Welcome to Keel Linux: Debian 13 appliances for Proxmox VE, multi-site without Kubernetes

[marcos-mendez]

Hi, and welcome to Keel Linux.

Keel Linux is a community project that builds ready-to-use LXC appliances on Debian 13 (trixie) for Proxmox VE. It started from TurnKey Linux 19 and keeps what made TurnKey good for decades: a template you download, a first boot that asks a few questions, and a console menu (confconsole) to manage the appliance.

Why we are building it

Many of us run two or three Proxmox hosts in different places, and want the applications people have run from TurnKey for years (WordPress, Nextcloud, Odoo, Moodle, MediaWiki, Drupal, GitLab) to survive losing one of them. The usual answer is Kubernetes: a powerful platform, but a heavy one for a sysadmin who just wants a site to stay up, with a steep learning curve, a control plane to run and upgrade, and a resource bill a small cluster feels. Sometimes you just want to put the batteries in the toy you just bought and have it work.

Keel aims for the useful part of that model without the platform: appliances on two or three Proxmox hosts in different sites, joined over an encrypted WireGuard mesh, a small etcd registry so nodes know each other, then replicated data and automatic failover, all managed with a template, a first-boot wizard, a console menu and one YAML file per appliance.

Where we are (testing, not for production yet)

• Keel Core and Keel Web LXC templates (tar.zst). Keel Web serves HTTPS out of the box, with Let's Encrypt from the console menu and an optional Coraza WAF and Anubis bot challenge.
• Signed packages and images, built from Debian plus the signed Keel archive (archive.keellinux.org) only. Every image is scanned so that no SSH or TLS key ships in it; each machine generates its own at first boot.
• One YAML file per appliance (/etc/keel/instance.yaml): keel diff shows drift, keel spec apply converges the machine.
• TurnKey compatibility: keel-transition moves an existing TurnKey 19 appliance onto the Keel archive, reversibly.
• Multi-site mesh: two nodes in different sites already run joined over WireGuard. Next: a one-command join (keel mesh invite / keel mesh join), etcd at the third node, then replication and failover.

Try it

The current testing templates are on the GitHub pre-releases of keel-core and keel-web, each with a .sha512 and a signed .sha512.asc. Download one into your Proxmox template storage (/var/lib/vz/template/cache/) and create a container from it as usual. A small keel-pve package that does this from a signed index is in review and will be announced here.

How to help

• Test a template on your Proxmox and tell us what broke: open an issue in this repository or reply here.
• Ideas and questions: the Ideas and Q&A categories.
• Packaging applications (WordPress on Nginx and PHP is next), documentation and translations are all welcome.

Website: https://keellinux.org, code: https://github.com/Keel-Linux

Marcos Méndez, maintainer