Team Leader - Nutanix Technology Champion - Nutanix NTC Storyteller

Julien DUMUR
Infrastructure in a Nutshell
Nutanix AOS 7.6, AHV 11.2 and PC 7.6 article header

The change I enjoyed the most while moving our production clusters and my homelab to the Nutanix AOS 7.6 upgrade takes two keystrokes: copy and paste finally works in the virtual machine console. It is far from the most significant part of this release, which mostly reshapes SSH access to the CVMs and turns Prism Central 7.6 into a much steadier version than 7.3 and 7.5 were at launch.

We started from AOS 7.5.1.8 and AHV 11.0.1.8 and landed on AOS 7.6.0.6, AHV 11.2.0.2 and Prism Central pc.7.6.0.6, across several production clusters hosted at OVHcloud and on the Supermicro 5019D-FN8TP node of my homelab (8 cores, 128 GB of RAM, 2 TB raw).

For that node, no Foundation on unsupported hardware like last year: I went through Nutanix CE this time. I covered the previous release in my article on AOS 7.5 and AHV 11.0.

Upgrading to AOS 7.6.0.6: order and rollout

I followed the order Nutanix recommends, the one I detail in my article on LCM: Prism Central first, then AOS, then AHV. On the production clusters everything went through LCM with the versions it offered that day, and I timed nothing: I start the job and let it live its own life.

On the homelab I had to download the files and upload them to the cluster before I could start the upgrade, on the same principle as for Prism Central 2024.2.

After the upgrade, the LCM inventory shows the following versions:

LCM inventory showing AOS 7.6.0.6, AHV 11.2.0.2 and NCC 6.0.0.1 after the upgrade

Taking the 7.6.0.6 that LCM offered instead of the initial 7.6 matters more than it looks. That patch clears two known blockers of 7.6: an AOS upgrade that freezes and never progresses (KB-22340), and a host stuck in “EnteringMaintenance” during the move to AHV 11.2 because the Narsil service keeps restarting. On the Prism Central side, pc.7.6.0.6 also fixes the login failures that could lock you out of the web console while upgrading from pc.7.3 or later.

The “Inconsistent Virtual Switch” alert after the upgrade

The only real snag of the whole operation: on two or three of our clusters, Prism raised an “Inconsistent Virtual Switch” alert once the upgrade was over. Nutanix documents it as a known issue of AOS 7.6, still open in 7.6.0.6: the VLAN configured on the AHV host bridge port no longer matches the one AOS stored for the virtual switch (KB-22397).

The vs0 virtual switch flagged as faulty after the upgrade to AOS 7.6.0.6

The same alert also shows up in the list of issues fixed by 7.6, for a different cause, an MTU mismatch between the hosts’ br0 bridge and the virtual switch. One variant goes away, another arrives. We fixed them.

Prism Central 7.6, steady at last

On our side, in production as well as on the homelab, pc.7.6.0.6 carries far fewer bugs than the first versions of 7.3 and 7.5 did. Two things are still worth checking before you start the upgrade.

First: pc.7.6 automatically moves every existing entity without a project into a system project, the “Default Project”, and that migration cannot be rolled back. Second: Nutanix Kubernetes Engine is not compatible with pc.7.6, so you need to move your workloads to NKP beforehand. Good news on the other hand, the local admin account lockout every ten minutes reported in pc.7.6 (KB-22348) no longer appears in the known issues of pc.7.6.0.6.

Copy and paste in the VM console

This one is my favourite of the release! Pasting a long password or a license key into a virtual machine console, instead of typing it character by character, now works from the console launched by Prism Central:

The "Paste to Console" button in the console of an AHV 11.2 VM

You will need both AHV 11.2 and pc.7.6: a cluster left on AHV 11.0 behind an up-to-date Prism Central gets nothing. On a related note, the “Console” tab of a VM is deprecated in Prism Central, the workflow now goes through the “Launch Console” action.

Secure Access and the end of direct SSH

With Secure Access, the admin user who connects over SSH to a CVM no longer lands on a bash prompt: the session opens the NuService Menu, a restricted shell that runs allow-listed commands on the CVM or the AHV host, shows the cluster logs, opens a bash session (admin shell) and manages local LDAP authentication. It is surprising at first, and I have not needed to type a single command in it yet.

NuService Menu displayed on an SSH connection as admin to an AOS 7.6 CVM

The nutanix user, for its part, keeps a regular bash session. For support work, the “Support-only Login” requires a token exchange with Nutanix and opens bash access for a 72-hour window. External SSH access is turned on or off cluster by cluster from Prism Central, through the “NuService Mode”, with a confirmation prompt on every switch:

NuService Mode disable confirmation dialog in Prism Central

On the host side, AHV 11.2 closes external SSH access on port 22 by default: you go through the CVM to reach the host, and the external SSH setting now applies to the CVMs only. What I described in The end of SSH on Nutanix keeps coming true release after release.

One last change under the hood: the CVM and the Prism Central VM now run on RHEL 9, aligned with the RHEL 9 STIG hardening guide. Day to day, it makes very little difference.

What I have not tested yet

Several notable features of this release are still waiting for me to try them, so I am simply listing them:

  • Cluster fault tolerance: the new 1N/2D mode (one node or two disks), and 1N&1D now possible beyond three nodes, with conversion from Prism Central.
  • Cluster expansion: moving an AHV cluster from two to three nodes.
  • Live migration across clusters: from an older AHV version to a newer one, with a choice of destination storage.
  • BIOS UUID: preserved through failover and restore, so third-party backup software keeps its chain intact.
  • Memory metrics: ballooned memory is now reported separately from what the VMs really consume.
  • Capacity per node: 307 TB on all-flash NVMe against 185 TB before, only for new deployments that start on 7.6. An upgraded cluster keeps its former limits.

Planning ahead: the end of the legacy APIs

API versions v0.8, v1, v2 and v3 lose support with the AOS and Prism Central release planned for Q2 2027. The first effect is visible in pc.7.6 already: Nutanix Guest Tools actions move to v4 permissions, and custom roles built on v3 permissions have to be updated. If your scripts still talk to the v2 or v3 APIs, you have less than a year to move them to the v4 APIs…

Now you know everything, all that is left is to launch your LCM upgrades!

