Run more than one Proxmox cluster and you end up living in browser tabs — one for the office cluster, one for the box at home, one for the backup server. Proxmox Datacenter Manager (PDM) gives you one read-only pane over all of it — but only bother if you actually run more than one cluster. For a single cluster the native Proxmox VE interface already does this, and PDM is just one more thing to host and secure.
Here's how I deployed PDM 1.1 in a container and connected my clusters with tokens that can only look.
This is a cross-post from Peira Labs. The full illustrated version — with the add-remote wizard, the architecture diagram, and every gotcha — lives at https://peira.dev/articles/proxmox-datacenter-manager/
What PDM actually is
A Proxmox VE cluster fuses several nodes into one system. PDM sits a layer above: it doesn't join anything, it connects to your clusters and standalone nodes as remotes and aggregates them into one screen. Each remote stays independent and hands PDM nothing but an API token — which is the whole security story, because you decide exactly how much that token can do.
Deploy it in a container
PDM ships as Debian packages, so a plain Debian 13 ("trixie") LXC does the job (2 vCPU / 2 GB RAM is plenty). Add the no-subscription repo and install:
wget https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg \
-O /usr/share/keyrings/proxmox-archive-keyring.gpg
cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pdm
Suites: trixie
Components: pdm-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF
apt update
apt install proxmox-datacenter-manager-container-meta
The web UI comes up on port 8443. Log in as root@pam with the container's root password.
Connect a cluster so it can only look
On each cluster, create a dedicated user and a read-only token rather than handing PDM an admin login. Proxmox VE has a built-in PVEAuditor role (read access, nothing else); Proxmox Backup Server has an Audit role:
# Proxmox VE
pveum user add pdm@pve
pveum acl modify / -user pdm@pve -role PVEAuditor
pveum user token add pdm@pve pdm --privsep 0 # prints the secret ONCE
# Proxmox Backup Server
proxmox-backup-manager user create pdm@pbs
proxmox-backup-manager user generate-token pdm@pbs pdm
proxmox-backup-manager acl update / Audit --auth-id 'pdm@pbs!pdm'
In PDM, Remotes → Add, give it the node address, let it read back the certificate fingerprint (it pins it, so a swapped cert breaks the link on purpose), then paste the token. Both remotes then show up with their audit tokens:
The single pane
With both remotes connected, the dashboard finally aggregates every node, guest, and datastore across separate clusters, with combined CPU/memory/storage gauges:
Three rough edges
-
A 403 in the log every cycle — ignore it. PDM tries to fetch each node's available updates, which needs
Sys.Modify. Your audit token doesn't have it, so you get a harmless 403 per cycle. That's least-privilege working as intended. -
A pure-Audit token can't populate every tile. On my PBS remote, PDM's resource-collection call returns
403 permission check failed, so the backup node reads as offline even though the connection is fine. Decide per remote whether you want the extra read scope. -
The 1.1.7 client CLI won't do password-file auth. The separate
proxmox-datacenter-manager-clientrejects--user root@pam --password-fileeven when the same credentials pass at the raw API. The UI, admin CLI, and API are all fine — use one of those.
And if you later want PDM 1.1's cross-cluster VM migration, remember these tokens can't do it (migration writes to both sides) — re-scope deliberately for that job.
For a single cluster, skip it. But the day you're logging into three Proxmox tabs to answer "is everything up?", PDM is the fix — and you can stand it up in an afternoon with credentials that can't hurt you.
Written by Peira Labs — full version with the add-remote wizard walkthrough and architecture diagram at peira.dev.
