Infrastructure requirements
Where in the admin: Infrastructure (the left menu zone) and System › Admin › License & updates (
/license) for turning modules on.
This page lists what each module needs outside the NexCMP server. For the server itself (Ubuntu, memory, disk, ports) see Requirements for the NexCMP server. To turn modules on, see Modules.
Module by module
| Module | Minimum infrastructure | Details |
|---|---|---|
| Virtual Machines on CloudStack | Apache CloudStack 4.23 (tested), KVM, an advanced zone with a guest network and a public IP range; a dedicated domain and account with an API key (never ROOT); at least one ready template and one service offering | CloudStack |
| Virtual Machines on Proxmox VE | Proxmox VE 9.x (verified on 9.2); an API token with a custom role; a storage that clones; a bridge; an IPv4 block with a gateway; one cloud-init template per OS and per node | Proxmox VE |
| OS templates | CloudStack: a Linux build machine with libguestfs and a web server for the image. Proxmox VE: cloud-image templates with the guest agent | OS templates |
| Bare metal / Dedicated Server | Dell servers with iDRAC 9 reachable over HTTPS (Redfish) from the panel on a management network; an HTTP server on that network that serves ISO files; writable ISO folders for the NexCMP service | Dedicated servers |
| AI Models | One or more model sources you are authorized to resell, with an OpenAI-compatible or Anthropic-compatible API and your own key; outbound HTTPS (port 443, public domain name) from the panel to each source, or an internal gateway listed under Allowed internal hosts; no GPU or special hardware | AI Models |
| VPN | One or more Linux hosts (x86_64, systemd, root) with public IPv4 addresses on the interface or routed to it, outbound HTTPS to your panel | VPN and proxy nodes |
| IPv6 Proxy | Linux hosts (x86_64, systemd, nft, ip, ss, sysctl) with a public IPv4, ports 80, 443 and 60001-65535 free, and an IPv6 prefix from /32 to /64 that works for outbound traffic; SSH access with a password for the one-time install | VPN and proxy nodes |
| Object Storage (S3) | A Ceph cluster with RADOS Gateway (RGW), an Admin Ops user, and a public HTTPS endpoint on port 443 | S3 |
| Kubernetes | CloudStack with the Kubernetes Service (CKS) enabled, at least one Kubernetes version ISO, and a free control-plane service offering of exactly 2 vCPU and 2048 MB | Kubernetes and Private Cloud |
| Private Cloud | CloudStack with a VPC offering and one network offering per bandwidth plan (plus a locked 1 Mbps offering) | Kubernetes and Private Cloud |
| OS & ISO Images | CloudStack whose secondary storage VM can reach the Internet to download customer images (direct links, no redirects); the CloudStack account may register templates and ISOs | Modules |
| Bandwidth | Nothing extra with the default source: usage is read from CloudStack VM statistics. VMs on Proxmox VE are not metered | Bandwidth |
| AI Chat and AI Agent | An OpenAI-compatible API (base URL, model and key) that the panel server can reach. No extra software on your servers | AI providers |
| DDoS & BGP | An add-on package that needs an edge router host with daemons that run as root (BGP, filtering, flow statistics). It is not part of the standard installation | Modules |
| DDoS Shield | The DDoS & BGP add-on | Modules |
| Web SSH terminal | A separate SSH proxy service and a route for it. It is not part of the standard installation; the AI Agent does not need it | Modules |
Network paths at a glance
| From | To | Port | Purpose |
|---|---|---|---|
| Panel server | CloudStack management server | 443 or 8080 (as you publish it) | API |
| Panel server | Proxmox VE node | 8006/tcp | API and console |
| Panel server | Dell iDRAC | 443/tcp (and the VNC port, default 5901) | Redfish and console |
| iDRAC | ISO web server | the HTTP port you choose (for example 8080) | Virtual media |
| Panel server | Ceph RGW | 443/tcp | Admin Ops |
| Panel server | IPv6 proxy node | SSH port you enter | One-time install |
| VPN and proxy nodes | Panel (through nginx) | 443/tcp | Enrollment, heartbeat, configuration |
| Customers | VPN and proxy nodes | per-IP ports 65001-65535 (VPN); 80, 443, 60001-65535 (IPv6 proxy) | The service itself |
Keep management networks private
iDRAC and hypervisor management addresses should be on a network customers cannot reach. NexCMP refuses iDRAC addresses outside the private ranges you allow.
Checklist before you sell
- The infrastructure behind the first service is connected and Test connection is green.
- A zone is ready to sell (see Zones): an active backend, a plan and a ready template.
- A payment channel is configured (see Payment channels).
- E-mail works (see SMTP and e-mails).
- You placed one test order and deleted the VM.