How I keep servers online with Proxmox clusters and zero-trust access

I look after more than twenty company networks in Europe and the US, including XXL Marketing Solution GmbH and UD Staffing LLC. When something goes down, it’s almost never the hardware. It’s a single server doing too much, an admin port open to the internet, or a backup nobody ever tested.

Why single servers keep failing

A lot of growing companies add servers one at a time, at different providers, whenever they need one. It works — until one of them has a bad update or a dying disk. Then someone spends a whole day rebuilding it by hand.

Proxmox clusters and automatic failover

To get to 99.9% without being locked into a big cloud, I run Proxmox VE clusters of three or more machines. If one dies, its virtual machines restart on another automatically. Storage is replicated every few minutes so very little is ever lost.

# Put VM 104 under HA management
ha-manager add vm:104 --group prod-eu-nodes --max_relocate 2 --max_restart 3
# Replicate its disk to a second node every 5 minutes
pvesr create-local-job 104-0 prod-node-02 --schedule "*/5" --rate 50

• Give the cluster its own network link. If heartbeat traffic shares a cable with backups, a busy night can make nodes think each other are dead.
• Snapshot often. Frequent replication plus a deduplicating backup server keeps recovery quick.

Close every public admin door

The Proxmox web panel (port 8006), SSH and Windows Remote Desktop should never be reachable from the open internet. I put all of them behind two layers:

• Tailscale or a company VPN. You can only reach admin tools from an approved device, with access rules per person.
• Cloudflare in front of public sites. Attacks hit Cloudflare, not your server.

Backups only count if you restore them

A backup you’ve never restored is a hope, not a plan. Every cluster I run makes encrypted backups every night, sends them off-site, and I regularly restore them to check they work.

If your setup has any of these weak spots, book a free call and I’ll tell you what I’d fix first.