Proxmox Post-Install Hardening Kit
Production-ready Proxmox in 10 minutes — security hardening, monitoring, storage, and network config scripts.
Proxmox Installs in 10 Minutes. Getting It Right Takes All Day.
The Proxmox installer gets you a working hypervisor. Then you need to disable the enterprise repo nag, configure storage pools, set up network bridges, harden SSH, tune kernel parameters for your workload, and add monitoring. Every homelab guide covers these steps in a different order with half the context. This kit does it all in one run.
What Is Included
- post-install.sh — removes enterprise subscription nag, enables the no-subscription repo, disables IPv6 if unused, sets optimal kernel parameters for a hypervisor workload
- harden-ssh.sh — disables password auth, sets sane SSH timeouts, installs fail2ban with Proxmox-aware jail config
- setup-storage.sh — creates LVM-thin pool for VMs, ZFS pool for backups (if drives available), and adds both to Proxmox storage
- setup-networking.sh — creates vmbr0 (VM bridge) and optional VLAN bridge, with interactive prompts for your interface names
- monitoring-stack/ — Docker Compose with Prometheus + Grafana + the Proxmox exporter, pre-wired with a Proxmox dashboard
- notify-setup.sh — configures Proxmox email alerts for backup failures and HA events via msmtp or SMTP relay
- README.md — run order, what each script changes, rollback notes, and recommended first VMs to create
How It Works
Run scripts in the order listed in the README. Each is idempotent — safe to re-run. The monitoring stack runs alongside Proxmox in Docker. Total time from fresh install to fully configured: under 15 minutes.
What You Get Immediately
- No more subscription nag on every login
- SSH locked down with fail2ban active
- Storage pools configured and visible in the Proxmox UI
- VM network bridge ready for your first VM
- Grafana dashboard showing CPU, RAM, storage, and VM status
- Email alerts for backup failures
Requirements
Fresh Proxmox VE 8.x install on bare metal or a dedicated server. Root access. Docker installed on the Proxmox host (for the monitoring stack). An SMTP relay or msmtp config for email alerts (optional).