Proxmox
Proxmox VE is the homelab hypervisor. It runs a single VM: OPNsense, which handles routing and firewalling for the entire network.
Proxmox itself is managed with Ansible from the proxmox repo.
Ansible
The Ansible setup covers seven playbooks:
| Playbook | Purpose |
|---|---|
bootstrap_user.yml | One-time setup: creates the ansible user with passwordless sudo and SSH key |
configure_proxmox.yml | Sets DNS resolvers and timezone via the pvesh API |
configure_backups.yml | Manages the vzdump backup job in /etc/pve/jobs.cfg (nightly snapshot of all guests to a Synology NFS share) |
backup_host_config.yml | Archives the host's own configuration (/etc/pve, network, apt sources) to the NAS, since vzdump only covers guests |
restore_test.yml | Restores the latest vzdump of a guest to a fresh, unused VMID, boots it with the network isolated, verifies it reaches running, then removes the test guest |
update_proxmox.yml | Safe dist-upgrade with automatic reboot if the kernel changed |
install_node_exporter_community.yml | Installs Prometheus Node Exporter on port 9100 |
All playbooks are run from the ansible/ directory:
# Base configuration (DNS, timezone)
ansible-playbook configure_proxmox.yml
# Backup job
ansible-playbook configure_backups.yml
# Full system update
ansible-playbook update_proxmox.yml
# Install/update Node Exporter
ansible-playbook install_node_exporter_community.yml
Update safety
The update playbook guards against accidental major version upgrades. It checks whether next-release repositories (e.g. trixie on a bookworm system) are present in /etc/apt/ and aborts if so. A major upgrade requires explicitly setting allow_major_upgrade: true.
My experience
I had used Proxmox before for running LXC containers and virtual machines, so it was a familiar choice. The idea to run OPNsense as a VM inside Proxmox came from a ServeTheHome article. The best part of this setup is being able to snapshot the VM before a major OPNsense upgrade — if something breaks, rolling back is instant.
Managing Proxmox with Ansible has been smooth, though the automation is still partly a work in progress.