thesabear/public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removed proxmox folder

Browse Source
This commit is contained in:
thesabear committed 2026-08-25 11:37:02 +03:00
1 parent 63689c3fc0
commit c11395825c
3 files changed
-724
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Proxmox/Proxmox API Authentication.md
-18
View File
@@ -1,18 +0,0 @@
## Create an API Token on Proxmox
To create a new API Token for your `user` in Proxmox, follow these steps:
1. Open the Proxmox Web UI and navigate to the **'Datacenter'** in the **'Server View'** menu.
2. Select **'API Token'** in the **'Permissions'** menu.
3. Click on **'Add'**.
4. Select the `user`, and add a **'Token ID'**.
5. (Optional) Disable `Privilege Separation`, and set an `Expire` date.
6. Click on **'Add'**.
## Check the API Token
To test the API Token, you can use the following command:
```sh
curl -H "Authorization: PVEAPIToken=root@pam!monitoring=aaaaaaaaa-bbb-cccc-dddd-ef0123456789" https://your-proxmox-url:8006/api2/json/
```
Proxmox/Proxmox Certificate Management.md
-313
View File
@@ -1,313 +0,0 @@
## Certificates for Intra-Cluster Communication
Each Proxmox VE cluster creates by default its own (self-signed) Certificate
Authority (CA) and generates a certificate for each node which gets signed by
the aforementioned CA. These certificates are used for encrypted communication
with the cluster's pveproxy service and the Shell/Console feature if SPICE is used.
The CA certificate and key are stored in the Proxmox Cluster File System (pmxcfs).
## Certificates for API and Web GUI
The REST API and web GUI are provided by the pveproxy service, which runs on each node.
You have the following options for the certificate used by pveproxy:
* By default the node-specific certificate in `/etc/pve/nodes/NODENAME/pve-ssl.pem` is used. This certificate is signed by the cluster CA and therefore not automatically trusted by browsers and operating systems.
* Use an externally provided certificate (e.g. signed by a commercial CA).
* Use ACME (Let's Encrypt) to get a trusted certificate with automatic renewal, this is also integrated in the Proxmox VE API and web interface.
For options 2 and 3 the file `/etc/pve/local/pveproxy-ssl.pem` (and
`/etc/pve/local/pveproxy-ssl.key`, which needs to be without password) is used.
Keep in mind that `/etc/pve/local` is a node specific symlink to
`/etc/pve/nodes/NODENAME`.
Certificates are managed with the Proxmox VE Node management command
(see the `pvenode(1)` manpage).
Do not replace or manually modify the automatically generated node
certificate files in `/etc/pve/local/pve-ssl.pem` and
`/etc/pve/local/pve-ssl.key` or the cluster CA files in
`/etc/pve/pve-root-ca.pem` and `/etc/pve/priv/pve-root-ca.key`.
## Upload Custom Certificate
If you already have a certificate which you want to use for a Proxmox VE node
you can upload that certificate simply over the web interface. Note that the
certificates key file, if provided, mustn't be password protected.
## Trusted certificates via Let's Encrypt (ACME)
Proxmox VE includes an implementation of the Automatic Certificate
Management Environment ACME protocol, allowing Proxmox VE admins to
use an ACME provider like Let's Encrypt for easy setup of TLS certificates
which are accepted and trusted on modern operating systems and web browsers
out of the box.
Currently, the two ACME endpoints implemented are the
Let's Encrypt (LE) production and its staging
environment. Our ACME client supports validation of http-01 challenges using
a built-in web server and validation of dns-01 challenges using a DNS plugin
supporting all the DNS API endpoints `acme.sh` does.
### ACME Account
You need to register an ACME account per cluster with the endpoint you want to
use. The email address used for that account will serve as contact point for
renewal-due or similar notifications from the ACME endpoint.
You can register and deactivate ACME accounts over the web interface
`Datacenter -> ACME` or using the `pvenode` command line tool.
