Proxmox VE installs in about twenty minutes. That is one of its great strengths, and also a trap: a default installation works, but it is not ready for production. Here are the seven settings we always apply before deploying the first virtual machine.
1. Choose the right package repositories
After installation, the enterprise repository is enabled. Without a subscription, updates fail. In the web interface, open Node > Updates > Repositories: disable the enterprise repository and enable the no-subscription one, or better still, buy a subscription for critical platforms. It gives access to the most thoroughly tested repository and to vendor support.
2. Update, then schedule updates
Apply all updates before going live (apt update then apt full-upgrade, or the Upgrade button in the interface). Then set a rhythm: for example a monthly window, node by node, migrating virtual machines to another cluster node before each reboot.
3. Check time synchronisation
A Proxmox cluster, and even more so distributed storage, copes very badly with clock drift between nodes. Check that every node synchronises (chronyc sources) with reliable time servers, ideally the same ones for all nodes.
4. Separate the networks
Running everything through a single network card is the source of many incidents. Plan at least:
- a management network for the web interface and SSH;
- a network dedicated to the cluster (Corosync), with low latency, ideally redundant;
- a high-bandwidth storage and migration network;
- bridges for the virtual machines, with VLAN support enabled (VLAN aware).
5. Create named accounts
Do not use the root@pam account day to day. Create one account per administrator, put them in groups, grant the narrowest roles possible (an operator who starts machines does not need to change storage), and enable two-factor authentication (TOTP) under Datacenter > Permissions > Two Factor. Keep the root account for emergencies.
6. Enable the firewall, methodically
Proxmox VE has a built-in firewall at three levels: datacenter, node and virtual machine. Before enabling it at datacenter level, first create the rules that allow the web interface (port 8006) and SSH (port 22) from your management network only. Enabled without rules, it can lock you out of the interface. Then add reusable security groups for your virtual machines.
7. Schedule backups from day one
Create the backup jobs before the first machines, not after the first incident. Proxmox Backup Server, installed on a separate machine, provides deduplication, backup verification and file-level restore. Set a retention policy (for example 7 daily, 4 weekly, 6 monthly), enable email notifications on failure, and test a restore in the very first week.
Going further
These settings lay sound foundations. Next come high availability, distributed storage, node monitoring and deployment automation: all topics that require the team running the platform to genuinely master it.