Read More
State of the Lab: my Nutanix homelab before the rebuild

In September 2024, I published an article about building a homelab on Nutanix CE in which I wrote that the first question to answer was the one about usage: throwaway virtual machines to build up skills, or services for yourself and your family? I answered “tests”, and I built my whole infrastructure around that answer.

Two years later, the answer has changed and the infrastructure has not moved an inch. Before starting the work, here is what my Nutanix homelab looked like on 1 July 2026.

My Nutanix homelab as of 1 July 2026

On that date, everything running at home sat on three machines. The network first, installed four years ago when the house was built and entirely Ubiquiti: a Dream Machine Pro, a USW Pro 24 PoE switch and a few Flex units spread across the rooms, all connected to a Freebox Delta on 10 Gb/s fibre.

Home network topology: Freebox Delta, Dream Machine Pro and USW Pro 24 PoE, with the Nutanix CE cluster and Mainsail behind the garage switch, Home Assistant on the USW 24 and AdGuard in a Freebox VM

The cluster next, an Intel S2600WTTR chassis installed in the garage because it is not allowed inside the house, on sliding rails screwed straight into the joists for lack of a proper rack, a single node running Nutanix CE 2.1, with two or three test virtual machines on it. I described its hardware configuration back then, and I invite you to read my article on the subject.

The Intel S2600WTTR chassis running my Nutanix CE cluster, mounted on rails under the timber structure of the garage

I recovered this 2016 server from a previous job. It had suffered a hardware failure and the administration did not want to pay for the repair, given its age and the infrastructure replacement already under way towards brand new Nutanix clusters. So I took it out and brought it back to life at my own expense.

Every other hardware decision follows from that starting point. Only one power supply connected out of two, on purpose, because nothing critical runs on it and a failure means at worst a cluster down for a weekend, then partial disk redundancy which I already accepted back then as a compromise. On sizing, however, I never hit the slightest limit: 384 GB of RAM, four 800 GB SAS SSDs and six 10k drives for two or three test virtual machines, headroom that served no purpose.

And that is all, or nearly. Two services live outside the cluster: Home Assistant on a Raspberry Pi, which already collects the consumption of the Meross plug connected to the server and the output of my photovoltaic installation, and AdGuard on a virtual machine hosted by the Freebox. DNS resolution for the entire house therefore relied on my ISP’s box: one slightly long reboot, one change of subscription, and nothing resolves any more.

What the network audit showed

Before touching the cluster, I went through the UniFi configuration in detail, on a version older than UniFi OS 5.1.33. The result is less flattering than the hardware.

The native network is 192.168.2.0/24 and carries VLAN ID 1 in the controller, a gap between naming and reality that stings as soon as you read your own configuration again six months later. Then four SSIDs, all on 2.4 GHz and all on WPA2, one of them hidden for the video surveillance, which has never protected anyone and mostly makes life harder for the devices that have to associate with it. The Tapo cameras, precisely, sit on Wi-Fi on that same native network: the devices I have the fewest guarantees about share the segment with everything else.

Network list in the UniFi controller: the LAN on 192.168.2.0/24 carries VLAN ID 1, and three of the four other VLANs have never handed out a single DHCP lease

The inventory turned up the rest. Four VLANs declared next to the native one, ALARM on 192.168.90.0/29, VIDEO on 192.168.100.0/24, NTNX on 192.168.84.0/24 and IOT on 192.168.99.0/24, three of which have never handed out a single DHCP lease. Meanwhile twenty-five devices share the LAN, cameras included, while the VIDEO VLAN meant for them has been sitting there empty since day one.

That is what happens when you draw a segmentation on installation day and never read it again afterwards.

So there is no segmentation, only declared VLANs. And the reason is the same as for the cluster: my time went elsewhere.

What a Nutanix homelab costs when you only power it on demand

In 2024, I plugged a Meross smart plug into the cluster and fed it into Home Assistant to know exactly what this machine was costing me. Around 5,850 Wh per day with the cluster powered on, which projects to 2,138.9 kWh over a full year and close to 535 euros at the regulated tariff, assuming the server is on every single day of the year.

Daily consumption of the cluster measured in Home Assistant from 18 August to 17 September 2024: a low plateau with the server off, then days close to 5,850 Wh from 10 September onwards

The number I was not expecting is the other one: with the server switched off, it still draws between 300 and 400 Wh per day, only to keep the IPMI and the power supplies alive. Over a year that is 110 to 146 kWh and around thirty euros for a machine that does nothing. The details of the measurement are in the article I wrote on the subject.

The rule imposed itself: the cluster only powers on for tests and for writing articles. And that is exactly what blocks everything else, since an infrastructure you boot on the evening you need it cannot host any service that has to answer around the clock, which rules out pretty much everything a house expects from a server.

I left things as they were for two years because I had other projects on my plate.

What did not exist

On 1 July 2026, I had no internal DNS, no reverse proxy, no monitoring, no secrets management, and no backup system at all.

Each of those gaps is painless as long as the virtual machines are disposable. You reach a VM by its IP address because you only have three of them, you monitor nothing because an outage bothers nobody, and you do not back up what you plan to destroy at the end of the test.

Over time my needs changed, and today I want to run local applications that the whole family will use. The five gaps then show up all at once, because none of them is visible until something has to survive a reboot.

The only addition in two years: Mainsail

Between my 2024 article and today, one single thing has moved. In December 2025, I installed Klipper and Mainsail to drive my 3D printer, on a Raspberry Pi sitting next to it.

I did not even consider another option. AHV does not do USB passthrough, the Nutanix KB is clear on that, and the cluster spends most of its time powered off anyway. There is one avenue I am keeping for the rebuild, VirtualHere, which exposes a USB device over the network and presents it to a virtual machine without any hardware passthrough. I have not tested it yet.

The electricity bill ended up dictating the architecture, and for two years it produced the same decision every time a new need came up.

So there is the inventory. A test cluster switched off almost all the time, two Raspberry Pi boards hosting applications and an ISP box acting as a DNS server. It works, and it cannot carry anything more.

That is where the work starts. I need a base that stays on and stays frugal, a DNS and a reverse proxy that belong to me, verified backups, monitoring, somewhere to keep secrets… and a Nutanix cluster that goes back to what it is good at: breaking things. That is what I will be writing about in the articles to come.

