Skip to content

Proxmox Setup

Jump to bottom
realstuffie edited this page Oct 28, 2026 · 1 revision

Proxmox Setup

API token

  1. Go to Datacenter → Permissions → API Tokens → Add
  2. Set a user and token ID (e.g. root@pam / plasma-monitor)
  3. Copy the secret immediately - shown only once
Required permissions & example role

Minimum (read-only)

Permission Path Purpose
Sys.Audit / Read node status
VM.Audit /vms Read VM & container status

Power actions

Permission Path Purpose
VM.PowerMgmt /vms Start/stop/reboot VMs and CTs
Sys.PowerMgmt / Required in some role setups

Console access

Permission Path Purpose
VM.Console /vms VNC console for VMs, TTY for LXCs

Storage usage

Permission Path Purpose
Datastore.Audit /storage Read each node's storage usage (optional)

Note: Datastore.Audit is part of PVEAuditor, so a token with that role already has it. Proxmox returns an empty list instead of an error when the permission is missing, so ProxMon says which permission to grant. Turn off Storage Usage in settings if you would rather not grant it.

Stats panel (guest IP)

Permission Path Purpose
VM.GuestAgent.Audit /vms Read guest IP via the QEMU agent (VMs only; optional)

Note: VM.GuestAgent.Audit is only needed to show a VM's IP in the stats panel, and only for VMs (it uses the QEMU guest agent). Without it, the CPU/mem graph still works and the IP simply shows N/A. Container IPs need no extra permission.

Privilege Separation note: if your token has privilege separation enabled, effective permissions are the intersection of user and token permissions. Grant roles to both, or disable privilege separation.

Example: dedicated monitoring user

pveum user add monitor@pve -comment "Plasma Monitor"
pveum aclmod / -user monitor@pve -role PVEAuditor
pveum user token add monitor@pve plasma-monitor

Proxmox Backup Server

  1. Configuration → Access Control → Users → Add. Create e.g. proxmon@pbs
  2. Configuration → Access Control → API Tokens → Add. Select the user, set a token name
  3. Configuration → Access Control → Permissions → Add. Path /datastore/YourDatastoreName, role DatastoreReader. Copy the token secret (shown only once).

Token ID format: user@pbs!tokenname

Minimum PBS permissions
Role Path Purpose
DatastoreReader (built-in) /datastore/<name> Read datastore and snapshot listings

Sharing one PBS across multiple Proxmox endpoints: set PBS Datastore and PBS Namespace for each endpoint to the location used by that cluster. An empty datastore searches all visible stores. Namespace * searches all visible namespaces; an empty namespace selects root only. Named namespaces match exactly, without including their children.

ProxMon keeps backup sources separate by datastore and namespace. If multiple sources match the same guest, its backup marker shows ? with an explanation instead of choosing the newest backup. Select the correct source in settings to resolve it. You can also restrict each endpoint's PBS token to its cluster's backups. ProxMon cannot infer which cluster owns a backup from its VMID alone, so use explicit filters when sharing PBS across clusters.

Using ProxMon

Developing

Clone this wiki locally