How it works: NexoVirt on top of Proxmox VE
NexoVirt is a self-hosted panel that talks to your Proxmox hosts through the Proxmox API and a small agent on each node. You add a host, it imports what already runs, and from then on you manage every VM, container, IP and customer in one place, without reinstalling anything.
From install to customers in five steps
The panel installs on its own Ubuntu server with one command. Then:
-
Add a Proxmox host
Point NexoVirt at a Proxmox VE host, fresh or already in production. A one-time SSH login installs a small agent and pins the host key; nothing on the host is reinstalled.
-
Adopt what already runs
The panel imports your existing VMs, containers, storage and networks into one list across every host, so you start with everything you already have.
-
Create and manage guests
New VMs and containers come from a six-step wizard with plans, cloud-init OS templates and IPs from your pools. Each guest gets a control panel with live charts, a console, snapshots, backups and reinstall.
-
Hand customers a portal
Assign an owner to a guest and that customer gets a portal with only their own servers. Plans add traffic limits and expiry, enforced automatically if you turn it on.
-
Automate the rest
Everything in the panel is also available through a REST API with one bearer token, and alerts reach you by email, Discord, Google Chat or any webhook.
What each step looks like
Real screenshots of the panel with demo data.
The agent installs itself
One SSH login, then every step runs live in the panel.
- Works with nodes that already run guests.
- Credentials encrypted at rest, a per-host SSH key generated for later updates.
- A version-pinned agent, updated in one click.
One list of every guest
Every VM and container across all hosts.
- OS, IP, cores, memory and storage for each guest.
- No switching between hosts or clusters.
- Served from the panel database, so it opens even when a host is slow.
A guest in six steps
Placement, resources, OS, network, access and a final overview.
- Create from a plan or custom specs, an OS template, DHCP or a static IP.
- Actions return at once while a worker runs them.
- xterm.js or noVNC console in the browser.
The customer portal
Customers see only the servers they own.
- Power, console, SSH keys and 2FA for customers.
- Ownership checked on the server for every request.
- Branded email on the events that matter.
API tokens and docs
Tokens, scopes and the built-in API reference.
- One response envelope on every endpoint.
- Create a guest from a plan in one call.
- Alert rules for downtime, load, backups and plan limits.
How does NexoVirt talk to Proxmox?
Through two channels. The Proxmox VE API over HTTPS handles everything Proxmox can do itself. A small agent on each node handles host jobs the API cannot do, such as downloading OS images, writing cloud-init snippets and applying NAT rules.
NexoVirt panel
Runs on your own server, with its own database for inventory and metrics.
- Admin panel
- Customer portal
- REST API
- Background workers
Proxmox VE API
HTTPS to each host: guests, storage, networks, tasks and consoles.
nexovirt-agent
On every node. It fetches its jobs from the panel over HTTPS, so the node needs no extra inbound port.
Your Proxmox nodes
Run your VMs and containers exactly as before. Removing NexoVirt leaves them untouched.
Under the hood
The mechanics that make the panel fast and safe to run next to production.
-
Why do pages open instantly?
A collector stores an inventory of every node, guest, storage and network, written only when something changes, plus metrics every 5 seconds for guests and every 30 seconds for nodes. Pages read that database, so they open at once and show an "as of" time when a host is unreachable.
-
What happens when I click Create?
The panel queues a job and shows the guest as provisioning right away. A worker downloads the cloud image on the node through the agent, imports it, applies cloud-init, starts the VM and deletes the download. A live page shows each step.
-
How are NAT rules applied safely?
The agent writes only its own NEXOVIRT iptables chains and never flushes built-in or Proxmox rules. It refuses public source ranges for masquerading and restores the rules at boot through its own systemd unit.
-
How are customers kept apart?
Every portal request checks on the server that the customer owns the guest, before any Proxmox call. Consoles run through a one-time session on your own domain, so Proxmox credentials never reach a browser.
-
How do I automate it?
With the REST API: one bearer token with optional IP allow-list and host scope, one response envelope, and the full guest lifecycle. Alerts and, on paid plans, event webhooks push changes to your other systems.
How it works: FAQ
Does NexoVirt require reinstalling Proxmox?
No. NexoVirt sits on top of your existing Proxmox VE hosts. A one-time SSH login installs a small agent, and the panel imports your running VMs, containers, storage and networks through the Proxmox API. Nothing is reinstalled and your nodes keep running exactly as they are.
Does NexoVirt modify or replace the Proxmox host?
No. NexoVirt manages Proxmox through its API and a small on-host agent; it does not replace the Proxmox web UI or reconfigure the hypervisor. You can keep using the Proxmox UI alongside it, and removing NexoVirt leaves the host untouched.
What does the on-host agent do?
The agent is a lightweight helper installed once over SSH during onboarding. It handles host-side tasks the API cannot do directly, such as staging cloud images, writing cloud-init snippets and applying NAT rules. It communicates over an authenticated job queue and can be removed at any time from the Hosts page.
How does async provisioning work?
When you create, reinstall, delete or power a guest, NexoVirt enqueues the job and returns immediately with an optimistic status, then a background worker runs the real Proxmox call and refreshes inventory. You watch progress on a live page instead of waiting on a blocked request, and the guest never flips to an unknown state mid-operation.
How are customers isolated in the portal?
Every read and every action in the customer portal is re-checked against guest ownership on the server, so a customer can only ever see or control the servers assigned to them. A single Proxmox cluster safely serves many tenants, and the console proxies through your own origin so Proxmox credentials never reach the browser.
Start running NexoVirt today
Free for homelabs with unlimited VMs on up to 2 nodes. Running a hosting business? Upgrade in place when you grow, no migration.