Read More
Nutanix Community Edition reinstallation issue

Reinstalling a Nutanix Community Edition node on hardware that already hosted an AHV. The Phoenix installer boots, detects the hardware, then halts on a Python traceback:

FATAL An exception was raised: Traceback (most recent call last):
  File "/root/phoenix/./phoenix", line 155, in <module>
    main()
  ...
  File "/root/phoenix/sysUtil.py", line 2086, in mount_ahv_lvm_volumes
    shell_cmd(['mount', '-t ext4', dev, target + mntpnt])
Exception: Failed command: [mount -t ext4 /dev/mapper/ahv-varlog /mnt/stage/var/log]
with error: [mount: /mnt/stage/var/log: special device /dev/mapper/ahv-varlog does not exist.]

The message seems perfectly accurate, and that is what makes it misleading: the device does not exist. The real question is why Phoenix is looking for it.

Understanding Why the Nutanix Installer Crashes

The call stack tells the whole story, provided you read it from bottom to top:

get_params → determine_actions → get_hyp_state
get_hyp_state → customize_kvm.get_state → __mount_kvm_partition → mount_ahv_lvm_volumes

Phoenix does not crash during the installation. It crashes beforehand, during the detection phase, when it tries to determine which actions to offer. It found an existing hypervisor on the disk, so it switched to its customize path (the one that updates an AHV in place rather than installing a fresh one), and this path requires mounting the volumes of the existing installation.

The preceding log lines confirm this reasoning:

INFO Calling dmsetup remove /dev/mapper/ahvstorage-varlogaudit
INFO Calling dmsetup remove /dev/mapper/ahvstorage-varlog
INFO LVM volume group ahv detected
INFO Found block device entry /dev/mapper/ahv-root, calling vgchange -an ahv

Two distinct volume groups appear: ahv and ahvstorage. An lvs command from the rescue shell confirms the layout:

LVVGSize
homeahv200 MB
rootahv6.84 GB
tmpahv1.95 GB
varahv2.93 GB
varlogahvstorage39.06 GB
varlogauditahvstorage1000 MB

There is the discrepancy. On the disk, varlog lives in the ahvstorage VG. The Phoenix ISO, however, is looking for /dev/mapper/ahv-varlog, meaning varlog inside the ahv VG. It is applying an LVM schema that does not match what is present on the machine.

The most likely explanation is a generational gap: the AHV layout evolved toward a separate storage VG, and the media used for the reinstallation expects the older layout. As a result, Phoenix recognizes the existing installation well enough to want to reuse it, but not well enough to know how to mount it.

The Solution: Wiping the System Disk Clean

Since the blockage stems entirely from the detection of a pre-existing installation, the solution is to ensure there is nothing left to detect.

Phoenix leaves a root shell accessible after the failure. We start by mapping the layout before destroying it:

lsblk
pvs
vgs
lvs

In my case, there were two PVs on a single disk: /dev/sda3 for ahv, and /dev/sda5 for ahvstorage.

Next, we deactivate and remove the VGs:

vgchange -an ahvstorage
vgremove -f ahvstorage

ahvstorage disappears without resistance. ahv, however, is stubborn:

Logical volume ahv/root contains a filesystem in use.
Can't deactivate volume group "ahv" with 2 open logical volume(s)

The Second Problem: Volumes Left Mounted

This message is the real turning point of the procedure, and the lvs output provides the key:

root  ahv  -wi-ao----
var   ahv  -wi-ao----

The o attribute means open. These two logical volumes are mounted. They are the “2 open logical volume(s)” from the error message, and this is what subsequently causes the whole chain to fail:

pvremove -ff -y /dev/sda3
  Can't open /dev/sda3 exclusively. Mounted filesystem?
  Cannot use /dev/sda3: device has a signature

wipefs -a /dev/sda
  wipefs: error: /dev/sda: probing initialization failed: Device or resource busy

The cause is simple: Phoenix had mounted root and var under /mnt/stage before crashing on varlog, and it unmounted nothing upon exiting. The failure left the disk in an intermediate state.

Therefore, unmounting must be done before anything else:

findmnt -R /mnt/stage
umount -R /mnt/stage

If a process is still holding the partition:

fuser -vm /mnt/stage
fuser -km /mnt/stage

Verify that the LVs are properly closed; the attribute should be -wi-a-----, without the o:

lvs

And only then, proceed with the complete wipe:

vgchange -an ahv
vgremove -f ahv
pvremove -ff -y /dev/sda3
wipefs -a /dev/sda
sgdisk --zap-all /dev/sda
dd if=/dev/zero of=/dev/sda bs=1M count=100 conv=fsync

The sgdisk --zap-all is not decorative. A GPT table has a backup copy at the end of the disk, which the dd on the first 100 megabytes leaves perfectly intact. This is why volume groups often “come back” after a wipe you thought was complete.

If the CVM data disks also hold remnants, apply the same treatment to them: run wipefs -a then sgdisk --zap-all on each.

Reboot, restart the installer, and Phoenix will no longer detect anything: it will offer a fresh installation.

My Takeaways from this Reinstallation

An accurate error message can point to the wrong problem:

ahv-varlog does not exist” is literally true and completely beside the point. The problem is not the missing volume; it is that the installer is applying a schema that doesn’t match the disk. Without reading the call stack, you set out looking for a missing volume instead of realizing you are in the wrong branch of the program.

An installer failure leaves state behind:

Phoenix crashed after mounting two volumes, and these mounts survived its termination. All the subsequent sequence failures (pvremove, wipefs) stemmed directly from this. Before fighting against a “Device or resource busy” error, you must find out what is holding the device.

An explicitly destructible cluster changes the nature of the problem:

This procedure is brutal: it wipes everything. It is only acceptable because this node belongs to an environment designated as disposable, on which no irreplaceable data depends. Deciding in advance which cluster is disposable does not change the failure itself, but it completely changes the amount of time spent solving it.

Read More
Recovering a lost IPMI password on a Nutanix or Supermicro node

A little misadventure happened to me recently. After changing the IPMI password on my 1-node, I couldn’t log back into my node’s management interface. Forgot it instantly? Typo? Botched copy-paste? Whatever the reason, the access lockout was very real.

