| Document ID | ISMS-INV-001-PVE03 |
| Version | 0.3 (audit-essential) |
| Status | Draft |
| Classification | Internal |
| Owner | Ananda Bhatta (Information Security Officer) |
| Approval date | pending |
| Effective from | pending |
| Next review | Annually, and on any material change |
| Field | Value |
|---|---|
| Hostname | pve03 |
| Role | Hypervisor for BackupExperts' application tier |
| Provider | Hetzner Online GmbH (sub-processor — see register) |
| Product | Hetzner dedicated server (root server, not Cloud) |
| Location | Hetzner data centre, Germany |
| Hypervisor | Proxmox VE 9 |
| Disk encryption | Yes — LUKS full-disk encryption |
| Customer backup data resident? | No — customer Veeam data lives on the basement MinIO endpoint and does not traverse pve03 |
| Configuration source of truth | infra-as-code Ansible repository |
The application tier — a Docker host, Cloudron, a PBX (LXC), and
ancillary VMs. Tenant Wiki.js instances, monitoring, and the
wiki-cms toolchain run here.
A current and accurate enumeration of resident VMs and containers is
maintained in the infra-as-code repository and verified periodically
via qm list / pct list against the host; it is not duplicated on
this page in order to avoid drift between the wiki and the source of
truth.
| Concern | Control | Annex A |
|---|---|---|
| Confidentiality at rest | LUKS full-disk encryption; passphrase custody in Vaultwarden | A.8.24 |
| Confidentiality in transit | TLS for management; SSH for shell; Tailscale (WireGuard) management overlay | A.8.20, A.8.24 |
| Authentication | Public-key SSH only; per-user MFA on Proxmox UI; tailnet identity for management | A.8.5 |
| Perimeter | Hetzner Robot firewall — administrative ports (SSH, Dropbear LUKS unlock, Proxmox UI) restricted to the BackupExperts home public IP; default-deny otherwise | A.8.20, A.8.21 |
| Brute-force resistance | fail2ban on SSH | A.8.20 |
| Change control | Network and host-level changes via the infra-as-code Ansible playbooks; ad-hoc changes recorded in Change log (planned) |
A.8.32 |
| Availability — host | Hardware RAID1 + Hetzner SLA; recovery per BCP §5.3 | A.5.30 |
| Logging | Proxmox host logs; Tailscale audit logs; Hetzner control-panel access logs; fail2ban logs | A.8.15 |
| Physical security | Inherited from Hetzner Online GmbH (ISO 27001 certified data centres) | A.7.1–A.7.4 |
Tracked in the Risk Register:
infra-as-code/inventories/inventory.yml — host definitioninfra-as-code/playbooks/proxmox/configure-pve03-network.yml — configuration source of truth