Proxmox HCI

Proxmox HCI is the single operational pane for a fleet of Proxmox VE clusters. The promise is the one that AWS, GCP and Azure deliver for their own hypervisors: the operator never needs to open the underlying hypervisor UI again. Everything that today is done across N per-cluster Proxmox web GUIs is done here, in one place, multi-tenant scoped, with a tamper-evident audit trail mapped to NIS2, ENS and ISO 27001.

It is the first building block of the NCN Cloud Platform — a sovereign, European HCI stack wrapping Proxmox VE with the operational, lifecycle and compliance features that the native UI deliberately leaves out.

Day-zero provisioning

A new node — bare metal or virtual — needs only one thing: network reachability to the App. From that single prerequisite:

• New cluster → the App orchestrates pvecm create, deploys Ceph (mons + mgr + OSDs + default pools) or wires the chosen shared storage (NFS, external Ceph), configures bridges + bonds + VLANs, applies the firewall baseline and adopts the resulting cluster into its catalog.
• Join existing cluster → the App pushes the cluster join + the full cluster configuration (network, storage, firewall, HA groups). The node reboots already in the target cluster.
• Retire → the App drains the node, performs cluster-aware removal and records the lifecycle transition in the audit log.

PXE + Proxmox autoinstall per MAC closes the loop: buy N servers, plug a cable, push a button, you have a cloud.

What you operate, all in one place

• Compute — VMs and containers across clusters: start / stop / snapshot / clone / live migrate / VNC console (proxied inside the App, never direct to Proxmox). Cross-cluster search.
• Network — bridges, bonds, VLANs and Proxmox SDN (zones / vnets / subnets). Cross-node consistency checks — a vmbr0 with mismatched MTU between nodes is surfaced as drift.
• Storage — Ceph (internal deploy or external attach), NFS, ZFS, LVM. Capacity time series + alerts.
• Firewall — DC, node and VM rules read and managed.
• HA groups — failover domains.
• Pools — Proxmox organisational pools mirrored; tenancy lives in the App's org_slug.

Managed cloud services on top — auto-deployed, CSP-style

The raw infrastructure layer above is only half the story. The App also provisions and lifecycle-manages the cloud services that AWS, GCP and Azure ship out of the box. Each service is declared in the App's catalogue, provisioned with one click, audited end-to-end, and inherits the platform's typed-confirm, IAM, Vault and break-glass plumbing automatically:

• Load Balancer — managed Envoy / NGINX deployment, multi-backend, TLS via ACME, per-LB dashboard with backend health and request rate, declarative reconfiguration on backend change.
• NAT Gateway — managed egress for tenant VLANs, masquerade + per-tenant ACLs, HA pair with fail-over between gateway VMs.
• VPN Gateway — managed WireGuard or IPsec endpoint per tenant with rotating peer credentials and per-tunnel audit.
• DNS-as-a-Service — authoritative + recursive resolver per tenant, declarative zone management, integration with the App's IPAM allocations.
• Object Storage — S3-compatible gateway on top of Ceph RGW, per-tenant buckets and access keys, versioning and lifecycle policies.
• Certificate Management — ACME automation for internal and external certificates, rotation tracking, expiry alerts mapped to ENS op.exp.7.
• Managed Kubernetes (Talos) — control plane + worker nodes provisioned across the cluster, with the SkyDefended stack itself auto-deployed on top for customers that want the full vertical.

Templates ship one at a time as customer demand surfaces (F8 roadmap). The contract for every new service is the same: declarative spec → provisioning job → per-tenant credentials in Vault → audit per state transition → restorable from ClusterConfig.

