Kubernetes on Proxmox.
Fully automated.

From bare Proxmox to production-ready Kubernetes — fully automated. Drive it from a Windows desktop app, an interactive TUI or a single CLI binary.

proxkube --config homelab.env install

Desktop App All Features

proxkube — Main Menu

⎈ proxkube HomeLab cluster: k8s-hetzner Phase 1/2

████████████░░░░░░░░░░░░░░░░ 43% (6/14) › Install Kubernetes

STEPS

✓🔍Preflight Check

✓📦Template exists

✓🖥Clone VMs

✓▶Start VMs + SSH

✓🔌Wait for SSH

✓⚖Setup load balancer (HAProxy + keepalived)

⟳☸Install Kubernetes packages

○🏗Init Control Plane

○🔗Install CNI Plugin

○🔄Join CPs (HA)

○👷Join Workers

○🏷Node labels + taints

○🔑Fetch kubeconfig

⎈ proxkube HomeLab mode: NodePort

ADDONS

▶1 → traefikwill installInfrastructure

2 → cert-managerwill installInfrastructure

3 → external-dnswill installInfrastructure

4 ● longhornalready installedStorage

5 → monitoringwill installObservability

6 → argocdwill installGitOps & Dev

7 → authentikwill installSecurity

8 ○ vaultskippedSecurity

9 ○ headlampskippedSecurity

10 → giteawill installGitOps & Dev

⎈ proxkube HomeLab cluster: k8s-hetzner Phase 2/2

████████████████████░░░░░░░░ 71% (5/7) › authentik

ADDONS

— Infrastructure

✓traefikdone

✓cert-managerdone

✓external-dnsdone

— GitOps & Dev

✓giteadone

✓argocddone

— Security

⟳authentikinstalling...

○monitoringwaiting

GitOps Status · k8s-hetzner · 16 managed · 0 unmanaged

ADDONSYNCHEALTHREVISIONAGE

▶argocdSyncedHealthya1b2c3d42d

cert-managerSyncedHealthye5f6g7h82d

traefikSyncedHealthyb9c0d1e21d

authentikSyncedHealthyf3g4h5i61d

external-dnsSyncedHealthyj7k8l9m01d

longhornSyncedHealthyn1o2p3q41d

monitoringSyncedHealthyr5s6t7u823h

vaultSyncedHealthyv9w0x1y223h

s sync app S sync all h history e edit values esc back

Addon Manager · k8s-hetzner · 12 installed · 24 available

ADDONSTATUSVERSIONACTION

▶traefikinstalledv32.1.0upgrade available

cert-managerinstalledv1.16.2up to date

argocdinstalledv7.7.14upgrade available

authentikinstalledv2024.12.3up to date

longhorninstalledv1.7.2up to date

vaultinstalledv0.29.1up to date

harbor—v1.16.0install

woodpecker—v2.8.1install

enter install/upgrade d uninstall esc back

Main Menu click or ↑ ↓ ⏎ esc

proxkube Desktop

Your whole cluster in one Windows app.

Everything from the first Proxmox connection to day-2 operations, without a terminal. Engine, kubectl and helm ship inside; no admin rights needed.

proxkube Desktop · homelab Interactive demo — click around

–□✕

⌂Overview

⬡Cluster

☷Architecture

⊞Add-ons

▦Apps

⎇GitOps

⚿Access

⚙Operations

⏲Maintenance

⚕Diagnostics

🧭

Guided Setup & Live Install

Connects to Proxmox, checks the host, creates an API token with exactly the permissions it needs and writes the config. During the install every step and VM appears live — and keeps running even when the app is closed.

🩻

Dashboard & Advisor

Nodes, VMs per Proxmox host, CPU, RAM and storage at a glance. The advisor spots problems — offline hosts, full disks, expiring certificates — and offers the fix; a diagnostics bundle collects everything for support.

✏️

Own Helm Values

See exactly what proxkube passes to every add-on chart (secrets masked) and what is deployed, then add your own values on top — saved per cluster, versioned, applied with snapshot protection.

🛟

Safety Net

VM snapshots before every risky action and a one-click rollback if something goes wrong. Every earlier version of your cluster config stays in the history.

🧰

Day-2 Operations

Resize VMs, add workers, rotate certificates, test backups, scan images with Trivy, watch disk space — and a maintenance window for unattended updates.

