Proxmox

The Proxmox Vitural Environment (as of 2025-11-02) is a cluster hosted on citric-acid, tahini and teriyaki. The GUI can be accessed via the hostname of any machine on port 8006, e.g. https://citric-acid.csclub.uwaterloo.ca:8006.

LDAP

To setup LDAP, from `Server View`, open the `Datacenter` page. Then go to `Permissions -> Realms`.

Then go to the LDAP page, add ldap realm, and input ldap1.csclub.uwaterloo.ca, and ldap2.csclub.uwaterloo.ca as the servers. Then make sure to sync both groups, and users.

Label it `csclub`, and make sure to log in using that realm when logging in from web ui.

Joining the Cluster

To join the cluster, go to the existing CSC Cluster, from `Server View`, open the `Datacenter` page. Then go to `Cluster` and copy the join information.

On the new node, from `Server View`, open the `Datacenter` page. Then go to `Cluster`, then `Join Cluster` and paste the join information. You will need to enter the root password of the host where you copied the join information.

Virtual Machines

When making virtual machines in proxmox please first consider whether a full vm is needed, or an lxc will do.

Then go ahead, choose the node (reccomended to choose teriyaki, or tahini), and set a name.

When setting the name, if it is for a member please use `[watiam]-whatever-they-want`. If it's for something else, please name it clearly. Then when you get to os [storage is still TBD, check syscom irc, same with ISO image].

Add Qemu Agent, otherwise rest are fine with defaults.

Disks [TBD]

Network TBD

Networking

There are two ways to do networking: network bridge and NAT. Network bridge will put the container/virtual machine on the CSC network (basically side-by-side to proxmox itself), while NAT will encapsulate the container/VM inside a private subnet that is only visible to proxmox host itself.

For services that only exposes HTTP/HTTPS, NAT is more desirable since multiple services can share a host nginx instance, only requiring the host IP to have 80/443 port opened to the Internet, thus saving some IP address in our pool and save some trips to the IST for firewall exemption. But for services that requires custom ports to be opened (for example, BigBlueButton requires a range of UDP ports to be exposed for relaying video streams), using the network bridge and giving the container/VM its own public IP might be easier.

Currently, vmbr0 is used for bridged network and vmbr1 is used for NAT (see Proxmox's wiki on NAT networking for setup instruction). vmbr0 uses the CSC DHCP server, so you can use DHCP there, but vmbr1 requires manual IP assignment.

Note that only using vmbr1 requires you to use SSH ProxyJump via citric-acid to access the inner container, as it wouldn't have a public IP.