# Proxmox Read-Only Integration

# Proxmox Read-Only Integration

Last verified: 2026-09-12 UTC.

## Connection

- Proxmox hostname: `pve.stargrid.com.au`
- Resolves internally to `192.168.1.115`.
- API endpoint: `https://pve.stargrid.com.au:8006/api2/json`
- The certificate is issued to `pve.stargrid.com.au` by the Proxmox cluster CA and is not publicly trusted.
- Current clients must disable TLS verification or trust the Proxmox CA; do not record or distribute the private key.

## API token

- Token identity: `oc@pve!oc`
- Permission: `PVEAuditor` at path `/`.
- The token secret is stored in OpenClaw protected secret storage as `PROXMOX_API_TOKEN`.
- Never put the token secret in BookStack, chat, scripts, or committed configuration.

## Verification

A direct read-only request to `/api2/json/nodes` returned valid node JSON using the token. This confirms the token identity, secret, endpoint, and `PVEAuditor` permission are working.

```
read -rsp "Proxmox token secret: " TOKEN
echo
curl -k -H 'Authorization: PVEAPIToken=oc@pve!oc='"$TOKEN" \\
  https://pve.stargrid.com.au:8006/api2/json/nodes
unset TOKEN
```

## OpenClaw status

- A local read-only skill was created at `skills/proxmox-readonly`.
- It is restricted to version, node, guest inventory, storage, and health GET requests.
- The OpenClaw protected egress path currently returns HTTP 502 for this private-LAN destination; this is separate from Proxmox authentication and should be resolved before relying on gateway-side automated checks.

## Safety boundary

This integration is read-only. Do not start, stop, restart, delete, create, modify, or snapshot Proxmox guests through it.