Infrastructureproxmoxhomelabself-hostedvirtualizationopen-source
ProxMate Sends Friends an Invite Link to Spin Up VMs on Your Proxmox Cluster, Without Ever Showing Them the Admin Panel
A self-hoster's open-source portal holds the one Proxmox API token, tags every VM with its owner, and fences each one with firewall rules that only work once you switch on the cluster firewall.
The problem is familiar to anyone with a spare server in the closet. “A friend wants a box to run a game server. Someone else wants a Linux machine to learn on.” You can build each VM by hand and answer texts forever. “Or I could give them a Proxmox login, which is a lot of trust to hand someone who just wants one VM.”
The developer behind the r0073dl053r blog built a third option. “I send someone an invite link, they make an account, and they can create and manage their own VMs inside the limits I set. They never see the Proxmox admin panel.”
ProxMate “connects to Proxmox with one API token, and that token lives on the ProxMate server.” It offers 20 cloud images, 16 for x86 and four for ARM, and the post says one is “up and ready to SSH into in about a minute.” Owners can share a VM at three levels: Viewer, Operator or Manager.
Ownership is the guard rail. “Every VM ProxMate creates gets tagged with who owns it, and ProxMate checks that tag before it does anything to a VM.” The point, per the post, is that “nobody can start, stop or open a console on someone else’s machine, even if Proxmox reuses an old VM ID.”
Play the video on YouTubeEach VM also gets its own firewall rules. The README lists “MAC filtering, RFC1918 drop rules, and a configurable DNS allow-list,” which keep a guest’s machine off your home network. Then comes the line the post puts in plain view: “The catch is that those firewall rules don’t do anything until the Proxmox cluster firewall is turned on, and it’s off by default.” ProxMate has a button that adds its rules first and then turns the cluster firewall on, so you don’t lock yourself out of your own host.
The author has tested it on Proxmox 9.2 and is “working on separately licensed editions for schools and businesses.” There’s a beta browser IDE too, built on code-server with an AI agent. The advice on the box is honest: “It’s still a young project, so I’d test it before putting anything important on it.”
What nobody can test yet is the social part. The firewall default is documented and has a button. The harder question is what happens the first time a friend’s game server gets popular and eats the cluster’s RAM, and whether the limits screen is enough to have that conversation for you.