LinuxinfrastructureTested on real hardware

Deploy Proxmox Datacenter Manager with Audit-Scoped Remotes

Stand up PDM 1.1 in a Debian LXC and register PVE and PBS remotes with read-only tokens and pinned certificate fingerprints.

DistrosDebian 13 (trixie)
Shellbash
Updated
Script
bash
# --- On the PDM container (fresh Debian 13 "trixie") ---
wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
  -O /usr/share/keyrings/proxmox-archive-keyring.gpg

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pdm
Suites: trixie
Components: pdm-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

apt update
apt install -y proxmox-datacenter-manager-container-meta
# UI now on https://<pdm-ip>:8443  (log in as root@pam)

# --- On each Proxmox VE cluster: a read-only user + token ---
pveum user add pdm@pve
pveum acl modify / -user pdm@pve -role PVEAuditor
pveum user token add pdm@pve pdm --privsep 0      # prints the secret ONCE

# --- On each Proxmox Backup Server: the same, with the Audit role ---
proxmox-backup-manager user create pdm@pbs
proxmox-backup-manager user generate-token pdm@pbs pdm   # prints the secret ONCE
proxmox-backup-manager acl update / Audit --auth-id 'pdm@pbs!pdm'

# --- Back on the PDM container: register the remotes ---
proxmox-datacenter-manager-admin remote add \
  --type pve --id office-cluster \
  --authid 'pdm@pve!pdm' --token 'CHANGE_ME_pve_token_secret' \
  --nodes 'pve-node1.homelab.lan,fingerprint=AB:CD:EF:...'

proxmox-datacenter-manager-admin remote add \
  --type pbs --id backup-server \
  --authid 'pdm@pbs!pdm' --token 'CHANGE_ME_pbs_token_secret' \
  --nodes 'pbs.homelab.lan,fingerprint=12:34:56:...'

# verify from PDM: should return the remote's version, not an auth error
proxmox-datacenter-manager-admin remote list
proxmox-datacenter-manager-admin remote version office-cluster

What this does

Deploys Proxmox Datacenter Manager (PDM) 1.1 on a plain Debian 13 container and connects one or more Proxmox VE clusters and Proxmox Backup Servers as read-only remotes. The result is a single dashboard on port 8443 across independent clusters — without giving the manager any credential that could start, stop, or delete a guest. Each remote is reached with a dedicated API token holding only an audit role, and PDM pins each node’s self-signed certificate fingerprint so a swapped certificate breaks the link instead of being trusted.

This is a management convenience, not a cluster feature: PDM joins nothing, so it is safe to point at production and clean to remove.

Prerequisites

  • A Debian 13 (“trixie”) LXC or VM for PDM (2 vCPU / 2 GB RAM is plenty), with outbound internet for the package repo.
  • Root (or root@pam) access on each Proxmox VE cluster and Proxmox Backup Server you want to add, to create the users and tokens.
  • Network reachability from the PDM container to each node’s API port (8006 for PVE, 8007 for PBS).

Notes

  • Make these values your own before you run anything. Replace pve-node1.homelab.lan / pbs.homelab.lan with your real node hostnames; office-cluster / backup-server with whatever you want each remote called; AB:CD:EF:... / 12:34:56:... with the real SHA-256 fingerprint PDM reads back when you probe each node; and every CHANGE_ME_*_token_secret with the secret each token add / generate-token prints once — keep it in your password manager, never in a note. If a value looks specific to one machine, it’s a placeholder to change, not a literal to copy.
  • The token secret is shown a single time. If you miss it, delete the token and mint a new one — you cannot re-read the old secret.
  • --privsep 0 lets the PVE token inherit its user’s PVEAuditor role instead of needing its own separate privileges; without it the token starts with no permissions.
  • Expect a benign 403 per node in the PDM log. Audit tokens lack Sys.Modify, so PDM cannot fetch the available-updates list. This is expected; grant Sys.Modify only if you want update visibility.
  • A pure Audit token may leave some dashboard tiles unpopulated (a PBS remote can read as offline while still being reachable) because certain status calls want a broader read scope. Decide per remote whether the extra detail is worth a wider token.
  • Cross-cluster migration needs more than audit scope. These tokens are for watching. Re-scope deliberately if you later use PDM’s VM migration.
  • remotes.cfg holds the token secrets (/etc/proxmox-datacenter-manager/remotes.cfg) alongside the pinned fingerprints — treat it as a secret file.
  • Single cluster? Skip PDM. The native Proxmox VE interface already gives you one pane over one cluster.
All playbooks