If you run more than one Proxmox VE cluster, you log in to each web page again and again. Proxmox Datacenter Manager (PDM) fixes this. It gives you one place to see all your clusters, nodes, VMs, containers, storage, and Ceph health.
In this guide, you will follow a full Proxmox Datacenter Manager 1.1 setup from zero to a working multi-cluster view.
In this guide, you will set up one small management server and connect two Proxmox VE clusters to it. The management server runs Proxmox Datacenter Manager (PDM). Each cluster stays in its own location and keeps running on its own.
PDM only connects to each cluster through its management IPs, so you can see and manage everything from one place. Here is the full layout:
Use your own IP addresses and names. The IPs above are only examples.
Two important rules for the whole guide:
8006.Before you begin your Proxmox Datacenter Manager 1.1 setup, make sure to make these things ready:
pdm01.example.com.If your clusters run in different data centers, use dedicated servers with private networking for the Proxmox nodes. You can see the options on the PerLod dedicated server hosting page.
Before you install anything, take a few minutes to plan. A clear plan helps you avoid changes later, like a wrong hostname or the wrong network for your nodes. First, decide these points:
There are two ways to do the Proxmox Datacenter Manager 1.1 setup on the server. Use Option A if you can boot an ISO, such as bare metal, Proxmox VM, or a VPS with ISO upload. Use Option B if your VPS only gives you a Debian image.
First, you must download the PDM ISO from the official Proxmox downloads page.
For a USB stick on Linux, find the right device name:
Write the ISO to the USB stick. Replace /dev/XYZ with your real USB device. Be careful; this deletes all data on that device.
On Windows, use Etcher, or use Rufus in DD mode. Do not use UNetbootin.
Start with a clean Debian 13 (Trixie) server. Log in as root and set the hostname:
Edit /etc/hosts so the name points to the server IP:
Add this line with your own IP and name:
Then, download the Proxmox repository key with the command below:
Check the key. The SHA256 must match the value below:
Make sure your Debian base repository file looks like this:
Now you must add the PDM no-subscription repository. Create the file:
Finally, install PDM. This command keeps your current Debian kernel, which is the best choice for most VPS servers:
If you want the Proxmox kernel with ZFS support (bare metal), you can use this package instead:
Note: Installing PDM on Debian looks easy, but you must set up disks and network yourself. The ISO is the safer way.
The ISO turns on the enterprise repository by default. It needs a valid subscription. Without one, apt update shows an error. PDM can use the enterprise repository if at least 80% of your remote nodes have a Basic or higher subscription.
If you have no subscription, you must turn off the enterprise repository:
Add this line at the end of the block:
Then, create the no-subscription repository file. Skip this if you used Option B, because you already did it:
The no-subscription repository is for testing and non-production use. For production, use the enterprise repository.
Now update the system, so your Proxmox Datacenter Manager 1.1 setup has the latest fixes. PDM is a rolling release, so use a full upgrade, not an upgrade:
Once you are done, check the installed versions:
To access the PDM web interface, open this address in your browser:
Log in with user root and the password you set. Your browser will warn about the self-signed certificate. That is normal at this stage. You can add a trusted certificate later with ACME.
A good Proxmox Datacenter Manager 1.1 setup needs a login on every cluster. The safest way is a separate user and API token with limited permissions. Also, PDM can create a token for you if you enter root credentials, but a token you create yourself gives you full control over its rights.
PDM checks each cluster by its TLS fingerprint. On any node of the cluster, run:
Copy the long value. Do this for one node of each cluster. Also, you can see it in the Proxmox VE web page under the node's Certificates panel, in the file pve-ssl.pem or pveproxy-ssl.pem if you use ACME.
Run these commands on one node of the cluster; the setting is shared in the whole cluster:
The token secret is shown only once. Copy it now and save it in your password manager. The token ID is pdm@pve!pdm.
With --privsep 1, the token only gets the rights that both the user and the token have. So give the same role to both:
PVEAuditor is read-only. It is enough for dashboards, resource lists, and Ceph status.
Also, if want to start, stop, or migrate guests from PDM, use PVEAdmin instead. Some actions, such as pushing updates, may need more rights, so you must raise rights only when you need a feature. Check the result:
Do these steps on every cluster. Use a different token secret for each cluster.
PDM must reach port 8006 on each Proxmox VE node. Only allow the PDM IP; do not open port 8006 to the whole internet.
If you use the Proxmox VE firewall, edit the cluster firewall file on one node:
Add these blocks with your PDM IP:
If the file does not exist yet, you can add [OPTIONS] with enable: 1. But only turn the firewall on after you have rules that keep your own admin access working. If the firewall is already on, only add the two blocks above.
Then, test the connection from the PDM server:
A JSON answer with the Proxmox VE version means the network path and the token both work. The -k option skips the certificate check, so use it for this test only.
If your clusters are in different locations, you need a safe path between the PDM server and each site. A VPN, for example, WireGuard or a strict IP allow list both work.
If you want an encrypted private network between your sites, check our guide on building a multi-site Proxmox SDN with a WireGuard fabric.
