verae-ops/03-proxmox.md

3. Proxmox (LXC and QEMU)

Target: one NATS cluster VM/CT (or three), one HTTPS edge VM, one or more worker VMs. Fleet SSH-spreads worm/tree-node onto worker hosts.

Suggested guests

Guest	OS	vCPU / RAM / disk	Role
nats-a nats-b nats-c	Debian 12 LXC unprivileged	1 / 1G / 8G	JetStream, bind 127.0.0.1 or a vmbr private bridge only
edge	Debian 12 QEMU	2 / 2G / 20G	Caddy + zappier-edge + middleware
worker-1 …	Debian 12 LXC	2 / 2G / 20G	fleet SSH target; worm + tree-node

Use a private bridge (vmbr1, RFC1918) for NATS 4222/6222. Public vmbr0 only on edge (80/443).

NATS on an LXC

apt-get update && apt-get install -y curl
# official nats-server binary
curl -sSL https://github.com/nats-io/nats-server/releases/latest/download/nats-server-v2.10.26-linux-amd64.tar.gz | tar -xz
install nats-server /usr/local/bin/

/etc/nats/nats.conf:

jetstream {}
listen: 10.10.10.11:4222          # private bridge, not 0.0.0.0 on public
cluster {
  name: verae
  listen: 10.10.10.11:6222
  routes: [ nats-route://10.10.10.12:6222, nats-route://10.10.10.13:6222 ]
}
http: 127.0.0.1:8222

systemd: ExecStart=/usr/local/bin/nats-server -c /etc/nats/nats.conf.

Edge VM

Install Node 22, clone zappier-edge and verae-middleware, Caddy reverse-proxy:

zappier.example.com {
  reverse_proxy 127.0.0.1:3000
}
middleware.example.com {
  reverse_proxy 127.0.0.1:3100
}

Middleware env: NATS_URL=nats://10.10.10.11:4222,nats://10.10.10.12:4222,nats://10.10.10.13:4222.

Fleet on Proxmox

On the operator workstation or a jump CT (loopback :3850):

machines.json entries: kind=ssh, user=root or marchon, host=10.10.10.2x, identityFile=~/.ssh/id_ed25519 (path only). Roles: tree-node,archive-worm. Capacity ≥ 3 per worker if you want floors on one host.

ssh-check from the operator console before enabling keepFloor.