Losing your IPMI password (or BMC) is enough to make anyone break a sweat. But rest assured, experience has taught me a golden rule: as long as you still have access to the host operating system (whether it’s AHV, a standard Linux, or even ESXi), you can regain control without needing to perform a hardware reset.

However, the situation can be more critical than it seems. For the experts reading this, you know that in a Nutanix Single-Node environment, IPMI isn’t just an administrative convenience: it’s your one and only fail-safe. Without it, you can’t mount a Phoenix ISO via Remote Media during a major AOS crash or force a reboot. Losing BMC access on such a node quickly becomes a critical bottleneck for your production and remote console access.

In this guide, I’ll share the different methods to regain control of your node in a matter of minutes, from the gentlest approach to the last resort.

Method 1: In-band Reset via ipmitool

If you are running Nutanix AHV or a classic Linux distribution, you’re in luck: the ipmitool utility is usually available natively. The trick here relies on the KCS (Keyboard Controller Style) hardware channel. Simply put, this allows the host OS to communicate directly with the BMC chip via the motherboard bus (LPC/PCIe), entirely bypassing the management network.

Identify and Overwrite the Admin Account

Log in as root on your host. As a precaution, first ensure that the kernel modules managing IPMI are loaded:

modprobe ipmi_si
modprobe ipmi_devintf

Next, we’ll list the configured users (usually on channel 1) to spot the ID of our administrator account. In 99% of cases, the default account (ADMIN) corresponds to ID 2.

ipmitool user list 1

In my case, the ID is indeed 2:

ipmitool user list 1 output with the ADMIN account on ID 2

Once the ID is confirmed, the command to force a new password is child’s play:

ipmitool user set password 2 'MyNewPwd123!'

When entering the previous command, the terminal might throw a nasty Invalid data field in request error.

Don’t panic; it’s simply the security policy parser of some firmwares rejecting your request. Not only does it require a minimum complexity (8 characters, uppercase, lowercase, number), but it can also be picky about the request format.

To bypass (or rather, satisfy) this mechanism, force the encoding length to 20 bytes by simply appending 20 to the end of your command:

ipmitool user set password 2 'MyNewPwd123!' 20

Your password has now been overwritten. You can test the connection to the web interface.

Method 2: The IPMICFG Utility (The Solution for VMware ESXi)

If you are running VMware ESXi, the first method might leave you stranded. Why? Because ipmitool is not packaged natively, and resolving dependencies to compile it on a hypervisor is a waste of time that I wouldn’t recommend.

The workaround is called IPMICFG. This is the official tool provided by Supermicro (downloadable from their portal with a free account). Its massive advantage is that it comes as static binaries, ready to use for Linux, Windows, and crucially, ESXi.

Once the archive is transferred to your host and extracted, using it is very straightforward:

./IPMICFG-Linux.x86_64 -user list
./IPMICFG-Linux.x86_64 -user setpwd 2 MyNewPwd123!

Note: Adapt the binary name if you are using the Windows or ESXi version.

You can download the utility here: https://www.supermicro.com/wdl/utility/IPMICFG/

Extreme Case: The Node No Longer Has a Bootable OS

What if the OS won’t boot at all? This is usually where the sweating starts, thinking that without network access to the IPMI or a functional OS, the only remaining option is a factory reset.

Remember: the KCS interface is exposed at the hardware level as soon as the BIOS POST completes. It is completely independent of your storage’s state.

All you have to do is boot the server from a USB stick containing a Linux Live CD (Ubuntu, Rocky Linux). Once on the live desktop, open a terminal, install the utility if it isn’t already there (e.g., apt install ipmitool), and run the exact same commands from Method 1.

Last Resort Method: The BMC Factory Reset

If for some obscure reason the previous methods fail, there is one ultimate resort left: resetting to factory settings.

With the Supermicro tool, the command is direct:

./IPMICFG-Linux.x86_64 -fd

And if you prefer the pure ipmitool method, you need to send a RAW command:

ipmitool raw 0x3c 0x40

⚠️ Warning, the consequences are heavy: Your entire BMC configuration is wiped clean. You will lose the static IP (the port reverts to DHCP), VLAN configurations, and user accounts. The BMC will then reboot (expect a good 2 to 3 minutes). Pay close attention to recent generations of servers: the password may not revert back to ADMIN/ADMIN. It defaults to the unique password printed on the OCP label (often stuck on the chassis or motherboard). Keep this in mind if your server is physically located on the other side of the world!

My Recommendations

Once access is recovered via method 1 or 2, here is what I systematically do to cover my back:

  1. The Password Manager: It’s basic, but save your creds immediately instead of keeping them in your copy-paste clipboard.
  2. The Backup Account: Create a second administrator account.
  3. The Slot ID Trick: Do not put your backup account on Slot ID 3. Force its creation on a higher Slot (like 5 or 6). Why? Because some infrastructure automation scripts have the annoying tendency to forcefully overwrite or modify the early Slots (2 and 3) during provisioning. By placing it further down, you safeguard it.

What about you? Have you ever locked yourself out of one of your nodes? Share your worst nightmare in the comments below!

Read More
VM Startup Policies on Nutanix AHV

A few years ago, following a power outage at one of our two sites, I had to deal with some application issues after the Nutanix cluster restarted. On paper, everything should have gone smoothly: the UPS had taken over, causing no impact on production, but that was without counting on a mishandling by the technician who turned off the UPS. The cluster shut down abruptly.

Once the power returned, the cluster restarted automatically, and all the VMs restarted shortly after. The problem was that some database servers took their time… Too much time for certain business applications…

It’s exactly to save you from these late-night cold sweats that we are going to explore VM Startup Policies on Nutanix AHV today.

While the concept of sequencing the startup of your servers might seem simple, the underlying mechanics are worth a closer look.

What are “VM Startup Policies”?

VM Startup Policies are a native feature of the AHV hypervisor that acts as a scheduler when powering on your virtual machines. This feature was added with version 7.5, which I talked about a while ago on the blog.

VM Startup Policies welcome screen in Prism Central

Instead of suffering the startup order and leaving control to the cluster, you define precise groups of VMs and strict dependency rules. This way, you guarantee that your infrastructure services (like an Active Directory, for example) and your databases are fully operational before allowing the application servers to start.

