$ cat "All-in-One Proxmox Server: Production Blueprint for 15-30 Users.md"
Virtualization Case Studies

All-in-One Office Server on Proxmox VE: A Blueprint for 15–30 Users

In growing businesses, IT infrastructure frequently evolves by accident: operational databases reside in shared network folders on standard desktop PCs, remote employees connect via ad-hoc screen-sharing tools, consumer-grade routers regularly freeze from packet exhaustion, and backups are performed manually once a month to an unencrypted thumb drive.

In this practical case study, Noxet infrastructure engineers detail how we modernized a 22-seat commercial distribution company into a consolidated, resilient single-host environment powered by Proxmox VE. We unified edge routing, transactional databases, corporate VoIP PBX, private cloud storage, and automated disaster recovery onto a single physical server.

1. Hardware Sizing & Component Selection

For an office running 15 to 30 concurrent users, deploying a loud, power-hungry dual-socket server rack is unnecessary overkill. An optimized, quiet Tower platform or compact single-socket microserver is the ideal form factor:

  • Processor: AMD Ryzen 7 5700X / 7700 or Intel Core i7 / Xeon E-2300 (8 cores / 16 threads with high base clock speeds exceeding 3.6 GHz, delivering optimal single-thread throughput for business applications).
  • RAM: 64–128 GB DDR4/DDR5 (with ECC parity support where applicable).
  • Storage Architecture:
    • 2× 1–2 TB Enterprise NVMe SSDs (e.g., Micron 7450 PRO or Samsung PM9A3) configured as a resilient ZFS Mirror (RAID 1) for virtual machines and databases.
    • 1× 4 TB Enterprise SATA HDD for local Proxmox Backup Server staging and call recording archives.
  • Network Interfaces: 2–4× 1GbE/2.5GbE ports (Intel i225/i226) — one port dedicated to the external ISP link (WAN), while remaining ports manage the LAN trunk.
  • Power Protection: Smart Line-Interactive UPS with USB management signaling (APC / Eaton) paired with automated shutdown daemons (apcupsd or nut).

2. Virtualization Topology & Layout

In Proxmox VE, physical resources are cleanly sliced into isolated virtual machines and lightweight LXC containers:

+-----------------------------------------------------------------------+
|                    Physical Server Host (Proxmox VE)                  |
+-----------------------------------------------------------------------+
|                                                                       |
|  [VM 100: MikroTik CHR]                [VM 101: Clustered Database]   |
|  * 2 vCPU, 1 GB RAM                    * 6 vCPU, 32 GB RAM            |
|  * WAN (eth0) + LAN (eth1)             * NVMe Storage (ZFS Pool)      |
|  * Firewall, QoS, VLANs                * Linux OS (Ubuntu / Enterprise)|
|  * VPN: L2TP/IPsec + WireGuard         * Client-Server Engine 8.3     |
|                                                                       |
|  [VM 102: Asterisk / FreePBX]          [LXC 103: Self-Hosted Docker]  |
|  * 2 vCPU, 4 GB RAM                    * 4 vCPU, 16 GB RAM            |
|  * VoIP Gateway & Trunks               * Nextcloud (Files)            |
|  * Multi-level IVR, Recordings         * Vaultwarden (Passwords)      |
|  * Storage on HDD Volume               * Uptime Kuma (Telemetry)      |
|                                                                       |
|  [VM/Host: Proxmox Backup Server (PBS)]                               |
|  * Sub-second deduplicated incremental snapshots every 4 hours        |
|  * Daily encrypted off-site replication to independent S3 cloud       |
+-----------------------------------------------------------------------+

3. Network Gateway & Multi-VPN Architecture (MikroTik CHR)

Running MikroTik Cloud Hosted Router (CHR) as an internal virtual appliance delivers enterprise routing features on standard server hardware:

  1. Subnet Isolation via VLANs:
    • VLAN 10: Server plane (databases, internal services, management APIs).
    • VLAN 20: Office employee workstations.
    • VLAN 30: VoIP phones and gateway adapters with hardware traffic prioritization (QoS DSCP 46).
    • VLAN 40: Isolated guest Wi-Fi network with direct internet access and zero lateral pathing into corporate LAN assets.
  2. Dual-Tier VPN for Remote Workers:
    • L2TP / IPsec: Tailored for remote accounting and administrative staff using standard corporate Windows laptops. Connects natively through the Windows network tray without requiring administrative permissions to install third-party clients.
    • WireGuard: Distributed to mobile personnel and field engineers for high-speed, battery-efficient smartphone and laptop connectivity.
  3. Perimeter Hardening: Total elimination of exposed RDP port 3389 forwarding. All internal desktops and services are reachable strictly within authenticated VPN tunnels.

4. Client-Server Database Migration onto PostgreSQL

Migrating from file-based shared folders into a Linux and PostgreSQL client-server architecture hosted on high-speed NVMe ZFS pools unlocks dramatic performance improvements:

  • Eliminating Database Corruption: Transactional write-ahead logs (WAL) and ZFS copy-on-write integrity guarantee that unexpected power drops or client-side Wi-Fi disconnections never corrupt database indexes.
  • Tuning Parameters (32 GB Allocation): 
    # postgresql.conf snippet for 25-user workload:
shared_buffers = 8GB
effective_cache_size = 24GB
work_mem = 64MB
maintenance_work_mem = 1GB
random_page_cost = 1.1
max_locks_per_transaction = 256
autovacuum_vacuum_scale_factor = 0.05
  • Client Access: On-premise users utilize lightweight thin clients, while remote staff connect seamlessly via RemoteApp or VPN.

5. On-Premise IP Telephony (Asterisk / FreePBX)

Eliminating per-user monthly SaaS fees, the local Asterisk PBX manages complete corporate communications:

  • Multi-channel digital SIP trunk integration.
  • Interactive Voice Response (IVR) menus routing calls by department.
  • Ring groups with automated round-robin agent distribution.
  • 100% call recording directly encoded to the secondary SATA storage pool.

6. Automated 3-2-1 Backups via Proxmox Backup Server (PBS)

Leveraging Proxmox Backup Server (PBS) integration:

  1. Block-Level Deduplication: PBS inspects disk changes at the block layer. Incremental backups of a 200 GB database complete in approximately 20 seconds, saving only unique delta blocks (1–2 GB).
  2. Snapshot Cadence:
    • Database VM snapshots every 4 hours throughout operational business hours.
    • Full host snapshot verification daily at 02:00.
  3. Air-Gapped Cloud Replication: At 04:00, encrypted backup archives synchronize automatically to independent off-site S3 storage. Even in the event of hardware loss or local catastrophe, operations can be restored on standard hardware within 30 minutes.

Business Financial Payback

Deploying this solution cost the business approximately $1,500 in physical hardware plus project setup services. In return, the business immediately eliminated:

  • Cloud database SaaS hosting fees: saving ~$400 / month.
  • Cloud PBX extensions and recording fees: saving ~$90 / month.
  • Corporate cloud drive subscriptions: saving ~$60 / month.

The investment delivered full capital payback within 3.5 months, resolving performance bottlenecks, ending data loss risks, and securing remote workforce connectivity.

Interested in architecting a consolidated All-in-One server for your office? Consult with Noxet infrastructure engineers.