🔔

Runs Quietly, Stays Current

Lives in the system tray and notifies you when a node goes down. Updates itself together with the bundled engine. Several clusters, German or English, and a move to a new PC as one encrypted file.

Under the hood

One engine. No Ansible, no Terraform.

A single Go binary does the work — the desktop app, the TUI and the CLI all drive the same engine.

⚡

Automated & Resumable

Cloud-init template, network and storage detection, preflight doctor for VMIDs, IPs and DNS. If setup aborts, resume continues exactly where it left off — no VM is recreated.

🔒

Hardened by Default

Secrets encryption at rest, audit logging, nftables firewall, Pod Security Standards and kubelet TLS. Optional default-deny NetworkPolicies and Kyverno policies on top.

🔐

One Login, One Secret Store

Authentik covers kubectl and every web UI via OIDC or ForwardAuth — apps, roles and admin groups wired up automatically. Vault is initialized, unsealed and fed with the add-on credentials.

🛡️

Tailnet-only Admin UIs

Switch any UI between public and tailnet-only under the same URL via Tailscale MagicDNS. Bonus: one-tap cluster import into Nautik on iPhone, iPad and Mac.

⚙️

Modern Networking

Cilium or Calico with optional eBPF dataplane (no kube-proxy), Gateway API next to classic Ingress, and Hubble for live network flows.

💾

Backups & Safe Upgrades

Scheduled etcd and VM snapshots with retention, Velero for volumes, one-shot etcd restore. Upgrade preflight checks removed APIs and version skew; certificate rotation without downtime.

🐙

GitOps Built In

Bootstrap Gitea and ArgoCD as app-of-apps, see the sync status per add-on, trigger syncs and roll back to any history entry.

🖥️

TUI & CLI

A full Bubbletea TUI for servers and SSH sessions, and a CLI whose status commands speak JSON. The config can be encrypted with age — plaintext never touches disk.

🌐

Hetzner Dedicated

A special mode for Proxmox on Hetzner root servers: private NAT network, port forwarding and persistent iptables rules.

High Availability

Survive a whole Proxmox host going down.

proxkube spreads the cluster across your Proxmox hosts — and proves it with a failover test.

🧩Placement across hosts. proxkube ha discover and suggest read your Proxmox cluster and plan where control planes, workers and load balancers go — no host holds an etcd majority, the two load balancers sit on different hosts, workers follow free memory.
⚖️Load-balancer pair. Two HAProxy VMs share a virtual IP via keepalived — the API stays reachable while either one is down.
🗳️Quorum built in. A QDevice keeps a two-host Proxmox cluster quorate; ha check tells you whether the cluster survives the loss of each host.
🧪Failover test. proxkube ha test --node pve2 powers off the cluster VMs on that host like a power cut, checks the API and nodes, then starts them again. The desktop app has an HA assistant for all of it.

App Catalog

Homelab apps, one click each.

Ready-made apps with storage, ingress and TLS — the desktop app checks the RAM first. Bundles combine them with matching add-ons, or bring your own docker-compose.yml.

Jellyfin

Media server for movies, series and music.

Immich

Photo and video backup from your phone.

Paperless-ngx

Scan, OCR and search all your documents.

Nextcloud

Files, calendar and contacts — your own cloud.

Mealie

Recipes, meal plans and shopping lists.

AdGuard Home

Network-wide ad and tracker blocking.

Homelab basics · Homepage, Uptime Kuma, Vaultwarden Media · Jellyfin, Immich Household · Paperless-ngx, Mealie, Nextcloud Network · AdGuard Home, Uptime Kuma Developer · Gitea, Woodpecker, Harbor

Ecosystem

Add-ons at the flip of a switch

One click in the app or true in the config — ingress, DNS, TLS and login happen automatically.

Networking & Ingress

Traefik

M MetalLB

GW Gateway API

cert-manager

Cloudflare DNS

Observability

L Loki

Falco

N Nautik

Grafana

Hubble UI

Prometheus

U Uptime Kuma

Alertmanager

metrics-server

Security & Access

Vault

K Kyverno

H Headlamp

Authentik

Tailscale

Vaultwarden

ES External Secrets

Storage & Backup

Velero

H Harbor

Longhorn

GitOps & CI/CD

Gitea

ArgoCD

Flux CD

W Woodpecker CI

Renovate

Cluster Tools

Helm

⌂ Homepage

LP local-path