[PROJECT] AnPreD InfraShield — Self-hosted fleet security, SSH key rotation, & JIT access for Proxmox

[Dheeraj Kumar]

Hi Proxmox Community,
I wanted to share a self-hosted project I’ve been working on that hooks right into Proxmox VE to solve a few pain points around fleet management, automation, and secure access: AnPreD InfraShield.

 

[Dheeraj Kumar]

How it connects to Proxmox VE:

• One-Click Provisioning: Connects via a restricted API token (PVEAuditor role). It can clone a cloud-init template, automatically inject fresh SSH keys, boot the VM, and pull it into your managed inventory seamlessly.
• Existing VM Discovery: Features a 'Register as Server' option that pulls existing virtual machines and containers directly from your Proxmox nodes into the tool's core dash using the QEMU guest agent data.
• Automated NFS Orchestration: Walks through attaching NFS storage interfaces directly from Proxmox to target servers end-to-end.

• Other Main Pillars:
  

  1. Automated SSH Rotation: Periodically handles full key life-cycles with automated fallback protections.
  2. Just-In-Time (JIT) Bastion Access: Grants time-limited server terminal access via an ephemeral proxy path without ever exposing raw private keys—fully logged with visual playback.
  3. Vulnerability Remediation: Parses Tenable/Nessus scans to generate local package repositories via an internal Nginx sidecar for safe, dry-run patching.
  4. Compliance Checking: Performs native OpenSCAP benchmarking directly on targets.

  • How do you currently manage SSH keys and patching workflows across your Proxmox VMs?
  • Are there any specific integration features you'd like to see added to the roadmap next?