Proxmox — hardware, storage, network, users, firewall

Extracted from the master document on 2026-09-04. §N numbering kept so cross-references are not broken.

4. Hardware

CPU:        AMD Ryzen 3 2200G — 4C/4T, 3.5–3.7 GHz
RAM:        ~16 GiB DDR4
Board:      ASUS PRIME A320M-C R2.0
iGPU:       Vega 8
GPU:        NVIDIA GTX 1060 3 GB — available, no assigned use
SSD:        EDILOCA ES580E 512 GB   → Proxmox, VMs, apps, DB
HDD:        WDC WD10EZEX 1 TB       → bulky data (Nextcloud)
Hypervisor: Proxmox VE

SVM/AMD-V and IOMMU enabled and validated; BIOS updated. The HDD passed SMART Extended Completed without error (~28,358 h observed).

Why SSD + HDD and not everything together: it separates performance (app, database, containers) from capacity (large files). That separation is also what later defines two different backup paths (§25).

5. Proxmox storage

local       → ISOs, templates, vzdump dumps       (~93.9 GiB)
local-lvm   → VM/LXC virtual disks                (~348.8 GiB)

VG pve approximately: root ~96 GB, swap ~8 GB, data/local-lvm ~348.82 GB. On 2026-09-01, before starting the temporary restore of VM 100, local-lvm had ~217 GiB free.

6. Proxmox network

Hostname: pve
IP:       192.168.2.200/24
Bridge:   vmbr0
LAN:      192.168.2.0/24

vmbr0 is the bridge between the VMs’ virtual NICs and the physical network. The .200 belongs to the Proxmox host, not to any VM.

7. Users and 2FA

The Proxmox identity was deliberately separated from the Linux identity:

Identity	What for	How it authenticates
balsero@pve	Proxmox GUI / API, Administrator role on / with propagate	password + TOTP + recovery keys
balsero (Linux)	SSH / shell with sudo	ED25519 SSH key
root	recovery / emergency only	console

adduser balsero
apt install sudo
usermod -aG sudo balsero
groups balsero
sudo whoami

TOTP, recovery keys and passwords are never stored here.

9. Proxmox firewall

UFW was not installed. Why: two overlapping firewalls on the same host produce contradictory rules that are hard to debug; only the native Proxmox firewall is used.

INPUT:   DROP
OUTPUT:  ACCEPT
FORWARD: ACCEPT

Exceptions from 192.168.2.0/24:
  TCP/22    SSH
  TCP/8006  Proxmox GUI

sudo pve-firewall status
sudo cat /etc/pve/firewall/cluster.fw

---