# 3. Proxmox (NS1 is the hypervisor)

**NS1.GEORGELAMBERT.ORG** (`70.88.205.138`) **is** the Proxmox host. Control plane, Caddy, keep, and fleet run on the host. Extra worm/tree copies run in an **unprivileged Ubuntu LXC** on the private bridge.

| Bridge | Address | Use |
|--------|---------|-----|
| `vmbr0` | `70.88.205.138/28` | Public HTTPS / SSH. **Never NATS.** |
| `vmbr1` | `10.10.10.1/24` | Private. PKI `.11`, peergos-a `.12`, peergos-b `.13`, **verae-px-worker `.20`** |

## Guest we actually deploy

| | |
|--|--|
| VMID | **510** |
| Name | `verae-px-worker` |
| Template | `ubuntu-24.04-standard_24.04-2_amd64.tar.zst` (`local`) |
| Disk | `SSD2` 16G |
| RAM / CPU | 2G / 2 |
| Roles | `tree-node`, `archive-worm` |
| Fleet id | `px-worker` |
| NATS | `nats://10.10.10.1:4222` (host `socat` → `127.0.0.1:4222`) |

Repo: [verae-proxmox](https://git.georgelambert.org/marchon/verae-proxmox)

```bash
# on NS1
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-proxmox.git
cd verae-proxmox
bash scripts/create-worker.sh
ssh -i ~/.ssh/id_ed25519 marchon@10.10.10.20 true
```

On the guest, bootstrap type `proxmox-worker` ([verae-bootstrap](https://git.georgelambert.org/marchon/verae-bootstrap)). Then `verae-fleet ssh-check px-worker` and set `"enabled": true` in `overlays/ns1/machines.json`.

## NATS for guests

Loopback NATS on the host stays `127.0.0.1:4222`. `verae-nats-private-proxy.service` binds **only** `10.10.10.1:4222`. Do not listen on `vmbr0`.

## Suggested future guests (not created by create-worker.sh)

| Guest | Role |
|-------|------|
| `nats-b` `nats-c` | Extra JetStream nodes on `vmbr1` when leaving all-in-one |
| more `worker-*` | Same recipe as 510 with the next free `10.10.10.2x` |

## Edge / Caddy

Stay on the **host** (already live). Do not put zappier-edge in the worker CT.

Operator console: `https://fleet.zapier.georgelambert.org/` · overlay `packages/verae-fleet/overlays/ns1/`.