boxvirt. Find a guide

AUTHOR

NetSec

I write Boxvirt for people who run their own infrastructure. The guides come from systems I build, break, and recover myself.

What I run

  • A homelab for Proxmox virtualisation, storage experiments, and network segmentation, with MikroTik handling routing and firewall policy.
  • Self-hosted services such as Nextcloud and Umami analytics, plus this site: a static Astro build served by an unprivileged, read-only nginx container.

How I write

Each guide starts from a configuration I needed to understand, secure, or restore. I name the software versions a procedure depends on, link the primary documentation behind it, and include the checks that show whether a change worked and how to roll it back.

Infrastructure software changes quickly. When a release changes a procedure, I revise the article and record the date. Read more about the editorial approach.

Topics

Proxmox · Networking · Storage & Backup · Self-hosting · Tools

26 GUIDES

Guides by NetSec

Self-hosting

Audiobookshelf Docker Compose: Setup, HTTPS, and Backup

Run Audiobookshelf with explicit image versions, persistent local config, private access, WebSocket-aware HTTPS, and backups that include your media.

Proxmox

Proxmox Cloud-Init Templates: Build, Clone, and Verify

Create a repeatable Proxmox cloud-image template and diagnose first-boot, SSH-key, and network configuration problems.

Self-hosting

Fedora Server 42 Installation: Historical Guide and Migration Notes

Historical Fedora Server 42 installation guide with its May 2026 end of life, media verification, service checks, and a practical migration plan.

Proxmox

Proxmox Homelab Guide: Plan Compute, Storage, and Recovery

Plan a maintainable Proxmox homelab, choose VM or LXC boundaries, organise networks and storage, and prove backup recovery.

Proxmox

Install Proxmox VE 8: Version-Specific Setup and Checks

Historical Proxmox VE 8 installation guide with its passed support window, disk and network checks, first-boot diagnostics, and migration precautions.

Proxmox

Proxmox HTTPS Certificates with ACME and DNS Validation

Use a trusted Proxmox management certificate without exposing the administration interface, and verify renewal and hostname matching.

Self-hosting

Self-Host Linkwarden with Docker: Secrets, Access, Backup

Deploy Linkwarden from release-matched Compose files, set authentication and search secrets safely, restrict registration, and preserve archives and database.

Networking

MikroTik Address Lists: Organise Firewall Policy Clearly

Create and review RouterOS address lists while keeping interface scope, service permissions, dynamic entries, and trust boundaries explicit.

Networking

MikroTik Backups and Firewall Logs: Build a Recovery Routine

Separate RouterOS backups from text exports, protect operational data, and use focused firewall logging with a tested recovery process.

Networking

MikroTik Firewall Chains: Input, Forward, and Output Explained

Trace router administration and routed traffic through RouterOS chains, rule order, and connection state without confusing NAT with filtering.

Networking

MikroTik Firewall Hardening: Reduce Exposure Before Blocking Scans

Prioritise protected management, precise rules, bounded logging, and measured detection instead of fragile blacklist recipes.

Networking

MikroTik Firewall Setup: Audit First and Keep Recovery Access

Prepare RouterOS firewall changes with an inventory, saved configuration, Safe Mode, and positive and negative connectivity tests.

Networking

MikroTik Forward Chain: Segment LAN, Guests, and VPN Clients

Build a RouterOS traffic matrix for routed networks, preserve required return paths, and test denied access as well as permitted flows.

Networking

MikroTik Hairpin NAT: Trace the Return Path and Fix Local Access

Diagnose local access to a public service hostname by checking DNS, destination NAT, firewall policy, and the server return path.

Networking

MikroTik Input Chain: Restrict Router Management Safely

Design a RouterOS input policy that protects administration while preserving required DNS, DHCP, VPN, and diagnostic traffic.

Networking

MikroTik WireGuard Setup: Split-Tunnel Remote Access

Build a RouterOS 7 WireGuard split tunnel with a client configuration, narrow firewall permissions, return-route checks, and troubleshooting.

Proxmox

Proxmox Networking: Bridges, VLANs, Bonds, and Isolation

Understand Proxmox bridge and VLAN design, avoid management lockouts, and verify routing and isolation before changing a live host.

Self-hosting

Nextcloud in Proxmox LXC: Storage, Proxy, and Backups

Design a manual Nextcloud installation in unprivileged Proxmox LXC, with supported dependencies, trusted proxy settings, cron, and recoverable data.

Networking

OPNsense DNS over TLS: Configure and Verify Unbound

Set up OPNsense Unbound DNS over TLS with certificate verification, local DNS exceptions, packet capture checks, and practical troubleshooting.

Networking

OPNsense Kea DHCP Migration: Leases, DNS, and Rollback

Decide whether Kea fits your OPNsense network, migrate DHCP without overlapping leases, and verify reservations, client options, DNS, and rollback.

Networking

OPNsense on Proxmox: WAN, LAN, and Recovery Design

Plan an OPNsense VM on Proxmox with separate WAN and LAN bridges, reachable host management, safe DHCP cutover, and isolation tests.

Storage & Backup

Proxmox Backups: VZDump, PBS, and a Restore Checklist

Choose a Proxmox backup approach, account for external guest data, set retention, and verify recovery on an isolated test network.

Proxmox

Terraform for Proxmox in Docker: Plan, Apply, and Protect State

Run a reproducible Proxmox Terraform workflow with verified TLS, scoped credentials, reviewed plans, and protected state files.

Self-hosting

Traefik Docker HTTPS: Compose and Cloudflare DNS Challenge

Configure same-host Traefik Docker routing with private backends, Cloudflare DNS challenge secrets, staged ACME issuance, and certificate verification.

Self-hosting

Traefik in Proxmox LXC: File Provider and HTTPS Routing

Run standalone Traefik in an unprivileged Proxmox LXC with a systemd service, explicit file-provider routes, ACME, and verified backend TLS.

Self-hosting

Traefik Remote Docker Provider: SSH and Reachable Backends

Connect Traefik to remote Docker through authenticated SSH, select reachable bound backend addresses, and diagnose API discovery separately from routing.