```shell
pvenode acme account register account-name [email protected]
```
Because of rate-limits you should use LE staging for experiments or if you use
ACME for the first time.
### ACME Plugins
The ACME plugins task is to provide automatic verification that you, and thus
the Proxmox VE cluster under your operation, are the real owner of a domain. This is
the basis building block for automatic certificate management.
The ACME protocol specifies different types of challenges, for example the
http-01 where a web server provides a file with a certain content to prove
that it controls a domain. Sometimes this isn't possible, either because of
technical limitations or if the address of a record to is not reachable from
the public internet. The dns-01 challenge can be used in these cases. This
challenge is fulfilled by creating a certain DNS record in the domain's zone.
Proxmox VE supports both of those challenge types out of the box, you can configure
plugins either over the web interface under `Datacenter -> ACME`, or using the
`pvenode acme plugin add` command.
ACME Plugin configurations are stored in `/etc/pve/priv/acme/plugins.cfg`.
A plugin is available for all nodes in the cluster.
### Node Domains
Each domain is node specific. You can add new or manage existing domain entries
under Node -> Certificates, or using the `pvenode config` command.
After configuring the desired domain(s) for a node and ensuring that the
desired ACME account is selected, you can order your new certificate over the
web-interface. On success the interface will reload after 10 seconds.
Renewal will happen automatically.
## ACME HTTP Challenge Plugin
There is always an implicitly configured standalone plugin for validating
http-01 challenges via the built-in webserver spawned on port 80.
The name `standalone` means that it can provide the validation on it's
own, without any third party service. So, this plugin works also for cluster
nodes.
There are a few prerequisites to use it for certificate management with Let's
Encrypts ACME.
* You have to accept the ToS of Let's Encrypt to register an account.
* Port 80 of the node needs to be reachable from the internet.
* There must be no other listener on port 80.
* The requested (sub)domain needs to resolve to a public IP of the Node.
## ACME DNS API Challenge Plugin
On systems where external access for validation via the http-01 method is
not possible or desired, it is possible to use the dns-01 validation method.
This validation method requires a DNS server that allows provisioning of TXT
records via an API.
### Configuring ACME DNS APIs for validation
Proxmox VE re-uses the DNS plugins developed for the
[acme.sh project](https://github.com/acmesh-official/acme.sh). Please
refer to its documentation for details on configuration of specific APIs.
The easiest way to configure a new plugin with the DNS API is using the web
interface (`Datacenter -> ACME`).
Choose DNS as challenge type. Then you can select your API provider, enter
the credential data to access your account over their API.
See the `acme.sh`
[How to use DNS API](https://github.com/acmesh-official/acme.sh/wiki/dnsapi#how-to-use-dns-api)
wiki for more detailed information about getting API credentials for your
provider.
As there are many DNS providers and API endpoints Proxmox VE automatically generates
the form for the credentials for some providers. For the others you will see a
bigger text area, simply copy all the credentials KEY=VALUE pairs in there.
## DNS Validation through CNAME Alias
A special alias mode can be used to handle the validation on a different
domain/DNS server, in case your primary/real DNS does not support provisioning
via an API. Manually set up a permanent CNAME record for
`_acme-challenge.domain1.example` pointing to `_acme-challenge.domain2.example`
and set the alias property in the Proxmox VE node configuration file to
`domain2.example` to allow the DNS server of `domain2.example` to validate all
challenges for `domain1.example`.
### Combination of Plugins
Combining http-01 and dns-01 validation is possible in case your node is
reachable via multiple domains with different requirements / DNS provisioning
capabilities. Mixing DNS APIs from multiple providers or instances is also
possible by specifying different plugin instances per domain.
Accessing the same service over multiple domains increases complexity and
should be avoided if possible.
