HZE Infrastructure

Overview

A self-hosted Proxmox VE environment running on a single physical host, with multiple isolated LXC containers providing public web services, internal tooling and AI workloads. Networking, storage and per-container firewall rules are managed in one place.

The system is operated end-to-end: provisioning, lifecycle, observability and backups. Service isolation is enforced at the container and firewall layer; there is no multi-host cluster underneath.

Problem

Self-hosted services, internal tooling and AI workloads all need predictable compute, isolated network segments and reproducible provisioning — without depending on a public cloud for everything.

Solution

A single Proxmox VE host running multiple LXC containers, each scoped to a single role (public web, internal tooling, AI, brain). Networking, firewall rules and storage live alongside the workloads and are versioned as code where practical.

Implementation

Proxmox VE provides the hypervisor and container primitives; LXC handles per-service isolation; Docker runs inside specific containers for apps that benefit from image-based deployment.

Per-container firewall rules (managed at the Proxmox layer) limit inbound and outbound traffic; LAN-only staging for changes before they reach public-facing services.

Backups and routine maintenance are scheduled and monitored via small in-house scripts that produce structured logs the brain inventory can ingest.

Results

Public services, internal tooling and AI workloads running in one place with a single operational model.

Changes follow a staging → production path that does not require a second physical host.

Technical Challenges

Single host is a single point of failure; backup and recovery routines are the primary mitigation.

Container-level isolation is enforced at the LXC and firewall layer, not at the hypervisor cluster level — there is no automatic failover today.

Highlights

• Single Proxmox VE host with multiple isolated LXC containers for public and internal services.
• Per-service firewall rules and LAN-only staging for changes before they reach production.
• Internal tooling for container provisioning, monitoring and backup routines.