To fully understand the importance of these rules, a quick reminder of Acropolis HA’s default behavior is necessary. In the absence of a Startup Policy, during a node crash or a cluster restart, the restart of VMs is done in best-effort mode. The Prism Element cluster focuses on rapid resource allocation (CPU/RAM) and triggers the power-on of VMs completely asynchronously and concurrently, and natively has no awareness of your application dependencies.

When do these rules really activate?

It is important to clarify that these strategies do not apply if you decide to restart a VM manually from the Prism Central interface in the middle of the day.

AHV orchestration wakes up and applies your Startup Policies in two critical scenarios:

  1. A High Availability (HA) event: One or more physical nodes in your cluster fail. The AHV hypervisor will migrate and restart the affected VMs on the surviving nodes, strictly respecting the order you defined.
  2. A Full Cluster Restart: Exactly the case of my anecdote! Following a total power outage, for example.

Decrypting the Mechanics: The 3 Fundamental Pillars

Nutanix’s approach has the merit of being extremely visual and very easy to grasp from Prism Central. It relies on three fundamental concepts.

1. Categories

Nutanix’s mechanics rely exclusively on Prism Central Categories. You don’t link “SQL-Server-01” to “Web-Server-01”, but you link the AppMetier:Database category, for example, to the VMs hosting databases and your application VMs to the AppMetier:Applicatif category.

This is where the true power of this architecture lies. If tomorrow you deploy three new application servers in scale-out to handle an unexpected load, you just need to assign them the right category. They will automatically be integrated into the correct order of your Startup Policy without you having to open or modify a single rule.

2. Dependency Levels

This is how you draw your logical chain: category B can only start if category A has finished. There is still a small subtlety to keep in mind: Nutanix allows a maximum of 6 consecutive dependency levels per policy. In 99% of cases, this is more than enough for a classic application (e.g., Infra > DB > Web), but it requires grouping your services well without micromanagement.

Cannot add more than six groups to a policy message

3. Start Conditions

That’s the million-dollar question: how does the AHV hypervisor know that the database is really ready to authorize the next step? The tool offers you 2 options:

  • VM Power On: As soon as the VM is powered on at the hardware level, the next step is launched. The Windows or Linux OS is not even loaded yet. To be avoided for strong dependencies.
  • Guest Boot up: The best of the best! Nutanix waits patiently for the OS to be fully loaded and the network layer to respond.

For the “Guest Boot up” condition to work, the Nutanix Guest Tools (NGT) must absolutely be installed and up to date on the VM. My advice (and the vendor’s recommendation): do not skip the NGT deployment!

There is also an option that complements either one:

  • Delay (in seconds): We “blindly” wait a given time (e.g., 60 seconds) before moving on.

Tutorial: Creating a Startup Policy

Let’s model the most common example: we want to start our domain controllers, wait for them to be ready, start our databases, and finally our application servers.

For this occasion, I created 3 categories: AppType:ActiveDirectory, AppMetier:Database, and finally AppMetier:Applicatif

  1. Log in to Prism Central.
  2. Go to the Infrastructure > Compute > VMs > Policies > VM Startup Policies menu.
  3. Click on Create VM Startup Policy.
  4. Give it an explicit name (e.g., Policy-Tiering-Metier).
  5. In the visual interface, add your first category (e.g., AppType:ActiveDirectory).
  6. Add a second block for AppMetier:Database and a third for AppMetier:Applicatif.
  7. Click on + Configure Start Conditions to define the startup conditions. Choose Guest Boot up and optionally add a 30-second safety delay to allow the internal OS services time to initialize properly.

Click on “Create”, and you’re done!

Creating a VM Startup Policy with three dependency groups

All that’s left is to add your VMs to the right categories.

Pitfalls to Avoid

The tool is great, but here is some field feedback to help you avoid falling into certain traps:

1. Manage the 6-Level Limit Intelligently

Don’t fall into the micromanagement trap! If you try to make a policy for every micro-application, you will quickly saturate the interface, reach the famous 6-level limit, and end up with a convoluted system that’s impossible to maintain over time. Group your resources intelligently and keep it simple!

2. Beware of the Interaction with DR Mechanisms

Startup Policies manage the local resilience of a cluster (HA or reboot). But beware, if you use Nutanix Disaster Recovery to failover to a remote site, this system has its own recovery plan mechanism. During an inter-site failover, it’s the Prism Central Recovery Plan that takes control of the startup order, and no longer your local Startup Policy. Therefore, ensure logical consistency between the two tools.

3. This Only Applies to Guest VMs

There is no need to try sequencing “Nutanix” VMs (Prism Central, CVM, or others…), it will not work. The mechanism is only applicable to your virtual machines, not system ones.

Conclusion

VM Startup Policies on Nutanix AHV are the kind of feature you configure once, forget about, and which can save precious time and provide peace of mind the day the unthinkable happens. Thanks to an intuitive visual interface based on categories, Nutanix has made application resilience accessible to everyone.

If you haven’t already done so, I strongly encourage you to check the status of your NGT (deployment status and versions) and categorize your most critical VMs today. Your future “you,” woken up at 3 AM during the next production incident, will thank you!

Read More
OpenClaw prerequisites on Nutanix AHV

In a previous article, we saw how to deploy OpenClaw on Nutanix AHV. However, before you can fully enjoy this autonomous AI agent, it is crucial to prepare the ground. OpenClaw is not just a simple script: it’s an ecosystem that relies on several technological building blocks to “think” (local LLM), “execute” (Node.js) and “search” (SearXNG).

OpenClaw prerequisites diagram: Ollama, SearXNG, Docker, Homebrew and GPU

In this article, we are going to detail the step-by-step installation of all the necessary prerequisites on your virtual machine (running Ubuntu), explaining for each one why it is essential for OpenClaw to work properly.

1. NVIDIA Drivers: Unleashing GPU Power

OpenClaw can rely on large language models (LLMs) running locally. While it is technically possible to run these models on a processor (CPU), performance would be extremely slow. Installing NVIDIA drivers allows the system to leverage the graphics card (GPU) allocated to your VM via Nutanix AHV (vGPU or Passthrough), thereby ensuring fast and smooth AI inference.

