This page explains the virtual machine layer. Proxmox hosts the VM layer, and Ansible creates or configures the machines that become Docker Swarm nodes and security services.
The VM layer exists so the physical host layout can stay flexible while the application layer sees stable node names and IP addresses. The MS-01 systems host the Swarm manager VMs, and the M900/Neo systems host worker VMs. That split keeps the control plane on the strongest, most storage-connected tier while still using the smaller systems for useful capacity.
The current VM model is intentionally simpler than the previous Kubernetes experiments. K3s inventory groups still exist in the Ansible repo because that work happened and may be useful historically, but Docker Swarm is the active application runtime. VM documentation should describe the Swarm-era layout unless the lab intentionally changes direction again.
| VM group | Hosts | Purpose |
|---|---|---|
| Swarm managers | ubuntu-ms-01, ubuntu-ms-02, ubuntu-ms-03 |
Docker Swarm managers and Keepalived VIP participants. |
| Swarm workers | ubuntu-neo-1, ubuntu-neo-2, ubuntu-m900-1, ubuntu-m900-4 |
Docker Swarm worker capacity. |
| Security VM | security-vm |
Wazuh manager/dashboard and Greenbone security tooling. |
The inventory also keeps K3s groups for prior Kubernetes work, but the current application runtime is Docker Swarm.
| VM | IP | Backing Proxmox host |
|---|---|---|
ubuntu-ms-01 |
10.0.30.20 |
ms-01 |
ubuntu-ms-02 |
10.0.30.21 |
ms-02 |
ubuntu-ms-03 |
10.0.30.22 |
ms-03 |
The manager VMs are the control-plane tier for Swarm. Keepalived runs on this group and provides the shared Swarm manager VIP at 10.0.30.40.
| VM | IP | Backing Proxmox host |
|---|---|---|
ubuntu-m900-1 |
10.0.30.30 |
m900-1 |
ubuntu-m900-4 |
10.0.30.33 |
m900-4 |
ubuntu-neo-1 |
10.0.30.34 |
neo-1 |
ubuntu-neo-2 |
10.0.30.35 |
neo-2 |
Worker VMs provide application capacity. GPU-capable hosts can receive Docker node labels so Plex/Jellyfin workloads can use hardware transcoding.
| VM | IP | Purpose |
|---|---|---|
security-vm |
10.0.30.50 |
Wazuh manager/indexer/dashboard, Greenbone, and security service staging. |
Falco agents run on Swarm hosts through Ansible-managed roles, while Trivy runs as a Swarm-managed scanner.
The security VM is separate from the Swarm app layer on purpose. Wazuh and Greenbone are infrastructure/security services with their own lifecycle and heavier operational footprint. Keeping them on a dedicated VM reduces coupling with the public app stacks and makes it easier to treat security tooling as part of the platform rather than just another user-facing app.
Swarm VMs are created from an Ubuntu cloud image by HomeLab/ansible/playbooks/vm/create-swarm-host-vms.yml.
| Setting | Value |
|---|---|
| Manager VMID range | 300+ |
| Worker VMID range | 200+ |
| Manager IP range | 10.0.30.20-29 |
| Worker IP range | 10.0.30.30-39 |
| Template image | Ubuntu Noble cloud image |
| VM bridge | vmbr0 |
| Preferred Ceph pool | rbd |
VM sizing is calculated from host resources with minimums, leaving capacity for Proxmox itself.
The VM creation playbook decides manager or worker role from Proxmox inventory groups. It then calculates the VM name, IP address, and VMID range so hosts can be recreated consistently. Manager VMIDs start at 300, worker VMIDs start at 200, manager IPs start at 10.0.30.20, and worker IPs start at 10.0.30.30.
new-vm and Docker playbooks.cd ~/HomeLab/ansible
ansible-playbook -i hosts.ini playbooks/vm/create-swarm-host-vms.yml
ansible-playbook -i hosts.ini playbooks/new-vm.yml --ask-vault-pass
ansible-playbook -i hosts.ini playbooks/docker/provision-swarm.yml