## Automatic renewal of ACME certificates
If a node has been successfully configured with an ACME-provided certificate
(either via `pvenode` or via the GUI), the certificate will be automatically
renewed by the `pve-daily-update.service`. Currently, renewal will be attempted
if the certificate has expired already, or will expire in the next 30 days.
## ACME Examples with pvenode
*Example*: Sample `pvenode` invocation for using Let's Encrypt certificates
```sh
root@proxmox:~# pvenode acme account register default [email protected]
Directory endpoints:
0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
2) Custom
Enter selection: 1
Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you agree to the above terms? [y|N]y
...
Task OK
root@proxmox:~# pvenode config set --acme domains=example.invalid
root@proxmox:~# pvenode acme cert order
Loading ACME account details
Placing ACME order
...
Status is 'valid'!
All domains validated!
...
Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
Task OK
```
*Example*: Setting up the OVH API for validating a domain
The account registration steps are the same no matter which plugins are
used, and are not repeated here.
OVH_AK and OVH_AS need to be obtained from OVH according to the OVH
API documentation
First you need to get all information so you and Proxmox VE can access the API.
```sh
root@proxmox:~# cat /path/to/api-token
OVH_AK=XXXXXXXXXXXXXXXX
OVH_AS=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
root@proxmox:~# source /path/to/api-token
root@proxmox:~# curl -XPOST -H"X-Ovh-Application: $OVH_AK" -H "Content-type: application/json" \
https://eu.api.ovh.com/1.0/auth/credential -d '{
"accessRules": [
{"method": "GET","path": "/auth/time"},
{"method": "GET","path": "/domain"},
{"method": "GET","path": "/domain/zone/*"},
{"method": "GET","path": "/domain/zone/*/record"},
{"method": "POST","path": "/domain/zone/*/record"},
{"method": "POST","path": "/domain/zone/*/refresh"},
{"method": "PUT","path": "/domain/zone/*/record/"},
{"method": "DELETE","path": "/domain/zone/*/record/*"}
]
}'
{"consumerKey":"ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ","state":"pendingValidation","validationUrl":"https://eu.api.ovh.com/auth/?credentialToken=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
(open validation URL and follow instructions to link Application Key with account/Consumer Key)
root@proxmox:~# echo "OVH_CK=ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ" >> /path/to/api-token
```
Now you can setup the ACME plugin:
```sh
root@proxmox:~# pvenode acme plugin add dns example_plugin --api ovh --data /path/to/api_token
root@proxmox:~# pvenode acme plugin config example_plugin
```sh
<pre>
┌────────┬──────────────────────────────────────────┐
│ key │ value │
╞════════╪══════════════════════════════════════════╡
│ api │ ovh │
├────────┼──────────────────────────────────────────┤
│ data │ OVH_AK=XXXXXXXXXXXXXXXX │
│ │ OVH_AS=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY │
│ │ OVH_CK=ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ │
├────────┼──────────────────────────────────────────┤
│ digest │ 867fcf556363ca1bea866863093fcab83edf47a1 │
├────────┼──────────────────────────────────────────┤
│ plugin │ example_plugin │
├────────┼──────────────────────────────────────────┤
│ type │ dns │
└────────┴──────────────────────────────────────────┘
</pre>
At last you can configure the domain you want to get certificates for and
place the certificate order for it:
```sh
root@proxmox:~# pvenode config set -acmedomain0 example.proxmox.com,plugin=example_plugin
root@proxmox:~# pvenode acme cert order
Loading ACME account details
Placing ACME order
Order URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/11111111/22222222
Getting authorization details from 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/33333333'
The validation for example.proxmox.com is pending!
[Wed Apr 22 09:25:30 CEST 2020] Using OVH endpoint: ovh-eu
[Wed Apr 22 09:25:30 CEST 2020] Checking authentication
[Wed Apr 22 09:25:30 CEST 2020] Consumer key is ok.
