# 3. Proxmox (LXC and QEMU)

Target: one **NATS cluster VM/CT** (or three), one **HTTPS edge** VM, one or more **worker** VMs. Fleet SSH-spreads worm/tree-node onto worker hosts.

## Suggested guests

| Guest | OS | vCPU / RAM / disk | Role |
|-------|----|-------------------|------|
| `nats-a` `nats-b` `nats-c` | Debian 12 LXC unprivileged | 1 / 1G / 8G | JetStream, bind `127.0.0.1` **or** a vmbr **private** bridge only |
| `edge` | Debian 12 QEMU | 2 / 2G / 20G | Caddy + zappier-edge + middleware |
| `worker-1` … | Debian 12 LXC | 2 / 2G / 20G | fleet SSH target; worm + tree-node |

Use a **private bridge** (`vmbr1`, RFC1918) for NATS `4222`/`6222`. Public `vmbr0` only on `edge` (80/443).

## NATS on an LXC

```bash
apt-get update && apt-get install -y curl
# official nats-server binary
curl -sSL https://github.com/nats-io/nats-server/releases/latest/download/nats-server-v2.10.26-linux-amd64.tar.gz | tar -xz
install nats-server /usr/local/bin/
```

`/etc/nats/nats.conf`:

```
jetstream {}
listen: 10.10.10.11:4222          # private bridge, not 0.0.0.0 on public
cluster {
  name: verae
  listen: 10.10.10.11:6222
  routes: [ nats-route://10.10.10.12:6222, nats-route://10.10.10.13:6222 ]
}
http: 127.0.0.1:8222
```

systemd: `ExecStart=/usr/local/bin/nats-server -c /etc/nats/nats.conf`.

## Edge VM

Install Node 22, clone `zappier-edge` and `verae-middleware`, Caddy reverse-proxy:

```
zappier.example.com {
  reverse_proxy 127.0.0.1:3000
}
middleware.example.com {
  reverse_proxy 127.0.0.1:3100
}
```

Middleware env: `NATS_URL=nats://10.10.10.11:4222,nats://10.10.10.12:4222,nats://10.10.10.13:4222`.

## Fleet on Proxmox

On the operator workstation or a jump CT (loopback `:3850`):

`machines.json` entries: `kind=ssh`, `user=root` or `marchon`, `host=10.10.10.2x`, `identityFile=~/.ssh/id_ed25519` (**path only**). Roles: `tree-node,archive-worm`. Capacity ≥ 3 per worker if you want floors on one host.

`ssh-check` from the operator console before enabling `keepFloor`.