Here is how to update your system and install the appropriate drivers:

# System update
sudo apt update && sudo apt upgrade -y

# NVIDIA server driver installation
sudo apt install nvidia-driver-535-server -y

# Reboot required to take effect
sudo reboot

After the reboot, check that your GPU is correctly recognized with the following command:

nvidia-smi

2. Node.js (v24): OpenClaw’s Execution Engine

The core logic of OpenClaw is developed in JavaScript/TypeScript. Node.js is the execution environment that allows running the agent’s code, managing its dependencies, and orchestrating calls between the interface, the AI model, and the various tools. We are targeting version 24.x here to ensure optimal compatibility.

# Adding the NodeSource repository and installing
curl -fsSL [https://deb.nodesource.com/setup_24.x](https://deb.nodesource.com/setup_24.x) | sudo -E bash -
sudo apt install -y nodejs

# Verifying the installed version
node --version  # should display v24.x

3. Ollama & Qwen 2.5: The Local Brain of the Operation

Ollama is the tool that will allow us to easily download and run our AI model locally. For OpenClaw, we are going to use the Qwen2.5 (7B) model. Why this choice? It’s a lightweight model (suitable for GPUs with about 8 GB of VRAM) and, above all, it is excellent at “Tool Calling”. It is this capability that allows OpenClaw to understand that it needs to execute a web search or run a script rather than simply generating text.

# Installing Ollama
curl -fsSL [https://ollama.ai/install.sh](https://ollama.ai/install.sh) | sh

# Start the Ollama service (in the background)
ollama serve &

# In another terminal, verify that Ollama detects the GPU:
nvidia-smi  # You should see ollama in the list of GPU processes

# Pull (download) the recommended model
ollama pull qwen2.5:7b

# Test the model and verify its execution on the GPU
ollama run qwen2.5:7b "say hello"

# While the model is generating a response, check VRAM usage
nvidia-smi

4. Docker: The Containerization Infrastructure

In order to extend OpenClaw’s capabilities (especially for web search which we will see next), we need third-party services. Docker allows these services to be deployed in an isolated, standardized, and fast manner, without polluting our host system with multiple complex dependencies.

# Installing initial dependencies
sudo apt update
sudo apt install -y ca-certificates curl gnupg

# Adding Docker's official GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL [https://download.docker.com/linux/ubuntu/gpg](https://download.docker.com/linux/ubuntu/gpg) | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Configuring the Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  [https://download.docker.com/linux/ubuntu](https://download.docker.com/linux/ubuntu) \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Installing Docker packages
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Adding your user to the docker group to avoid using 'sudo' every time
sudo usermod -aG docker $USER
newgrp docker

# Verifying the installation
docker --version

5. SearXNG: Giving AI Access to the Web

For OpenClaw to be a truly performant search agent, it cannot rely solely on the data contained in the Qwen model (which stops at its training date). SearXNG is a privacy-respecting metasearch engine. By installing it via Docker, we provide OpenClaw with an API (on port 8080) that it can use to retrieve real-time information from the web and source its answers.

# Create a dedicated directory for configuration
mkdir -p ~/searxng && cd ~/searxng

# Run the SearXNG container
docker run -d \
  --name searxng \
  --restart unless-stopped \
  -p 8080:8080 \
  searxng/searxng

# Verify that the container is running correctly
docker ps

# Test that the SearXNG API is responding
curl http://localhost:8080

6. Homebrew & GCC: The Compilation Tools

The OpenClaw Node.js ecosystem sometimes relies on low-level libraries or native packages that need to be compiled directly on your machine during installation. Homebrew (the well-known package manager on macOS, also very handy on Linux) and the GCC compiler are essential to avoid errors during the final dependency installation phase (the famous npm install).

# Install the base Ubuntu compilation package
sudo apt-get install build-essential

# Install Homebrew
/bin/bash -c "$(curl -fsSL [https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh](https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh))"

# The end-of-installation instructions for Homebrew will ask you
# to add Homebrew to your PATH. Generally, it looks like this:
# (Make sure to adapt the path if necessary)
echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> /home/$USER/.bashrc
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"

# Install GCC via Homebrew
brew install gcc

Conclusion

Your virtual machine on Nutanix AHV is now a rich and complete environment, equipped with high-performance GPU drivers, an execution engine (Node.js), an LLM ready to answer (Ollama), web access (SearXNG), and the right compilation tools.

The groundwork is perfectly laid. All that’s left is for you to finalize the installation of the application itself by following the rest of our guide on OpenClaw.

Read More
header nutanix

A few months ago, I wrote an article about installing NGTs via the command line on Linux.

Having recently switched to Rocky Linux 10 for my lab VMs, I’ve run into a problem: the procedure I’ve been using doesn’t work!

NGT installation command output on Rocky Linux 10

Here’s how to work around the problem…

Installing Nutanix Guest Tools

Connect to your Nutanix cluster on Prism Central, go to the list of virtual machines, right-click on the virtual machine where you want to install NGT, and click “Install NGT”:

Install NGT menu in Prism Central

On the next screen, in my case there’s no need to change anything, click on “Confirm and Enter Password”:

NGT installation options

Do not touch anything on this screen, simply click on “Skip and Mount” in the bottom left corner:

Skip and Mount button in the NGT installation

The ISO is mounted; now we move on to the command lines!

Installing Nutanix Guest Tools

Here are the commands to run on the virtual machine to install Nutanix Guest Tools:

  • System update:
sudo dnf update -y && sudo dnf upgrade -y
  • Install Python (if not already installed):
sudo dnf install python3
  • Verify drive letter ID:
blkid -L NUTANIX_TOOLS
  • Command output:
/dev/sr0
  • Mount the ISO:
sudo mount /dev/sr0 /mnt
  • Enter root mode:
sudo su
  • Install NGTs:
dnf install /mnt/installer/linux/ngt_rpm_installer/ngt_repo/nutanix-guest-agent-4.5.1-1.x86_64.rpm
Installing the NGT package with dnf

  • Checking the installation via command line:
yum list installed | grep 'nutanix-guest-agent'
nutanix-guest-agent 4.5.1 package installed

On Prism Central side :

Rocky Linux 10.1 VMs in Prism Central
Read More
From Nutanix CLI to APIs

Those who’ve been following the blog for a while surely remember my “Maxi Best-Of Nutanix CLI” series. I loved writing it, and obviously, it saved the day for some of you more than once. But with the announced end of SSH connections on Nutanix clusters, the days of firing up PuTTY to SSH into a CVM (Controller VM) and typing our ncli or acli commands as we please are over. Today, with the rise of Zero Trust architectures and STIG (Security Technical Implementation Guides) compliance requirements from the US DoD, locking down low-level access is no longer a paranoid option: it’s the production standard.

