Proxmox acme¶

What is IncusOS ?¶

IncusOS is an immutable OS solely designed around safely and reliably running Incus. Incus is a next-generation system container, application container, and virtual machine manager.

Install IncusOS¶

Go to the IncusOS image downloader.
In installation target Wipe the target drive must be checked.
In target drive identifier, put wwn
In application configuration Apply default configuration must be checked only for server1.
In TLS client certificate copy the output of incus remote get-client-certificate
In the advanced settings, paste the network configuration from incusos/serverX/network.yaml (where X represents the server number).
Download the ISO.
Configure the BIOS.
Boot from the ISO.
Install and reboot
Connect to IncusOS

Post install setup¶

Add the remote server

incus remote add serverX serverX.unicornafk.fr

Retrieve encryption recovery key in OS > System > Security

Create Volumes

# Volumes
incus storage volume create local flatcar

Create Networks

incus network create prod parent=enp3s0 vlan=10 --type=physical
incus network create lab parent=enp3s0 vlan=20 --type=physical

Add custom CA certs¶

https://linuxcontainers.org/incus-os/docs/main/reference/system/security/#configuration-options

Configure ACME¶

In OS > System > Security add custom CA cert.

custom_ca_certs:
  - |
    -----BEGIN CERTIFICATE-----
    xxxxxxx

In settings page configure the following :

acme.agree_tos: true acme.ca_url: https://openbao.unicornafk.fr:8200/v1/pki/acme/directory acme.domain: server.unicornafk.fr,serverX.unicornafk.fr (where X represents the server number) acme.email: admin@unicornafk.fr

Usage¶

Task¶

Use uv run task --list to find Flatcar group recipes for deploying the base VM infrastructure.

Tips¶

List hardware ressources¶

incus query /1.0/resources

Wipe a drive¶

incus admin os system storage wipe-drive -d '{"id":"/dev/disk/by-id/<disk-id>"}'