Proxmox Deployment Overview on Server¶

Prerequisites¶

The following conditions must be met for the system to operate correctly:

• Operating System: Debian (Bullseye, Bookworm, and Trixie versions are supported).

• Access Rights: root privileges for installing packages and modifying system configurations.

• Network Parameters: Access to Proxmox VE repositories and an active internet connection to obtain SSL certificates.

FQDN of the final panel on hostkey.in domain¶

The web interface is accessed via a subdomain automatically generated according to the following pattern:

File and Directory Structure¶

The following directories and files are created during the deployment process:

• /root/nginx/ — working directory for the Nginx Docker Compose configuration.

• /data/nginx/user_conf.d/ — directory for custom Nginx configuration files (including proxy settings).

• /data/nginx/letsencrypt/.well-known/acme-challenge/ — directory for domain ownership validation when obtaining SSL certificates.

• /data/nginx/ — storage for Nginx configuration files and environment variables.

Application Installation Process¶

Installation is performed by upgrading the current Debian OS into a full Proxmox VE hypervisor:

1. Update APT system packages.

2. Add official Proxmox VE repositories (no-subscription).

3. Install the Proxmox kernel (pve-kernel or proxmox-default-kernel depending on the Debian version).

4. Remove the standard Debian kernel to prevent boot conflicts.

5. Install the proxmox-ve package, as well as auxiliary services (postfix, open-iscsi).

6. Configure automatic certificate renewal via an Nginx Docker container using Certbot.

Access Rights and Security¶

• Use of os-prober has been removed to enhance bootloader security.

• Configuration files in /data/nginx/user_conf.d/ are managed by the automation system.

• Docker is operated via a specialized service with the Delegate=yes parameter, allowing containers to use cgroups correctly.

Databases¶

In this configuration, no databases are deployed; the application utilizes server system resources for virtualization management.

Docker Containers and Execution¶

To ensure web interface operation over a secure connection (HTTPS), an Nginx container with integrated Certbot is used.

Container: nginx-nginx-1

• Image name: jonasal/nginx-certbot:latest

• Network mode: host

• Volumes:

  • nginx_secrets:/etc/letsencrypt (external volume for certificates)

  • /data/nginx/user_conf.d:/etc/nginx/user_conf.d (custom configs)

  • /data/nginx/letsencrypt:/var/www/letsencrypt (for ACME challenges)

• Environment variables:

  • [email protected]

• Variables file: /data/nginx/nginx-certbot.env (includes the RENEWAL_INTERVAL=8d parameter)

• Restart policy: unless-stopped

Application Update Instructions¶

Updates are performed via standard system package management and Docker mechanisms:

• For system components: execute repository and package update commands.

• For web proxy: update containers using the command docker compose pull && docker compose up -d in the /root/nginx directory.

Permissions Settings¶

• The /root/nginx directory has 0755 permissions (owner root).

• Configuration files and environment variables have 0644 permissions (owner root).

Location of Configuration Files and Data¶

• Nginx configuration: /data/nginx/user_conf.d/{prefix}{server_id}.hostkey.in.conf

• Certbot environment variables: /data/nginx/nginx-certbot.env

• Docker Compose file: /root/nginx/compose.yml

Available Connection Ports¶