Managed Proxmox Platform Architecture

Cluster, VM, backup, observability, and ownership architecture

Platform architecture

Managed Proxmox architecture should be simple enough to operate, explicit enough to audit, and sized for the workloads it actually hosts. The design below is a reference structure; each engagement records the final topology, support model, and accepted risks.

Reference layers#

Layer	Typical contents	Assistance responsibility	Customer responsibility
Facility/provider	Rack, power, remote hands, circuits, public IP allocation	Coordinate when scoped and document dependencies	Own contracts and provider approvals unless explicitly contracted
Physical hosts	Servers, firmware, disks, NICs, out-of-band management	Baseline, monitor, patch plan, capacity review	Procure/replace hardware when customer-owned
Proxmox cluster	Nodes, quorum, storage definitions, bridge/VLAN config, permissions	Configure, upgrade, document, and operate	Approve downtime, risk, and access decisions
Guest workloads	VMs, LXC containers, templates, cloud-init, resource limits	Create and operate guest infrastructure tasks in scope	Own OS/app behavior unless guest management is separately scoped
Data protection	Backup jobs, retention implementation, restore workflow, backup target	Implement, monitor, and test restores when scoped	Define retention, data policy, and application-level restore acceptance
Observability	Host metrics, storage alerts, VM availability, backup status, dashboards	Configure signals and triage platform alerts	Map alerts to business impact and application owners
Change/support	Requests, approvals, maintenance windows, rollback notes, incident records	Run the agreed workflow	Approve changes and communicate business impacts

Cluster sizing and topology#

The topology depends on workload criticality and hardware constraints:

Single host — acceptable for labs, development, migration staging, or explicitly accepted low-availability workloads. Requires clear backup/restore expectations because host failure can be customer-impacting.
Small cluster — common for production or shared internal platforms where maintenance, capacity movement, and host-level resilience matter. Quorum and failure-domain behavior must be understood.
Dedicated pools or clusters — useful when customer tenants, regulated workloads, noisy CI workloads, or production/non-production separation require stronger boundaries.

Cluster design should document CPU/RAM overcommit policy, reserved capacity, storage pressure thresholds, workload placement rules, naming conventions, and the process for adding or removing hosts.

Guest conventions#

Every VM or LXC should have:

owner, environment, criticality, and support contact;
source image or template lineage;
allocated CPU, RAM, disk, and network attachments;
backup inclusion/exclusion and retention class;
monitoring expectations and health signal;
patching responsibility for the guest OS;
recovery and restore-validation owner.

Assistance can manage guest OS operations only when that is included in scope. Otherwise, Proxmox health and guest application health remain separate responsibilities.

Management plane#

The management plane includes the Proxmox UI/API, SSH or bastion access, out-of-band management, monitoring, backup administration, and supporting DNS/TLS records. Keep management access private where practical, protected by least privilege, and documented in the access register.

Administrative access should be named, reviewed, and removed when no longer needed. Shared emergency credentials, if required, should have a rotation and break-glass record.

Architecture artifacts#

Maintain these artifacts for each operated environment:

topology diagram or written equivalent;
host inventory and warranty/provider details;
IP/VLAN/subnet and DNS record list;
storage layout, pool names, redundancy assumptions, and capacity thresholds;
VM/LXC inventory with owners and backup policy;
monitoring and alert route;
backup and restore procedure;
access register and emergency path;
change log and known-risk register.