7. First tenant

This is the acceptance test for the whole installation. If a server created here reaches the internet and is reachable from it, every layer works.

1. Create an organisation

Sign in as a platform operator and create one. Give it a short name — it appears in resource names so that Proxmox stays readable.

Invite the user who will own it.

2. Define a public address pool

Platform → IP Havuzları (Platform → IP pools). You need:

Field	Value
Region	The region you prepared
CIDR	Your routed public block
Gateway	The address on your edge that this block routes through
Block kind	subnet or slice — see below

The panel materialises one row per address.

subnet or slice — get this right

• subnet — the block is a real subnet. The first (network) and last (broadcast) addresses are excluded, as they must be.
• slice — the block is carved out of a larger network upstream and routed to you. Every address is usable, including the first and last, because here they are not a network and a broadcast address; they are just addresses.

Choosing subnet for something that is actually a slice quietly costs you two addresses. Choosing slice for a real subnet hands out two addresses that will not work. If you are not sure, ask whoever routes the block to you whether it is a subnet on a segment or a routed slice.

Mark any address still referenced by something on your edge as reserved, so it is never handed out while you clean up.

3. Allocate an address to the organisation

From the pool, allocate one address. Allocation gives it to the organisation; attaching it to a machine is the tenant’s own step.

4. Create a private network and a gateway

As the tenant now:

1. Ağ → Özel Ağlar — create a network; an app subnet is created with it.
2. Ağ → Ağ Geçidi → Kur — install a gateway on that subnet, using the allocated address.

This is the first real exercise of the whole stack: a virtual machine is cloned from your appliance template, receives a bootstrap identity, fetches its configuration, and configures forwarding.

If it never becomes ready, the cause is almost always one of: the template is missing or wrong in the region configuration, the appliance’s subnet cannot reach the panel, or the public address is not actually routed to the region.

5. Create a server

Sunucular → Sunucu Oluştur, Ubuntu, smallest plan, that subnet.

Then, from its console:

curl -sS https://example.com -o /dev/null -w '%{http_code}\n'   # expect 200
curl -sS https://ifconfig.me                                     # expect the gateway's address

The second line is the whole point of the egress model: your tenant’s traffic leaves from their own address.

6. Attach a public address and check reachability

Attach a firewall allowing 22 from your own address, then attach a public address, then — from outside your network, not from your office —

ssh ubuntu@<public-address>

Testing from inside the datacentre proves nothing about routing. This is the step that catches a block that was bridged rather than routed.

7. Clean up

Delete the server. Confirm it enters the deletion buffer, then disappears when the buffer expires, and that the address returns to the organisation as free.

Checklist

Check	Confirms
Server created and reachable on the console	Templates, cloning, cloud-init
Private address assigned	Address allocation and SDN
Outbound internet through the gateway	Appliance pipeline, routing, edge
Egress leaves from the tenant’s address	The routed model, not shared NAT
Reachable from the internet	The block is genuinely routed
Firewall blocks what it should	Hypervisor-level enforcement
Deletion buffer behaves	Two-phase delete
Address returns as free	Allocation lifecycle

With all eight, the installation is working. Continue with Operations.