Setting up a single-node Proxmox home lab from scratch

Goal of this lesson

Take a brand-new mini-PC and turn it into a working single-node Proxmox home lab. By the end you’ll have:

• Proxmox VE installed and reachable on your network
• Repos configured to avoid the “no subscription” nag
• Updates current
• SSH hardened
• A backup of the host configuration

This is the equivalent of “hello world” for the home lab. Subsequent lessons add complexity: clustering, Ceph, PBS, SDN, etc.

Step 1: Download and prepare the installer

# On a separate machine (your laptop, etc.)
# Download the latest Proxmox VE 9.x ISO
wget https://enterprise.proxmox.com/iso/proxmox-ve_9.2-1.iso

# Verify the checksum (always)
sha256sum proxmox-ve_9.2-1.iso

# Write to USB stick (replace /dev/sdX with your stick)
dd if=proxmox-ve_9.2-1.iso of=/dev/sdX bs=4M status=progress conv=fdatasync

Step 2: Install Proxmox

1. Plug the USB stick into your mini-PC
2. Power on, mash F12 (or whatever your boot menu key is)
3. Select the USB stick
4. The Proxmox installer GUI launches — accept the EULA
5. Target Harddisk: select the NVMe or SSD (the installer may show “options” — for a single SSD, accept defaults)
6. Location and Time Zone: pick your country and timezone
7. Password and Email: set a strong root password; use a real email so you get alerts
8. Network: configure management network. Critical:
   • Hostname: pve.lab.local (or your preferred FQDN)
   • IP: a static IP outside your router’s DHCP range (e.g., 192.168.1.10/24)
   • Gateway: your router’s IP (e.g., 192.168.1.1)
   • DNS: 1.1.1.1 or your router
9. Click Install — takes ~5 minutes

Step 3: First boot and access the web UI

Reboot, remove the USB stick. From your laptop, open https://192.168.1.10:8006 in a browser.

You’ll see a self-signed certificate warning — accept it (we’ll fix this with a proper cert in a later lesson). Log in as root with the password you set.

The first thing you’ll notice is a small “No valid subscription” popup. We’re going to fix that by removing the enterprise repo and adding the no-subscription one.

Step 4: Remove the enterprise repo, add the no-subscription one

# SSH into your Proxmox host
ssh root@192.168.1.10

# Edit the sources.list to remove enterprise repo (which is for paying customers)
sed -i '/enterprise.proxmox.com/d' /etc/apt/sources.list.d/pve-enterprise.list

# Add the no-subscription repo
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list

# Update and upgrade
apt update
apt -y full-upgrade

# Reboot if a new kernel was installed
[ -e /var/run/reboot-required ] && reboot

Step 5: Disable the subscription nag

# Backup the file first
cp /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js.bak

# Patch out the nag
sed -Ezi.bak "s/(Ext\.Msg\.show\(\{\s+title: gettext\('No valid sub)/void\(\{ \/\/ \1/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
systemctl restart pveproxy

After running, refresh the UI and the nag is gone. This patch may break after a Proxmox upgrade — re-run if it reappears.

Step 6: Harden SSH

# Add your SSH public key
mkdir -p /root/.ssh
chmod 700 /root/.ssh
# (Paste your public key from your laptop)
# (heredoc replaced)
echo "ssh-ed25519 AAAA... your-key-comment" >> /root/.ssh/authorized_keyschmod 600 /root/.ssh/authorized_keys

# Test from your laptop BEFORE disabling password auth
ssh root@192.168.1.10

# If it works, disable password auth
sed -i 's/^#?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

Step 7: Set up basic storage

Decide on a storage layout. For a single-SSD lab:

# Option A: Use the whole SSD as a thin-pool (recommended for a single disk)
# During install, if you chose ext4, you have /dev/pve/root and /dev/pve/swap.
# Add an LVM-thin pool for VMs/LXC:
lvcreate -l +100%FREE -T pve/data

# Option B: Add a second disk and put VMs on it
# (see storage lessons for details)

Step 8: Configure DNS, NTP, and email

# Set NTP (Datacenter → Time, or via /etc/chrony/chrony.conf)
# (heredoc replaced)
echo "pool pool.ntp.org iburst" >> /etc/chrony/chrony.confsystemctl restart chrony

# Test
chronyc tracking

# Configure postfix for outbound email (so alerts work)
# Datacenter → Options → Email from address
# Or via /etc/postfix/main.cf

Step 9: Install common tools

apt install -y vim git curl wget htop iotop iftop mtr-tiny tmux

Step 10: Take a baseline backup

Even single-node Proxmox supports PBS. Set up PBS locally first (or use vzdump to local storage as a quick fallback):

# Quick fallback: a one-off host config backup
tar czf /root/pve-host-config-$(date +%F).tar.gz \
  /etc/pve /etc/network/interfaces /etc/hosts /etc/resolv.conf /etc/ssh

# Copy off
scp /root/pve-host-config-*.tar.gz your-laptop:~/

# Proper PBS setup is in another lesson

Step 11: Install PBS locally (optional but recommended)

The cleanest path is a small PBS instance — either as a VM on the same Proxmox host (chicken-and-egg, but fine for a lab) or on a separate device (a Raspberry Pi with a USB drive works).

For the lab-only PBS on the same host:

# Download PBS ISO
wget https://enterprise.proxmox.com/iso/proxmox-backup-server_4.2-1.iso

# Install in a VM (or on separate hardware)
# Then add it as a storage in Proxmox UI
# Datacenter → Storage → Add → Proxmox Backup Server

What’s next?

After this lesson, you should have a working single-node Proxmox host. Suggested next steps:

• Cluster it — add a second mini-PC and form a 2-node cluster (you’ll need a qdevice for quorum)
• Deploy services — try Pi-hole, Vaultwarden, Nextcloud via community-scripts.org
• Back it up — set up PBS properly
• Learn networking — start adding VLANs

Key takeaways

• A single-node home lab is the right starting point
• Disable enterprise repo + use no-subscription + patch the nag
• Harden SSH with key auth before you go further
• Take a baseline backup of /etc/pve and /etc/network/interfaces
• Don’t run important data without PBS

Knowledge check