Building a recoverable single-node Proxmox VE foundation for practical home services.

I was bored, wanted to learn more.

Got some hardware available so I guess why not.

In these writeups (this is only the first one), I will document details of what I do in these homelabs.

I want to build stuff for my own home that is practical. Lets go :D

Homelab Phase 1: Proxmox Server Foundation

Overview

Phase 1 established the base infrastructure for a practical home lab. I deployed Proxmox VE directly on a dedicated physical server, configured stable management networking, cleaned up the package repositories, updated the host, and added external USB backup storage.

The result is a single-node virtualization platform ready for lightweight services such as AdGuard Home and Tailscale.

Design goals

• Keep the environment small, understandable, and maintainable.
• Use a Type 1 hypervisor instead of running services directly on a general-purpose OS.
• Separate guest workloads from the Proxmox host.
• Avoid storing the only backup on the same SSD as the host and guests.
• Document deferred security controls instead of pretending they were implemented.

Hardware

Architecture

Physical server
├── Proxmox VE host
│   ├── pve-root       Operating system and local files
│   ├── pve-data       LVM-thin storage for VM/LXC disks
│   └── vmbr0          Bridged LAN interface
└── External USB backup storage
    ├── dump/          Future Proxmox VM/LXC backups
    └── host-config/   Proxmox host configuration archives

Work completed

1. Hardware virtualization

I enabled Intel VT-x and VT-d in firmware and validated that the virtualization flags were visible to Linux.

egrep -c '(vmx|svm)' /proc/cpuinfo
lscpu | grep -i virtualization

This validates the effective configuration, not only the BIOS setting. A non-zero VMX/SVM count confirms that KVM can use hardware-assisted virtualization.

2. Bare-metal Proxmox installation

Proxmox VE was installed directly on the internal SATA SSD. I used the ext4/LVM-thin layout because this is a single-disk host with 16 GB of RAM.

• pve-root stores the host operating system.
• pve-data is the thin-provisioned guest disk pool.
• pve-swap provides swap space.
• The host boots with UEFI.

3. Static management networking

The Proxmox management interface uses a static LAN address on a Linux bridge. Future guests can connect to the same bridge and receive their own LAN addresses.

Operational IP addresses and hardware identifiers are intentionally omitted from this public write-up.

4. Repository cleanup and patching

I disabled or removed the enterprise and test repositories and enabled the no-subscription repository.

Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

I then refreshed the package index, upgraded the host, and rebooted.

apt update
apt full-upgrade -y
reboot

5. Backup storage

I identified the USB device separately from the Proxmox system disk before performing any destructive operation. The USB was configured with a GPT partition table and an ext4 filesystem labelled PVE-BACKUP.

The filesystem is mounted persistently by UUID:

UUID=<redacted> /mnt/pve/usb-backup ext4 defaults,nofail,x-systemd.device-timeout=10 0 2

The important controls are:

• UUID= avoids relying on changeable /dev/sdX names.
• nofail allows the host to boot if the USB is missing.
• x-systemd.device-timeout=10 prevents a long boot delay.

I registered the mount as dedicated Proxmox backup storage:

pvesm add dir usb-backup \
  --path /mnt/pve/usb-backup \
  --content backup \
  --is_mountpoint 1

--is_mountpoint 1 is a critical safety control. If the USB is not mounted, Proxmox marks the storage unavailable instead of writing backups into the empty mountpoint directory on the system SSD.

6. Host configuration backup

I created a timestamped compressed archive containing the important host configuration:

• /etc/pve
• /etc/network/interfaces
• /etc/hosts
• /etc/hostname
• /etc/fstab
• /etc/apt/sources.list.d
• /etc/vzdump.conf, when present

A SHA-256 checksum is stored next to the archive and was verified after creation.

host-config/
├── pve-host-config-YYYY-MM-DD-HHMMSS.tar.gz
└── pve-host-config-YYYY-MM-DD-HHMMSS.tar.gz.sha256

This is a configuration recovery archive, not a full Proxmox disk image. VM and LXC backups will be handled separately through Proxmox vzdump jobs.

Validation

The phase was accepted only after the following checks passed:

• Proxmox boots without installation media.
• The web interface remains reachable at the static management address.
• Hardware virtualization is visible to the kernel.
• The no-subscription repository is active and the test/enterprise repositories are not active.
• The host is fully updated and boots normally after the upgrade.
• findmnt confirms that the backup path is backed by the USB filesystem.
• pvesm status reports usb-backup as active.
• The host configuration archive and checksum exist.
• The checksum verification reports OK.
• The USB remounts and the Proxmox storage returns to active state after reboot.

Limitations

The attached USB protects against failure of the internal SSD and many configuration mistakes. It is not an offline or off-site backup because it remains connected to the same host.

A later improvement could add an encrypted copy to a NAS, Proxmox Backup Server, or cloud-compatible storage.

Skills demonstrated

• Bare-metal hypervisor deployment
• Hardware virtualization and IOMMU fundamentals
• Linux block-device identification and safe disk preparation
• GPT partitioning and ext4 filesystems
• Persistent mounts using UUID and /etc/fstab
• Linux bridge and static management networking
• Debian APT repository management
• Proxmox storage administration with pvesm
• Archive integrity validation with SHA-256
• Backup and recovery planning
• Risk-based security scoping and documentation

Result

Phase 1 is complete. The server now has a stable virtualization, networking, update, and backup foundation.

Next phase

Phase 2 will deploy AdGuard Home in an LXC container, assign a reserved LAN address, configure upstream DNS, validate filtering, and then migrate the home network to use it as the primary DNS resolver.