[Wed Apr 22 09:25:31 CEST 2020] Adding record
[Wed Apr 22 09:25:32 CEST 2020] Added, sleep 10 seconds.
Add TXT record: _acme-challenge.example.proxmox.com
Triggering validation
Sleeping for 5 seconds
Status is 'valid'!
[Wed Apr 22 09:25:48 CEST 2020] Using OVH endpoint: ovh-eu
[Wed Apr 22 09:25:48 CEST 2020] Checking authentication
[Wed Apr 22 09:25:48 CEST 2020] Consumer key is ok.
Remove TXT record: _acme-challenge.example.proxmox.com
All domains validated!
Creating CSR
Checking order status
Order is ready, finalizing order
valid!
Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
Task OK
```
### Example: Switching from the staging to the regular ACME directory
Changing the ACME directory for an account is unsupported, but as Proxmox VE
supports more than one account you can just create a new one with the
production (trusted) ACME directory as endpoint. You can also deactivate the
staging account and recreate it.
*Example*: Changing the default ACME account from staging to directory using `pvenode`
```sh
root@proxmox:~# pvenode acme account deactivate default
Renaming account file from '/etc/pve/priv/acme/default' to '/etc/pve/priv/acme/_deactivated_default_4'
Task OK
root@proxmox:~# pvenode acme account register default [email protected]
Directory endpoints:
0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
2) Custom
Enter selection: 0
Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you agree to the above terms? [y|N]y
...
Task OK
```
Proxmox/Proxmox Cheat-Sheet.md
-393
View File
@@ -1,393 +0,0 @@
Proxmox Virtual Environment (Proxmox VE or PVE) is a hyper-converged infrastructure open-source software. It is a hosted hypervisor that can run operating systems including Linux and Windows on x64 hardware. It is a Debian-based Linux distribution with a modified Ubuntu LTS kernel and allows deployment and management of virtual machines and containers. Proxmox VE includes a web console and command-line tools, and provides a REST API for third-party tools. Two types of virtualization are supported: container-based with LXC (starting from version 4.0 replacing OpenVZ used in version up to 3.4, included), and full virtualization with KVM. It includes a web-based management interface.
Proxmox VE is licensed under the GNU Affero General Public License, version 3.
Repository: [https://git.proxmox.com](https://git.proxmox.com)
Website: [https://pve.proxmox.com](https://pve.proxmox.com)
## VM Management
```shell
# list VMs
qm list
# Create or restore a virtual machine.
qm create your-vm-id
# start a VM
qm start your-vm-id
# Suspend virtual machine.
qm suspend your-vm-id
# shutdown a VM
qm shutdown your-vm-id
# reboot a VM
qm reboot your-vm-id
# reset a VM
qm reset your-vm-id
# stop a VM
qm stop your-vm-id
# Destroy the VM and all used/owned volumes.
# Removes any VM specific permissions and firewall rules
qm destroy your-vm-id
# Enter Qemu Monitor interface.
qm monitor your-vm-id
# Get the virtual machine configuration with both current and pending values.
qm pending your-vm-id
# Send key event to virtual machine.
qm sendkey your-vm-id your-key-event [OPTIONS]
# Show command line which is used to start the VM (debug info).
qm showcmd your-vm-id [OPTIONS]
# Unlock the VM.
qm unlock your-vm-id
# Clone a VM
qm clone your-vm-id new-vm-id
# Migrate a VM
qm migrate your-vm-id target-node
# Show VM status
qm status your-vm-id
# Clean up resources for a VM
qm cleanup your-vm-id your-clean-shutdown your-guest-requested
# Create a Template.
qm template your-vm-id [OPTIONS]
# Set virtual machine options (synchrounous API)
qm set your-vm-id [OPTIONS]