Why is the API becoming the only master on board?

Let’s be very clear: the REST API is the admin’s essential new Swiss Army knife.

It started with the progressive hardening of our infrastructures, notably with cluster lockdown, but the sentence officially fell in late January 2026: Nutanix announced the End of Support Life (EOSL) for “Bash Shell Access”. The reason is obvious. Leaving direct, unrestricted Bash access to the underlying OS (whether on AOS, AHV, or even Prism Central) has become absolute nonsense when it comes to guaranteeing security, auditability, and long-term support.

Here is the timeline I found in this document:

  • Under AOS 7.0 to 7.5, we started seeing login warnings, the appearance of an info alert warning of the deactivation of SSH password authentication, and options to disable SSH manually.
  • Starting from the next major NCI release, Bash will be disabled by default. Instead: an ultra-restricted “SSH Service Menu” allowing you to run a few acli/ncli commands to perform basic troubleshooting / actions.
  • And for late 2026? The “SSH Service Menu” is in place, the bash shell is disabled, but can be reactivated in “Support-Only” mode via a temporary token provided when handling a ticket with Nutanix support.

The only official, tracked, and complete entry point to interact with the infrastructure via command line is now the API.

Whether it’s the Prism Element API (v2.0) on an isolated cluster, or the Prism Central API (v3/v4) for multi-cluster management, there’s no escaping it: you have to dive in.

The API toolkit

Before we can blast our clusters with API requests, we need to gear up.

Daily, I switch between two go-to tools: Curl when I have a Linux/WSL terminal at hand (fast, raw, scriptable), and Postman when I need to visually explore Nutanix APIs.

If your workstation isn’t ready yet, I’ll point you directly to the dedicated article I’ve already written on this topic: Configure your Windows PC to query Nutanix APIs (WSL & Postman).

However, even when well-equipped, I regularly see admins tearing their hair out over their first Prism Element requests because of two crucial details.

The SSL certificate: By default, a Prism Element cluster uses a self-signed certificate. If you send a standard request, it will be violently rejected. The field reflex? Always add the -k (or --insecure) flag in your curl commands, and remember to disable the SSL certificate verification option in Postman settings.

Authentication: The Prism Element v2.0 API relies on Basic Auth. Avoid passing your credentials in plain text in the URL of your request (like https://admin:MySuperPass@IP...). It inevitably ends up in plain text in the history or logs. In Postman, use environment variables!

Get cluster details request in Postman

Exploring the API with the built-in REST API Explorer

How many times have you banged your head against the wall looking for the right syntax in a 500-page PDF documentation? With Nutanix, forget about that. The best documentation isn’t on the support portal; it’s directly embedded in your cluster.

Prism Element natively integrates an interface called REST API Explorer. To access it, it’s very easy: log in to your cluster’s web interface, click on your username at the top right, then select REST API Explorer. You can also type the URL directly: https://<CVM_IP>:9440/api/nutanix/v2/api_explorer/index.html.

The true power of this Swagger isn’t just listing the endpoints (GET /cluster, POST /vms…). It’s its ability to code for you! Fill in the required fields in the interface and click the “Try it out!” button. Not only does the interface execute the request and display the raw JSON response, but above all, it generates the complete and perfectly formatted curl command. It’s the ultimate hack to save time and avoid syntax errors.

REST API Explorer v2 API list

Conclusion

I won’t hide it from you, moving from CLI to REST API took a little effort to adapt. At first, I fumbled around, I grumbled at a malformed header or a temperamental JSON. But once you’ve crossed that milestone, it becomes almost natural. The API opens the doors to large-scale automation and continuous integration. However, you unfortunately won’t be able to find equivalents for every single CLI command…

In the next article of this series, we’re going to get to the heart of the matter. Enough theory, we’ll tackle practice with our first concrete use case: The complete health check of a cluster.

Read More
openclaw on nutanix ahv

If you read my previous article detailing the architecture and the technical stack I chose to deploy OpenClaw, you already know why I decided to run this solution on my Nutanix AHV cluster. Today, we’re getting practical! I will show you, step by step, how to deploy your own instance on a freshly installed Ubuntu virtual machine.

Before kicking off the hostilities, here is a quick reminder of my setup. I provisioned a VM on Nutanix AHV with:

  • 8 vCPUs
  • 32 GB of RAM
  • 250 GB of storage
  • an NVIDIA Tesla P4 graphics card in PCI Passthrough

💡 Why favor full Passthrough over vGPU (virtual GPU)? Quite simply to guarantee near “bare-metal” inference performance. By giving our VM direct and exclusive access to the physical hardware, we completely eliminate the overhead (latency) associated with the virtualization layer.

Let’s start the deployment.

Preparing the Ubuntu VM: System and NVIDIA Drivers

The very first step is to prepare the ground to deploy our AI.

Ubuntu 24.04: Operating System Update

This is a rule I apply every single time I deploy a new operating system. As soon as I connect via SSH, I make sure all packages are up to date to avoid future security flaws or dependency conflicts.

sudo apt update && sudo apt upgrade -y

GPU: Installing NVIDIA Drivers

For OpenClaw to harness the computing power of my Tesla P4, the operating system must be able to communicate with it properly. Here are the commands to run to install the drivers (you can access a more detailed guide on the blog):

sudo apt install nvidia-driver-535-server -y
sudo reboot

Once the machine has rebooted, we log back in and type the command to verify that our GPU is properly detected and ready to work:

nvidia-smi
nvidia-smi output with the Tesla P4 on the OpenClaw VM

Node.js and OpenClaw

Installing Node.js 22

OpenClaw is built on Node.js. To ensure we have a recent and efficient runtime environment (here version 22), we add the official NodeSource repository before launching the installation:

curl -fsSL [https://deb.nodesource.com/setup_22.x](https://deb.nodesource.com/setup_22.x) | sudo -E bash -
sudo apt install -y nodejs

Basic OpenClaw Deployment

Now that NodeJS is in place, we move on to installing OpenClaw. A simple curl script provided by the developers does the heavy lifting:

curl -fsSL [https://openclaw.ai/install.sh](https://openclaw.ai/install.sh) | bash

Once the installation is complete, the system automatically launches the configuration wizard for your instance. I will detail this step as well as the creation of API keys (Discord, Telegram, etc.) in a future blog post.