Now PDM is ready, and your first cluster has a token and a firewall rule. In this step, you can connect that cluster to PDM. In the PDM web interface:
192.168.1.11. Paste the fingerprint from Step 4. Click Connect.dubai-prod.pdm@pve!pdm and the token secret.192.168.1.12 and 192.168.1.13), so PDM has other nodes to use if the first one is down.Always use the management IPs here. Do not use the corosync network.
Now you can add your second cluster the same way you added the first one. Repeat Step 4, Step 5, and Step 6 for cluster B. Use these values:
frankfurt-prod192.168.2.11, 192.168.2.12, 192.168.2.13Also, you can add remotes from the PDM shell. This is useful for scripts. Use the token ID and secret you created:
Then, list the remotes with the command below:
If the node needs a fingerprint or a special port, use the same wizard in the web interface instead. It handles the fingerprint for you.
Now that both clusters are connected, you can set who can see and change them. Do not use root@pam for daily work, because it has full rights on everything. You can create separate PDM users and give each one only the access they need.
PDM has three built-in roles. You cannot create custom roles:
Permissions use paths. These are the paths you can usually use:
Create two users in PDM. One for monitoring and one for daily operations. Then, give each user a role on the right path. This way, each person can only do what their job needs.
noc@pdm (a monitoring user) and ops@pdm (an operator). Set a password for each.Now ops@pdm can manage cluster A, but it can only watch cluster B. Permissions are saved in /etc/proxmox-datacenter-manager/access/acl.cfg. Each entry has this form:
PDM supports TOTP, WebAuthn, and one-time recovery keys. You can add a second factor for every user, and save the recovery keys in a safe place.
This is very important, because PDM holds a token for every cluster.
At this point, you can check that your Proxmox Datacenter Manager 1.1 setup shows the right data. In the web interface, look at these places:
You can check the same data from the PDM shell:
Also, you can use the client tool. It logs in with a PDM user:
If the metric graphs look empty, check the collection state and start a new collection:
To make sure permissions work, log in as noc@pdm and try to stop a test VM. It must fail. Then, log in as ops@pdm and confirm you can start and stop a test VM only on dubai-prod.
PDM can monitor the Ceph state of hyper-converged Proxmox VE clusters. Click Ceph in the left sidebar. You will see one row for each Ceph cluster, from all remotes. The overview shows:
{up} up, {in}/{total} in.3 / 3 in quorum.Click a cluster to open its detail panel. It has tabs for Dashboard, Monitors, Managers, OSDs, Pools, CephFS, and Flags. Use the Flags tab to see if a flag such as noout is still set after maintenance.
Two things to know:
Resource.Audit privilege on the remote. The Auditor role has it. If a user cannot see a Ceph cluster, check the permission on /resource/<remote-id>.To confirm that PDM shows the true state, compare it with Ceph on a node of the same cluster:
The health status, OSD counts, and monitor quorum must match what PDM shows.
Tips: If you want to build a Ceph cluster, you can check this guide on building a Ceph Tentacle cluster on Proxmox VE with NVMe OSDs.
In any Proxmox Datacenter Manager 1.1 setup, PDM stores the API token of every cluster it manages. If someone takes over PDM, they may reach all your clusters. So treat the management node as a high-value server.
You can follow these rules to protect your PDM management node:
PVEAuditor tokens. Use PVEAdmin only when you really need actions from PDM.root@pam for emergencies.In this step, you can add a small firewall on the PDM server. It allows SSH and the web interface only from your VPN or office network and blocks everything else.
Install nftables if it is not installed and edit the rules file with the commands below:
Paste this content. Change 10.99.0.0/24 to your VPN or office network:
Once you are done, save and close the file. Check the file for errors, then turn it on:
Keep your current SSH session open while you test. Open a second session to make sure you can still log in.
If the clusters or PDM use a public certificate, for example, from Let's Encrypt via ACME, PDM trusts it without a fingerprint. If a cluster uses the default self-signed certificate and it changes, PDM will fail to connect, because it uses the old fingerprint. Fix it like this:
Confirm the new certificate in a trusted way before you accept it. For example, run the fingerprint command from the Add the First Cluster step directly on the node. An unexpected change can mean someone is secretly sitting between PDM and the node. In the web interface, you can do the same with the Check Certificate action on the remote.
PDM gets regular fixes and security updates, so you must update it. Update PDM from Administration > Updates in the web interface, or from the shell:
Note: Only run the upgrade if apt update shows no errors. Remember to read the release notes.
At this point, you have a full Proxmox Datacenter Manager 1.1 setup. PDM runs on its own management node and manages two Proxmox VE clusters. Each cluster has its own token, and users only get the access they need. You can see all your resources and Ceph health in one place. Keep PDM outside your clusters, allow only the ports you need, and keep it updated.
For a clean Proxmox Datacenter Manager 1.1 setup, you can use a small PerLod management VPS for PDM and run each Proxmox VE cluster on PerLod dedicated servers in different locations. The VPS stays separate from the clusters, and each location keeps its own private network.