```
### Cloudinit
```shell
# Get automatically generated cloudinit config.
qm cloudinit dump your-vm-id your-vm-type
# Get the cloudinit configuration with both current and pending values.
qm cloudinit pending your-vm-id
# Regenerate and change cloudinit config drive.
qm cloudinit update your-vm-id
```
### Disk
```shell
# Import an external disk image as an unused disk in a VM.
# The image format has to be supported by qemu-img(1).
qm disk import your-vm-id your-target-source your-target-storage
# Move volume to different storage or to a different VM.
qm disk move your-vm-id your-vm-disk [<storage>] [OPTIONS]
# Rescan all storages and update disk sizes and unused disk images.
qm disk rescan [OPTIONS]
# Extend volume size.
qm disk resize your-vm-id your-vm-disk <size> [OPTIONS]
# Unlink/delete disk images.
qm disk unlink your-vm-id --idlist <string> [OPTIONS]
# rescan volumes
qm rescan
```
### Snapshot
```shell
# List all snapshots.
qm listsnapshot your-vm-id
# Snapshot a VM
qm snapshot your-vm-id <snapname>
# Delete a snapshot.
qm delsnapshot your-vm-id <snapname>
# Rollback a snapshot
qm rollback your-vm-id <snapname>
# Open a terminal using a serial device
# (The VM need to have a serial device configured, for example serial0: socket)
qm terminal your-vm-id [OPTIONS]
# Proxy VM VNC traffic to stdin/stdout
qm vncproxy your-vm-id
```
### Misc
```shell
# Execute Qemu Guest Agent commands.
qm guest cmd your-vm-id <command>
# Executes the given command via the guest agent
qm guest exec your-vm-id [<extra-args>] [OPTIONS]
# Gets the status of the given pid started by the guest-agent
qm guest exec-status your-vm-id <pid>
# Sets the password for the given user to the given password
qm guest passwd your-vm-id <username> [OPTIONS]
```
### PV, VG, LV Management
```shell
# Create a PV
pvcreate <disk-device-name>
# Remove a PV
pvremove <disk-device-name>
# List all PVs
pvs
# Create a VG
vgcreate <vg-name> <disk-device-name>
# Remove a VG
vgremove <vg-name>
# List all VGs
vgs
# Create a LV
lvcreate -L <lv-size> -n <lv-name> <vg-name>
# Remove a LV
lvremove <vg-name>/<lv-name>
# List all LVs
lvs
```
### Storage Management
```shell
# Create a new storage.
pvesm add <type> <storage> [OPTIONS]
# Allocate disk images.
pvesm alloc <storage> your-vm-id <filename> <size> [OPTIONS]
# Delete volume
pvesm free <volume> [OPTIONS]
# Delete storage configuration.
pvesm remove <storage>
# List storage content.
pvesm list <storage> [OPTIONS]
# An alias for pvesm scan lvm.
pvesm lvmscan
# An alias for pvesm scan lvmthin.
pvesm lvmthinscan
# List local LVM volume groups.
pvesm scan lvm
# List local LVM Thin Pools.
pvesm scan lvmthin <vg>
# Get status for all datastores.
pvesm status [OPTIONS]
```
### Template Management
```shell
# list all templates
pveam available
# list all templates
pveam list <storage>
# Download appliance templates
pveam download <storage> <template>
# Remove a template.
pveam remove <template-path>
# Update Container Template Database.
pveam update
```
## Certificate Management
See the [Proxmox Certificate Management](proxmox-certificate-management.md) cheat sheet.
