infraweaver/requirements
Requirements
InfraWeaver provisions virtual machines on a Proxmox host you already run. It does not install a hypervisor, buy cloud capacity, or work without a domain you control.
The short version
Free means free after everything else on that host is running. Proxmox will happily overcommit memory and then the kernel will pick a victim.
Sizing
The default is three identical control-plane nodes. Three is not decoration: etcd needs an odd number, and three is the smallest count that survives losing one.
| Shape | Nodes | Total | What it is for |
|---|---|---|---|
| Minimum viable | 3 × (4 vCPU / 8 GB / 100 GB) | 12 vCPU · 24 GB · 300 GB | The platform itself plus a handful of light catalog apps. Monitoring off. |
| Comfortable | 3 × (6 vCPU / 16 GB / 250 GB) | 18 vCPU · 48 GB · 750 GB | Monitoring on, a dozen apps, headroom for a node to go down without eviction pain. |
| Media / storage heavy | 3 × (8 vCPU / 16 GB / 250 GB) + external storage | 24 vCPU · 48 GB | Longhorn holds app state; bulk media belongs on an NFS or SMB share, not on replicated block storage. |
| Single node | 1 hybrid node | 4 vCPU · 8 GB · 100 GB | Supported by the cluster builder for evaluation. No redundancy: one node down is the whole platform down. |
Longhorn keeps three replicas of every volume by default, so usable storage is roughly a third of raw. Plan for that before you fill it.
Network
| What | Requirement |
|---|---|
| Bridge | A Proxmox bridge the nodes can attach to, reachable from the machine you administer from |
| Static IPs | One per node, outside your DHCP pool |
| MetalLB range | A small free range on the same subnet — Traefik and CoreDNS each take one VIP |
| Port 443 | Forwarded from your router to the Traefik VIP, if anything should be reachable from outside |
| LAN ranges | The CIDRs allowed to reach the internal tier. Enforced by a Traefik middleware, not by DNS. |
TALOS NIC NAMINGREAD THIS
Talos 1.13 and later name the first interface ens18 on Proxmox, not
eth0. A machine config that still says eth0 silently does
nothing: the node comes up on DHCP, joins etcd on the wrong address, and everything
downstream looks mysteriously broken. If a node joins on an address you did not choose,
this is why.
DNS and certificates
cert-manager issues a wildcard certificate over an ACME DNS-01 challenge, which means it needs write access to your zone. Pick the provider you actually use.
| Provider | DNS_PROVIDER | Credentials |
|---|---|---|
| Cloudflare | cloudflare | CLOUDFLARE_API_TOKEN scoped to Zone:DNS:Edit |
| AWS Route 53 | route53 | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_HOSTED_ZONE_ID |
| Azure DNS | azure | Client ID and secret, subscription, tenant, resource group |
| DigitalOcean | digitalocean | DIGITALOCEAN_TOKEN |
| Hetzner DNS | hetzner | HETZNER_DNS_API_KEY |
| None | none | HTTP-01 only. Works, but no wildcard certificate. |
Using Cloudflare as a proxy in front of the cluster? SSL mode must be Full. Flexible terminates TLS at Cloudflare and talks plain HTTP to your origin, which breaks the model.
Credentials you need to have ready
- An SSH key pairUsed to provision the VMs. Talos itself has no SSH daemon — the key is for the provisioning path.
- Proxmox API accessEither a token you created, or a root login the wizard uses once and discards.
- A DNS provider tokenScoped to the one zone. It goes into OpenBao at
secret/platform/dns-provider, never into git. - SMTP details, optionallyFor password resets and alert mail. The platform works without it; account recovery gets harder.