# Proxmox — manual, one-time steps

Deliberately NOT automated (Phase 4 §21: "do not over-automate bare-metal Proxmox installation
if it becomes fragile" — a broken automated install of the one host that IS the only way in is
a much worse failure mode than a documented manual step reviewed by a human once).

## 1. Install Proxmox VE

Standard ISO install on the Hetzner dedicated server, once purchased. Follow Proxmox's own
install guide. Full checklist: `docs/PRODUCTION_DEPLOYMENT.md` §1-2.

## 2. Build the cloud-init VM template

One-time, either via `virt-customize`/manual, or Packer if already a comfortable tool here:

```bash
# On the Proxmox host, after downloading an Ubuntu 22.04 cloud image:
qm create 9000 --name ubuntu-22.04-cloudinit --memory 2048 --cores 2 --net0 virtio,bridge=vmbr0
qm importdisk 9000 jammy-server-cloudimg-amd64.img local-zfs
qm set 9000 --scsihw virtio-scsi-pci --scsi0 local-zfs:vm-9000-disk-0
qm set 9000 --ide2 local-zfs:cloudinit
qm set 9000 --boot c --bootdisk scsi0
qm set 9000 --serial0 socket --vga serial0
qm set 9000 --agent enabled=1
qm template 9000
```

Then apply `infra/proxmox/cloud-init/user-data.yaml` as the template's default cloud-init
user-data (Proxmox's own cloud-init snippet mechanism — `Datacenter -> Storage -> snippets`).

## 3. Hand off to Terraform + Ansible

Once the template exists and tagged `template` (matching `infra/terraform/main.tf`'s data
source filter), `infra/terraform/` can clone `rn-platform-01`/`rn-lab-host-01` from it, and
`infra/ansible/site.yml` configures them. Neither of those needs further Proxmox-console work
after this point — see `docs/RUNBOOK_FIRST_DEPLOYMENT.md`.

## 4. Proxmox host firewall

Apply `infra/firewall/proxmox-host.rules` manually (rendered with real values) — see that
file's own header comment for why this one ruleset stays a manual apply, unlike the two VMs'.