DEV Community

Cover image for Proxmox Datacenter Manager: One Pane Over Every Cluster
Josh Hall
Josh Hall

Posted on Edited on Originally published at peira.dev

Proxmox Datacenter Manager: One Pane Over Every Cluster

#proxmox #homelab #selfhosted #devops

Run more than one Proxmox cluster and you end up living in browser tabs — one for the office cluster, one for the box at home, one for the backup server. Proxmox Datacenter Manager (PDM) gives you one read-only pane over all of it — but only bother if you actually run more than one cluster. For a single cluster the native Proxmox VE interface already does this, and PDM is just one more thing to host and secure.

Here's how I deployed PDM 1.1 in a container and connected my clusters with tokens that can only look.

This is a cross-post from Peira Labs. The full illustrated version — with the add-remote wizard, the architecture diagram, and every gotcha — lives at https://peira.dev/articles/proxmox-datacenter-manager/

What PDM actually is

A Proxmox VE cluster fuses several nodes into one system. PDM sits a layer above: it doesn't join anything, it connects to your clusters and standalone nodes as remotes and aggregates them into one screen. Each remote stays independent and hands PDM nothing but an API token — which is the whole security story, because you decide exactly how much that token can do.

PDM login screen

Deploy it in a container

PDM ships as Debian packages, so a plain Debian 13 ("trixie") LXC does the job (2 vCPU / 2 GB RAM is plenty). Add the no-subscription repo and install:

wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
  -O /usr/share/keyrings/proxmox-archive-keyring.gpg

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pdm
Suites: trixie
Components: pdm-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

apt update
apt install proxmox-datacenter-manager-container-meta
Enter fullscreen mode Exit fullscreen mode

The web UI comes up on port 8443. Log in as root@pam with the container's root password.

Connect a cluster so it can only look

On each cluster, create a dedicated user and a read-only token rather than handing PDM an admin login. Proxmox VE has a built-in PVEAuditor role (read access, nothing else); Proxmox Backup Server has an Audit role:

# Proxmox VE
pveum user add pdm@pve
pveum acl modify / -user pdm@pve -role PVEAuditor
pveum user token add pdm@pve pdm --privsep 0   # prints the secret ONCE

# Proxmox Backup Server
proxmox-backup-manager user create pdm@pbs
proxmox-backup-manager user generate-token pdm@pbs pdm
proxmox-backup-manager acl update / Audit --auth-id 'pdm@pbs!pdm'
Enter fullscreen mode Exit fullscreen mode

In PDM, Remotes → Add, give it the node address, let it read back the certificate fingerprint (it pins it, so a swapped cert breaks the link on purpose), then paste the token. Both remotes then show up with their audit tokens:

PDM remotes table with two audit-scoped remotes

The single pane

With both remotes connected, the dashboard finally aggregates every node, guest, and datastore across separate clusters, with combined CPU/memory/storage gauges:

PDM dashboard aggregating resources across remotes

Three rough edges

  • A 403 in the log every cycle — ignore it. PDM tries to fetch each node's available updates, which needs Sys.Modify. Your audit token doesn't have it, so you get a harmless 403 per cycle. That's least-privilege working as intended.
  • A pure-Audit token can't populate every tile. On my PBS remote, PDM's resource-collection call returns 403 permission check failed, so the backup node reads as offline even though the connection is fine. Decide per remote whether you want the extra read scope.
  • The 1.1.7 client CLI won't do password-file auth. The separate proxmox-datacenter-manager-client rejects --user root@pam --password-file even when the same credentials pass at the raw API. The UI, admin CLI, and API are all fine — use one of those.

And if you later want PDM 1.1's cross-cluster VM migration, remember these tokens can't do it (migration writes to both sides) — re-scope deliberately for that job.

For a single cluster, skip it. But the day you're logging into three Proxmox tabs to answer "is everything up?", PDM is the fix — and you can stand it up in an afternoon with credentials that can't hurt you.

Written by Peira Labs — full version with the add-remote wizard walkthrough and architecture diagram at peira.dev.

Top comments (1)

Collapse
 
sikamikanikobg profile image
Arsen Apostolov •

the "only bother if you run more than one cluster" line is the honest part and i agree with it. i have one cluster and the native interface does the job, so i do not host one more thing just to look at it. the 403 every cycle is also a good example of least privilege doing its job, it is annoying in the log but it means the token really cannot do more than read. the PBS tile reading offline with a pure audit token is the kind of edge that makes you think twice before you add the extra scope, because now you have a dashboard that lies to you. i ended up with a small self-hosted monitor (SikamikanikoBG/homelab-monitor) that just polls the pve api read-only, no second pane to secure, and for my size that is the whole stack.