## Container Management
```shell
# List containers
pct list
# Create or restore a container.
pct create your-vm-id <ostemplate> [OPTIONS]
# Start the container.
pct start your-vm-id [OPTIONS]
# Create a container clone/copy
pct clone your-vm-id new-vm-id [OPTIONS]
# Suspend the container. This is experimental.
pct suspend your-vm-id
# Resume the container.
pct resume your-vm-id
# Stop the container.
# This will abruptly stop all processes running in the container.
pct stop your-vm-id [OPTIONS]
# Shutdown the container.
# This will trigger a clean shutdown of the container, see lxc-stop(1) for details.
pct shutdown your-vm-id [OPTIONS]
# Destroy the container (also delete all uses files).
pct destroy your-vm-id [OPTIONS]
# Show CT status.
pct status your-vm-id [OPTIONS]
# Migrate the container to another node. Creates a new migration task.
pct migrate your-vm-id <target> [OPTIONS]
# Get container configuration.
pct config your-vm-id [OPTIONS]
# Print the list of assigned CPU sets.
pct cpusets
# Get container configuration, including pending changes.
pct pending your-vm-id
# Reboot the container by shutting it down, and starting it again. Applies pending changes.
pct reboot your-vm-id [OPTIONS]
# Create or restore a container.
pct restore your-vm-id <ostemplate> [OPTIONS]
# Set container options.
pct set your-vm-id [OPTIONS]
# Create a Template.
pct template your-vm-id
# Unlock the VM.
pct unlock your-vm-id
```
### Container Disks
```shell
# Get the container?s current disk usage.
pct df your-vm-id
# Run a filesystem check (fsck) on a container volume.
pct fsck your-vm-id [OPTIONS]
# Run fstrim on a chosen CT and its mountpoints.
pct fstrim your-vm-id [OPTIONS]
# Mount the container?s filesystem on the host.
# This will hold a lock on the container and is meant for emergency maintenance only
# as it will prevent further operations on the container other than start and stop.
pct mount your-vm-id
# Move a rootfs-/mp-volume to a different storage or to a different container.
pct move-volume your-vm-id <volume> [<storage>] [<target-vmid>] [<target-volume>] [OPTIONS]
# Unmount the container?s filesystem.
pct unmount your-vm-id
# Resize a container mount point.
pct resize your-vm-id your-vm-disk <size> [OPTIONS]
# Rescan all storages and update disk sizes and unused disk images.
pct rescan [OPTIONS]
# Connect to container
pct enter your-vm-id
# Launch a console for the specified container.
pct console your-vm-id [OPTIONS]
# Launch a shell for the specified container.
pct enter your-vm-id
# Launch a command inside the specified container.
pct exec your-vm-id [<extra-args>]
# Copy a file from the container to the local system.
pct pull your-vm-id <path> <destination> [OPTIONS]
# Copy a local file to the container.
pct push your-vm-id <file> <destination> [OPTIONS]
```
### Container Snapshot
```shell
# Snapshot a container.
pct snapshot your-vm-id <snapname> [OPTIONS]
# List all snapshots.
pct listsnapshot your-vm-id
# Rollback LXC state to specified snapshot.
pct rollback your-vm-id <snapname> [OPTIONS]
# Delete a LXC snapshot.
pct delsnapshot your-vm-id <snapname> [OPTIONS]
```
## Web GUI
```shell
# Restart web GUI
service pveproxy restart
```
## Resize Disk
### Increase disk size
Increase disk size in the GUI or with the following command
```shell
qm resize 100 virtio0 +5G
```
### Decrease disk size
> Before decreasing disk sizes in Proxmox, you should take a backup!
1. Convert qcow2 to raw: `qemu-img convert vm-100.qcow2 vm-100.raw`
2. Shrink the disk `qemu-img resize -f raw vm-100.raw 10G`
3. Convert back to qcow2 `qemu-img convert -p -O qcow2 vm-100.raw vm-100.qcow2`
## Further information
More examples and tutorials regarding Proxmox can be found in the link list below:
- Ansible playbook that automates Linux VM updates running on Proxmox (including snapshots): [TheDatabaseMe - update_proxmox_vm](https://github.com/thedatabaseme/update_proxmox_vm)
- Manage Proxmox VM templates with Packer: [Use Packer to build Proxmox images](https://thedatabaseme.de/2022/10/16/what-a-golden-boy-use-packer-to-build-proxmox-images/)