal on five HP EliteDesk nodes. Designed to model enterprise infrastructure: hypervisor clustering, declarative container workloads, split-horizon DNS, zero-trust identity management, and automated disaster recovery.
Cluster Nodes
5 Nodes
Proxmox VE 8.x
Total Memory
112 GB
DDR4 ECC & Non-ECC
Live Workloads
15+ Services
Docker Compose & VMs
Identity & SSL
Authentik SSO
Wildcard *.elic01.dev
Public Internet Local LAN Devices (192.168.10.0/24)
│ │
Cloudflare Edge / Proxy Technitium Local DNS (Node 3)
(External DNS & WAF) (Resolves *.elic01.dev to LAN IPs)
│ │
└─────────────────────────┬─────────────────────────┘
▼
Traefik Reverse Proxy (Node 1)
(Wildcard Let's Encrypt *.elic01.dev)
│
┌───────────────────────────┴───────────────────────────┐
▼ ▼
Authentik Identity Provider (Node 3) Internal Routing Middleware
(SSO / OIDC / Forward-Auth & MFA) (IP Whitelist & Rate Limiting)
│ │
└───────────────────────────┬───────────────────────────┘
▼
Docker Workload Host VMs
┌──────────────────────────────┬──────────────────────────────┬──────────────────────────────┐
▼ ▼ ▼ ▼
Node 1 (Control Plane) Node 2 (Productivity) Node 3 (Net & Sec) Node 4 (AI & Dev)
• Portainer Management • Nextcloud Collaboration • Technitium DNS • Ollama Local LLMs
• Prometheus Telemetry • Immich Photo Backup • WireGuard VPN • n8n Automation
• Grafana Dashboards • Gitea Source Control • AdGuard Home DNS • VS Code Server
• PostgreSQL & Redis • Paperless-ngx & Vault • Authentik Server • Dev Sandboxes
└──────────────────────────────┴──────────────────────────────┴──────────────────────────────┘
│
Automated Scheduled Snapshots
▼
Node 5: Proxmox Backup Server (PBS)
(Deduplicated ZFS Storage Pool & Verification)| Node | Role & Hostname | CPU & RAM | Storage | Workloads Hosted |
|---|---|---|---|---|
| Node 1 | Control Plane & Telemetry ctrl-node1 · 192.168.10.101 | AMD Ryzen 5 Pro 2400G (4C/8T) 32 GB DDR4 | 512GB NVMe + 1TB HDD | Traefik v3 (Wildcard SSL), Portainer, Prometheus, Grafana, Node Exporter |
| Node 2 | Cloud & Core Productivity cloud-node2 & apps-node2 · 192.168.10.102 | AMD Ryzen 5 Pro 2400G (4C/8T) 32 GB DDR4 | 512GB NVMe + 1TB HDD | Nextcloud AIO, Immich, Gitea Git Server, Vaultwarden, Paperless-ngx, PostgreSQL, Redis |
| Node 3 | Network & Zero-Trust Security net-node3 · 192.168.10.103 | AMD Ryzen 5 Pro 2400G (4C/8T) 16 GB DDR4 | 512GB NVMe + 1TB HDD | Technitium Authoritative DNS, WireGuard VPN Gateway, AdGuard Home, Authentik SSO / IdP |
| Node 4 | AI & Development Automation ai-node4 · 192.168.10.104 | AMD Ryzen 5 Pro 2400G (4C/8T) 16 GB DDR4 | 512GB NVMe + 1TB HDD | Ollama Local LLM Runner, n8n Workflow Automation, VS Code Server, Developer Containers |
| Node 5 | Disaster Recovery (PBS Bare Metal) pbs-node5 · 192.168.10.105 | AMD Ryzen 5 Pro 2400G (4C/8T) 16 GB DDR4 | 512GB NVMe + 1TB HDD (ZFS Pool) | Proxmox Backup Server (PBS), Deduplicated Chunk Storage, Encrypted Snapshot Verification |
Uses Technitium DNS locally and Cloudflare publicly under elic01.dev. Traefik holds one Let’s Encrypt wildcard certificate for *.elic01.dev. Internal apps resolve locally with valid green-padlock HTTPS and zero exposed ports.
Authentik serves as the single source of truth for identity across the cluster. Applications use OAuth2/OIDC where native, or Traefik forward-auth proxy middleware for legacy tools with multi-factor authentication enforced.
ZFS storage pools with tuned record sizes (16k for PostgreSQL, 64k for media). Nightly incremental backups stream to a dedicated bare-metal Proxmox Backup Server with client-side deduplication saving over 80% disk space.
SSH key authentication with root login disabled. Strict UFW firewall rules enforce default-deny policies. Docker workloads run in unprivileged containers with read-only root filesystems where applicable.
Relying on router NAT loopback causes latency spikes and breaks when upstream WAN changes. Implementing Technitium as local authoritative DNS ensures internal traffic never leaves the LAN switch while maintaining valid public SSL certificates.
Default 128KB ZFS record sizes cause severe write amplification for PostgreSQL and Redis (which write in 8KB/16KB pages). Creating dedicated ZFS datasets tuned to 16KB reduced disk IOPS wear and cut query latencies significantly.
Traditional full-VM snapshots quickly exhaust storage. Deploying Proxmox Backup Server (PBS) with chunk-level deduplication allowed retaining 30 daily snapshots across 10+ VMs using less than 20% of the total disk space.
Not all self-hosted software supports modern OIDC authentication out of the box. Using Traefik forward-auth with Authentik enables modern MFA and role-based access control in front of legacy services without altering upstream container images.
Full Step-By-Step Runbook
Explore the complete technical runbook covering physical hardware prep, Proxmox clustering commands, Docker Compose stacks, split-horizon DNS configurations, and PBS backup verification.