nginx is serving this page

From cloud image to web server

This VM was cloned from a template, started, and set up with nginx by Claude Code, using two MCP servers. This page explains how, step by step.

VM102 · nginx
Address192.168.1.83
OSUbuntu 26.04 LTS
Web servernginx 1.28.3
HostProxmox VE 8.3 · pve
Template9001 · ubuntu-2604

How the pieces connect

The AI never touches Proxmox or the VM directly. It calls tools; each MCP server turns a tool call into a real action.

The process

Building the template happened once. Every new VM after that takes about a minute.

Part 1 · A reusable Ubuntu template

VM 9001 · done once
  1. Official Ubuntu 26.04 LTS cloud image

    Ubuntu’s own cloud image, uploaded to Proxmox and checked against Ubuntu’s published SHA-256 checksum.

    uploaded by yousha256 8800…32b2 ✓
  2. Turned into VM 9001

    One root command imported the image as a 20 GB disk with TRIM, CPU type host, a serial console and the guest agent option.

    qm create … import-from
  3. First-boot settings with cloud-init

    User alain with a password and two SSH keys (this PC’s default key and the SSH MCP’s key), IP from the router.

  4. Set up from inside

    Installed the QEMU guest agent and allowed SSH password login. Each command needed your approval.

    privileged-command10-password-login.conf
  5. Cleaned and frozen

    Reset the machine ID, deleted the SSH host keys and cloud-init’s state, trimmed free space, shut it down and converted it to a template. Every clone gets its own identity on first boot.

    shutdown_vmqm template 9001

Part 2 · This VM

VM 102 · created from the template
  1. Pick a free ID

    Proxmox suggested 102.

    get_next_vmid
  2. Full clone of the template

    An independent copy of the whole disk. It doesn’t depend on the template.

    clone_vm full=true24 s
  3. Start it

    cloud-init gave it the hostname nginx, new SSH host keys and a new machine ID.

    start_vm3 s
  4. Find its address

    The guest agent baked into the template reported the IP.

    get_vm_ip_addresses9 s → 192.168.1.83
  5. Register it with the SSH MCP

    Its new SSH host key was pinned, so the MCP refuses to connect if the machine is ever swapped.

    profile “nginx”SHA256:rPnm7tUW…
  6. Install nginx and publish this page

    Installed from Ubuntu’s repository after your approval, then this page was uploaded over SFTP.

    apt-get install nginxsftp-upload/var/www/html/index.html

Safety rails

Automation that can create machines needs limits. These were in place the whole time.

Limited Proxmox tools

The Proxmox MCP offers 21 chosen tools. It has no delete, force-stop, rollback or config-edit tools.

You approve root

Every sudo command inside a VM waited for your yes in Claude Code before it ran.

Pinned identities

Proxmox’s certificate and each machine’s SSH host key are pinned. An impostor gets refused.

No secrets here

This page contains no passwords, keys or tokens. It’s safe to open on any device on your network.

Using this server

# log in (this PC’s default key, or alain’s password)
ssh alain@192.168.1.83

# check nginx from any machine on the network
curl -I http://192.168.1.83

# where things live on the VM
/var/www/html/                      # web root (this page)
/etc/nginx/sites-available/default  # site config
/var/log/nginx/access.log           # visitor log