Proxmox VE
Proxmox Virtual Environment
Proxmox VE is the hypervisor underneath every self-hosted service in this list — Gitea, Authentik, Wiki.js, npmplus, Technitium DNS and the rest all run as containers or VMs on the same single-node cluster.
Because everything else depends on it, Proxmox's own access is deliberately kept simpler and more direct than the services running on top of it.
Infrastructure
Node
Single-node cluster — pve
Every CT/VM in the fleet, including Gitea, Authentik and Wiki.js, runs here
Access
proxmox.internal.omegaproject.ai
Reverse-proxied through npmplus on 443 — no port suffix needed
Login
Local (PAM) + Authentik (optional)
Authentik SSO added as a convenience realm; local root login is never disabled
Deliberately Not Fully Proxied
Proxmox's own management access stays reachable directly at 10.10.1.250:8006regardless of what happens to the proxy layer. Routing the only path to the hypervisor's own UI through a reverse proxy that itself runs as a container on that same hypervisor would be a circular dependency — if npmplus or the network ever has a bad day, direct access is what lets you fix everything else. TheAuthentik login and the friendlier proxied hostname exist for convenience on top of that, not as a replacement for it.
Security
No Single Point of Failure
Local PAM login, the direct IP:port address, and Authentik SSO are three independent paths in — losing any one of them doesn't lock anyone out.
Least Privilege by Default
Authentik-linked accounts get zero Proxmox permissions on first login — access has to be explicitly granted afterwards, not inherited automatically.