What Proxmox does not have today — native here

• Hash-chained audit log — every operator action and worker-detected event, immutable through three independent layers (Postgres role + PL/pgSQL trigger + SHA-256 chain). Weekly automatic chain verification.
• Versioned cluster configuration — every drift produces a new immutable ClusterConfig snapshot. Diff between any two versions. Restore-from-version with preview + typed-confirm and scope deliberately bounded to what Proxmox API can write safely (firewall / HA groups / pools).
• Per-tenant SIEM outbound — ndjson POST to the customer's Splunk / Elastic / CCN-CERT collector every 30 s, bearer from Vault, exponential retry. Weekly chain-verify failures forwarded as CRITICAL.
• Break-glass — dual-control approved emergency access to the upstream Proxmox SSH / GUI. 1 h TTL. Every transition audited. The native UI and SSH stay live as the "back door" — they are never the productive path. "Two doors, both audited" (C8 of the SkyDefended security contract).
• CMDB — per-node hardware inventory (PCI / USB / SMART / DNS / NTP / hosts) read entirely via Proxmox API. BIOS / BMC via Redfish out-of-band where reachable, node-side agent otherwise.
• Compliance engine — declarative checks emit findings mapped to ENS / NIS2 / ISO controls with severity + remediation, accessible from the cluster overview.

Identity model — ephemeral by design, CSP-style

Proxmox HCI does not manage users. It is an Application running on SkyDefended InfraAPP, the underlying platform that owns identity, PIM and IAM end to end. The App inherits decisions, it does not re-implement them.

Think of the model as the entrance of an institution: at the door, the guard checks your ID card (an RSA-signed identity registered in SkyDefended) and hands you a short-lived visitor badge. With that badge — not with the ID card — you walk through the rooms, do your work, and the badge expires by itself when its TTL elapses. The next time you need access, the guard hands you a fresh one. The badge is ephemeral by design: even if it is intercepted mid-route, it cannot be used past its TTL. The same primitive that AWS, GCP and Azure use for their consoles.

The App applies the pattern twice:

1. Operator → App boundary. Authentication is a SkyDefended Engine JWT (RS256, short-lived, refreshed automatically), verified offline by the App against a Policy Bundle phoned home every 5 minutes. The JWT carries the operator's identity, the org_slug and the permissions[] resolved server-side combining baseline IAM + PIM elevation. Permissions are baked into the TTL-limited token, not granted on a long-lived session — revocation propagates within the bundle refresh window.
2. App → Proxmox node boundary. Following the CSP pattern (AWS Session Manager, GCP IAP, Azure PIM), every action against a node carries identity derived from that ephemeral operator JWT and is captured in the audit log scoped to the action. VNC console tickets are single-use and expire in ~120 s. Break-glass SSH or GUI credentials are sealed in Vault and revealed exactly once with a 1 h TTL; afterwards they are unreachable, even if the operator wanted them again.

Multi-tenancy is by column (tenantSlug from org_slug); no local Tenant table, no hardcoded slugs anywhere. PIM + IAM live in SkyDefended InfraAPP — the App is a consumer of decisions, not a re-implementer.

Compliance frameworks (day 1)

• NIS2 — Art. 21(2)(c)(d)(g)(i)(j), Art. 23 incident reporting
• ENS — op.exp.7 / op.exp.8 / op.exp.10 / op.acc.1 / op.acc.5 / op.mon.1 / op.cont.1
• ISO 27001:2022 — A.5.15 / A.5.16 / A.5.30 / A.5.33 / A.8.2 / A.8.8 / A.8.15 / A.8.16 / A.8.20 / A.8.24 / A.8.32

Technology

Fastify 5 + TypeScript + Prisma 7 + PostgreSQL 16 (API); Next.js 15 + React 19 + Tailwind (Admin); Vault with K8s Auth — no VAULT_TOKEN env, ever; Kubernetes (Talos) runtime; per-cluster Proxmox credentials isolated in dedicated Vault paths.

Status

Dogfooded against an OVH-hosted test cluster. 11 of 14 phases shipped: bootstrap + SkyDefended coupling, credential auto-renewal (auth-secret rotation survival), discovery, VM operations with typed-confirm, compliance foundations (hash-chain audit + compliance engine + per-node hardening), break-glass dual-control, ClusterConfig versioning (F2), restore-from-version (F6), log centralisation end-to-end (F5), hardware CMDB read-only (F4 batch 1), translation + GCP-style help system. In progress: network discovery + declarative designer. Planned: provisioning from bare nodes (F1), BIOS/BMC via Redfish + agent (F4 batch 2), Day-0 PXE zero-touch (F7), managed cloud services catalog and templates (F8 — LB, NAT, VPN, DNS, Object Storage, Cert mgmt, Talos K8s + SkyDefended stack).