--- title: Infrastructure requirements description: One table: for every NexCMP module, the minimum infrastructure it needs and the page that explains how to prepare and connect it. url: https://nexcmp.com/docs/infrastructure/requirements/ applies_to: NexCMP 1.6.1 updated: 2026-11-02 --- # Infrastructure requirements > **Where in the admin:** Infrastructure (the left menu zone) and System › Admin › License & updates (`/license`) for turning modules on. This page lists what each module needs **outside** the NexCMP server. For the server itself (Ubuntu, memory, disk, ports) see [Requirements for the NexCMP server](https://nexcmp.com/docs/getting-started/requirements/). To turn modules on, see [Modules](https://nexcmp.com/docs/infrastructure/modules/). ## Module by module | Module | Minimum infrastructure | Details | |---|---|---| | **Virtual Machines on CloudStack** | Apache CloudStack 4.23 (tested), KVM, an advanced zone with a guest network and a public IP range; a dedicated domain and account with an API key (never ROOT); at least one ready template and one service offering | [CloudStack](https://nexcmp.com/docs/infrastructure/cloudstack/) | | **Virtual Machines on Proxmox VE** | Proxmox VE 9.x (verified on 9.2); an API token with a custom role; a storage that clones; a bridge; an IPv4 block with a gateway; one cloud-init template per OS and per node | [Proxmox VE](https://nexcmp.com/docs/infrastructure/proxmox/) | | **OS templates** | CloudStack: a Linux build machine with libguestfs and a web server for the image. Proxmox VE: cloud-image templates with the guest agent | [OS templates](https://nexcmp.com/docs/infrastructure/templates/) | | **Bare metal / Dedicated Server** | Dell servers with iDRAC 9 reachable over HTTPS (Redfish) from the panel on a management network; an HTTP server on that network that serves ISO files; writable ISO folders for the NexCMP service | [Dedicated servers](https://nexcmp.com/docs/infrastructure/dedicated/) | | **AI Models** | One or more model sources you are authorized to resell, with an OpenAI-compatible or Anthropic-compatible API and your own key; outbound HTTPS (port 443, public domain name) from the panel to each source, or an internal gateway listed under Allowed internal hosts; no GPU or special hardware | [AI Models](https://nexcmp.com/docs/infrastructure/ai-models/) | | **VPN** | One or more Linux hosts (x86_64, systemd, root) with public IPv4 addresses on the interface or routed to it, outbound HTTPS to your panel | [VPN and proxy nodes](https://nexcmp.com/docs/infrastructure/vpn-proxy-nodes/) | | **IPv6 Proxy** | Linux hosts (x86_64, systemd, `nft`, `ip`, `ss`, `sysctl`) with a public IPv4, ports 80, 443 and 60001-65535 free, and an IPv6 prefix from /32 to /64 that works for outbound traffic; SSH access with a password for the one-time install | [VPN and proxy nodes](https://nexcmp.com/docs/infrastructure/vpn-proxy-nodes/) | | **Object Storage (S3)** | A Ceph cluster with RADOS Gateway (RGW), an Admin Ops user, and a public HTTPS endpoint on port 443 | [S3](https://nexcmp.com/docs/infrastructure/s3/) | | **Kubernetes** | CloudStack with the Kubernetes Service (CKS) enabled, at least one Kubernetes version ISO, and a free control-plane service offering of exactly 2 vCPU and 2048 MB | [Kubernetes and Private Cloud](https://nexcmp.com/docs/infrastructure/kubernetes-and-private-cloud/) | | **Private Cloud** | CloudStack with a VPC offering and one network offering per bandwidth plan (plus a locked 1 Mbps offering) | [Kubernetes and Private Cloud](https://nexcmp.com/docs/infrastructure/kubernetes-and-private-cloud/) | | **OS & ISO Images** | CloudStack whose secondary storage VM can reach the Internet to download customer images (direct links, no redirects); the CloudStack account may register templates and ISOs | [Modules](https://nexcmp.com/docs/infrastructure/modules/) | | **Bandwidth** | Nothing extra with the default source: usage is read from CloudStack VM statistics. VMs on Proxmox VE are not metered | [Bandwidth](https://nexcmp.com/docs/catalog/bandwidth/) | | **AI Chat and AI Agent** | An OpenAI-compatible API (base URL, model and key) that the panel server can reach. No extra software on your servers | [AI providers](https://nexcmp.com/docs/ai/ai-providers/) | | **DDoS & BGP** | An add-on package that needs an edge router host with daemons that run as root (BGP, filtering, flow statistics). It is not part of the standard installation | [Modules](https://nexcmp.com/docs/infrastructure/modules/) | | **DDoS Shield** | The DDoS & BGP add-on | [Modules](https://nexcmp.com/docs/infrastructure/modules/) | | **Web SSH terminal** | A separate SSH proxy service and a route for it. It is not part of the standard installation; the AI Agent does not need it | [Modules](https://nexcmp.com/docs/infrastructure/modules/) | ## Network paths at a glance | From | To | Port | Purpose | |---|---|---|---| | Panel server | CloudStack management server | 443 or 8080 (as you publish it) | API | | Panel server | Proxmox VE node | 8006/tcp | API and console | | Panel server | Dell iDRAC | 443/tcp (and the VNC port, default 5901) | Redfish and console | | iDRAC | ISO web server | the HTTP port you choose (for example 8080) | Virtual media | | Panel server | Ceph RGW | 443/tcp | Admin Ops | | Panel server | IPv6 proxy node | SSH port you enter | One-time install | | VPN and proxy nodes | Panel (through nginx) | 443/tcp | Enrollment, heartbeat, configuration | | Customers | VPN and proxy nodes | per-IP ports 65001-65535 (VPN); 80, 443, 60001-65535 (IPv6 proxy) | The service itself | ::: tip Keep management networks private iDRAC and hypervisor management addresses should be on a network customers cannot reach. NexCMP refuses iDRAC addresses outside the private ranges you allow. ::: ## Checklist before you sell 1. The infrastructure behind the first service is connected and **Test connection** is green. 2. A zone is ready to sell (see [Zones](https://nexcmp.com/docs/infrastructure/zones/)): an active backend, a plan and a ready template. 3. A payment channel is configured (see [Payment channels](https://nexcmp.com/docs/billing/payment-channels/)). 4. E-mail works (see [SMTP and e-mails](https://nexcmp.com/docs/administration/smtp-and-emails/)). 5. You placed one test order and deleted the VM.