Prerequisites
Proxmox host
- Proxmox VE 8.x (7.x should work; the script only uses
qm,pveum,pvesm). - CPU with AVX (any Intel/AMD from ~2012+). The script creates VMs with CPU type
hostso the flag passes through — MongoDB (Graylog’s store) crash-loops without it. - Internet access from the host and the VMs (image + package downloads).
- A storage that can hold the VM disks (default sizing below), and the
localstorage able to hold snippets (default on).
Resource sizing
| Topology | RAM | Disk | Cores |
|---|---|---|---|
| Split — aleth-metrics | 8 GB | 60 GB | 4 |
| Split — aleth-logs (Graylog/OpenSearch) | 12 GB (8 GB minimum) | 100 GB | 4 |
| Split — aleth-siem (Wazuh) | 12 GB (8 GB minimum) | 80 GB | 4 |
| Single VM (everything) | 24 GB (16 GB minimum) | 200 GB | 4–8 |
The total must fit in the host’s available RAM with ~3 GB left for Proxmox itself. Split at 8/12/12 needs a ≥40 GB host; on a 32 GB host the script defaults split to 8/8/8 (24 GB) — or use a single 24 GB VM. A host at 32 GB running 8+12+12 is over-committed and will swap.
Split is recommended when the host has ≥40 GB RAM available — the script looks at free RAM and RAM already committed to running VMs, not just what’s installed, suggests a topology/size that fits, and warns (and asks to confirm) if the VMs you size would over-commit the host. An over-committed hypervisor swaps, and a swapping VM makes first-boot database work (LibreNMS, Graylog, Wazuh) take 10+ minutes instead of seconds — check free -m on the PVE host before you start.
Network
- Decide static IPs for the VMs (recommended — they’re monitoring targets) or use DHCP reservations.
- A domain for the web UIs. Recommended: a domain (or subdomain, e.g.
lab.example.com) whose DNS is hosted in Cloudflare — Caddy obtains a publicly-trusted Let’s Encrypt wildcard certificate through the Cloudflare API (ACME DNS-01), and the deploy can create the*.lab.example.com→ metrics-VM record for you. Nothing needs to be reachable from the Internet. Alternative: any internal suffix (e.g.lab.internal) on a DNS server you control, with Caddy’s private CA (TLS_MODE=internal) — you then trust its root cert on each client. - Firewall/router/switches that can send syslog, NetFlow/sFlow, and speak SNMP v3 — configured after deployment.
Accounts & keys to have ready
- Cloudflare API token (for the recommended TLS mode): My Profile → API Tokens → Create Token → “Edit zone DNS” template, scoped to the zone that holds your domain, with permissions Zone → Zone → Read and Zone → DNS → Edit. The setup scripts verify the token against the Cloudflare API before continuing. It is stored only in
/opt/alethurgy/.env(mode 600) on the metrics VM. - An email address for Let’s Encrypt expiry notices.
- (Optional) an ntfy topic or self-hosted ntfy server for push alerts — the script defaults to public ntfy.sh with a random topic suffix.
- (Optional, later) Anthropic API key or a local Ollama endpoint for the Grafana LLM plugin.
Nothing else is needed up front; every other credential (Grafana admin, Graylog admin, DB passwords, PVE API token) is created or generated by the setup script and stored in /opt/alethurgy/.env on each VM.
Next: Deployment.