Skip to content

Authoritative On-Prem Foundation

Overview

Authoritative On-Prem Foundation establishes the platform services that later systems depend on. NetBox holds the authoritative record for prefixes, VM inventory, and tagged foundation services, while Proxmox SDN delivers the management, data, and workload networks through one repeatable control path.

It provides the baseline for Kubernetes, PostgreSQL HA, WAN, and DR.

Case study

  • Context: the on-prem estate had no authoritative record for IP allocations or VM inventory. Addressing decisions lived in spreadsheets and the network was configured manually per host.
  • Challenge: downstream platform services (Kubernetes, PostgreSQL HA, WAN extension) all needed reliable declared addressing and applied network state to build on, but those concerns were resolved independently through spreadsheets and host-level configuration.
  • Approach: NetBox was deployed as the authoritative IPAM, inventory, and service metadata system through onprem/authoritative-foundation@v1. Proxmox SDN replaced manual bridge configuration with a controlled delivery path through core/onprem/network-sdn.
  • Outcome: downstream blueprints consume the declared addressing model while the applied SDN state remains visible in Proxmox. The SDN zone is active, NetBox is reachable, and later platform layers inherit the verified foundation instead of redefining it.

Covers NetBox reachability, SDN zone delivery, and the point where authoritative inventory and network state are established before higher platform layers are introduced.

Outcome

The result is an on-prem foundation with declared network and inventory authority separated from applied network state, but delivered through one controlled path.

  • Addressing, VM, and service records are established before downstream services are layered on.
  • Proxmox SDN replaces manual bridge changes with repeatable platform delivery.
  • Later blueprints consume the verified baseline instead of redefining network state.

Operating model

  • NetBox owns prefixes, addresses, VM inventory, and foundation service metadata.
  • Proxmox owns the applied SDN objects and current network substrate.
  • HybridOps coordinates and verifies the handoff between declared authority and applied network state.
  • Higher platform layers inherit this baseline instead of rebuilding it independently.

Architecture

Authoritative on-prem foundation architecture showing NetBox as declared inventory and addressing authority, Proxmox SDN as applied network authority, and a validated foundation handoff to downstream platform paths.

NetBox remains authoritative for declared addressing, inventory, and service metadata. Proxmox remains authoritative for the applied SDN objects and live network substrate. HybridOps coordinates those two surfaces through the foundation blueprint and verifies the handoff consumed by downstream platform paths.

Foundation sequence

  1. NetBox is made reachable as the authoritative inventory, IPAM, and service metadata system.
  2. Proxmox SDN publishes the management, data, and workload networks.
  3. Foundation VMs and synced inventory are registered against the same addressing model.
  4. Downstream platform layers consume the verified baseline instead of rebuilding it.

Platform state

NetBox IPAM prefix list: management, data, and workload prefixes active with correct status and VRF assignments
Authoritative management, data, workload, staging, and lab prefixes in NetBox.
NetBox virtualisation VM inventory: current registered foundation VMs listed with their IPs, cluster assignment, and status
Foundation VM inventory registered with address and cluster state.
Proxmox SDN zones view: shybzone active as the platform zone baseline
Shared Proxmox SDN zone active as the network baseline.
Proxmox datacenter summary: hybridhub node with running VMs including NetBox and foundation services
Foundation services running on the Proxmox estate.

IP addresses, hostnames, and instance identifiers visible in screenshots and recordings reflect the ephemeral infrastructure provisioned during the recorded exercise.

Service governance

NetBox also records the service-level contract for the foundation itself. The service records below keep protocol, port, parent VM, and governance tags in the same authoritative inventory as IPAM and VM records.

NetBox service detail for netbox-ui-api, showing parent VM shared-netbox-01, TCP port 8000, source-of-truth description, and governance tags platform-foundation, sot-authority, and ha-required
NetBox service contract with endpoint, ownership, and governance tags.
NetBox service detail for postgresql-core, showing parent VM shared-pgcore-01, TCP port 5432, platform foundation description, and governance tags platform-foundation, ha-required, dr-protected, and cost-sensitive
PostgreSQL service contract marked for HA, DR protection, and cost control.

Implementation

  • Inventory authority: NetBox owns the address, VM, and service metadata source of truth.
  • Applied network authority: Proxmox owns the active SDN objects and current network substrate.
  • Foundation discipline: downstream services inherit the verified handoff rather than bypassing it.
  • Operational record: representative execution records are retained with the platform log.

Key components

  • Bootstrap path: onprem/bootstrap-netbox@v1
  • Foundation path: onprem/authoritative-foundation@v1
  • Inventory service: platform/onprem/netbox
  • Network baseline: core/onprem/network-sdn

Where it fits

  • organizations establishing an on-prem platform baseline
  • teams replacing spreadsheet-driven IPAM and manual bridge configuration
  • estates preparing for HA Kubernetes, PostgreSQL, WAN extension, or DR delivery

References

Further reading
Implementation references
  • platform/onprem/netbox
  • core/onprem/network-sdn

What was verified

Verified against HybridOps v1.0.1 with NetBox reachable, the SDN zone active, authoritative inventory established, and foundation service records carrying governance tags across the shared on-prem environment.