OpenClaw setup wizard security warning

A small manipulation is required right after the OpenClaw installation if we want to be able to use “openclaw” commands without constraints. We need to add the local installation directory to our PATH environment variable (remember to adapt the username if you are not using administrateur):

export PATH="/home/administrateur/.npm-global/bin:$PATH"

💡 Why this manipulation? It’s an excellent security practice that I highly recommend. By exporting the PATH to ~/.npm-global/bin, we avoid installing global NPM packages with root (sudo) privileges. This significantly reduces attack surfaces and saves you from the eternal Linux permission conflicts!

Cleanly Exposing OpenClaw with Caddy

By default, the OpenClaw web interface listens on port 18789. Instead of attacking this port directly, I always prefer to place a reverse proxy in front of my applications. For this lab, my choice fell on Caddy.

sudo apt install -y caddy

💡 Why Caddy rather than Apache or Nginx? Because Caddy is formidably efficient. Where Nginx sometimes requires long configuration blocks for simple proxying, Caddy does the same job in literally three lines of code, all while being ultra-lightweight.

We edit its configuration file:

sudo vi /etc/caddy/Caddyfile

And we replace the entire content with the following instructions (replace the IP with the one of your VM, in my case 192.168.84.134):

192.168.84.134 {
    reverse_proxy 127.0.0.1:18789
}

Now, all that’s left is to restart the service so the proxy takes over:

sudo systemctl restart caddy

Network Security: Locking Down the OpenClaw Instance

Having a functional instance is good, securing it is essential. Even if you are on your local network (LAN), you should never leave open access to your control interface. We are going to apply a strict configuration via the OpenClaw CLI commands.

We start by restricting the Gateway listening to the local loopback to prevent any direct access:

openclaw config set gateway.bind loopback

We then force the operating mode to local, and activate token authentication (the bare minimum):

openclaw config set gateway.mode local
openclaw config set gateway.auth.mode token

Finally, since we are going through Caddy, we must authorize Cross-Origin requests (CORS) coming from our IP address, otherwise the browser will block the page (don’t forget to adapt the IP):

openclaw config set gateway.controlUi.allowedOrigins '["[https://192.168.84.134](https://192.168.84.134)"]'

We restart the service to apply our lockdown:

openclaw gateway restart

💡 The security pattern applied here is akin to local “Zero Trust”. By forcing OpenClaw on the loopback (127.0.0.1), we ensure that absolutely all traffic is forced to go through our Caddy proxy. Coupled with CORS filtering and authentication, we provide a baseline protection for our instance against potential scans or malicious scripts on the network.

First Contact and Configuration Validation

Retrieving the Access Token

Now that the doors are locked, we need the key. The authentication token was automatically generated during installation. We’re going to go fish it directly out of the JSON configuration file:

grep -i token ~/.openclaw/openclaw.json

Carefully copy this string of characters. Then open your browser and access your Web interface (e.g., https://192.168.84.134).

OpenClaw Gateway Dashboard login page

Enter the token in the “Gateway Token” box.

Device Approval

Once connected, you will notice that something is missing: the system is waiting for us to approve the “device” (the PC or tablet from which we wish to use OpenClaw) to grant it the right to process requests.

Return to your terminal to list the pending devices:

openclaw devices list

Locate your device ID in the list (a UUID-type string) and approve it:

openclaw devices approve b7beb7fa-fa4e-46e9-aec1-282bcce881f6

💡 Device approval (devices approve) is much more than a simple interface formality. It’s a sort of cryptographic handshake. This mechanism guarantees that no unsolicited machine can attach itself to your OpenClaw cluster instance without your knowledge!

Interaction Tests

The OpenClaw instance is now 100% operational! To validate our entire stack, there’s nothing like a full-scale test. You can send a first prompt on the web interface’s integrated chat, or configure a bridge to send a message on the Discord side.

OpenClaw chat interface

Conclusion

We went from a simple Ubuntu VM to a true secured inference server, powered by Node.js and accelerated by a dedicated NVIDIA Tesla P4 GPU via Nutanix AHV. The architecture is clean, secured behind a Caddy proxy, and ready to handle our requests.

But this is only the beginning. In upcoming articles, we will go even further: I will show you how to configure OpenClaw via the startup wizard, deploy local models via Ollama, create an interactive Discord bot, and even inject Google API keys to equip our AI with search capabilities. Stay tuned!

Read More
OpenClaw on Nutanix AHV

If you follow my ramblings on the blog, you know I love tinkering with my clusters and testing somewhat out-of-the-box stuff (cf. my Steamdeck articles for example). Recently, I had a thought: Gemini or Claude in the public cloud is great for coding a Python script or writing emails. But when it comes to asking it to interact with our local infrastructure, that’s where it gets stuck.

So I wondered how I could connect artificial intelligence closer to my VMs. With this in mind, I got my hands on OpenClaw. Honestly, it was a bit of an obstacle course at the start. No more simple conversational gadgets, here we are talking about deploying a true Private AI on a Nutanix AHV cluster capable of acting on our infrastructure. Let me present the tech stack I chose for this experiment.

What is OpenClaw?

For those who have been living in a cave these past few months, OpenClaw is a GitHub project that exceeded 300k stars in just a few months. Imagine an ultra-intelligent thought translator coupled with a butler. Instead of clicking through dozens of menus in a complex interface, you simply ask your infrastructure to work for you in natural language (via a universal web interface or even messaging apps like WhatsApp and Telegram). It is even capable of working on its own while you sleep!

But where it gets exciting for us engineers is under the hood. OpenClaw is not just another “stateless” Large Language Model (LLM) that forgets everything with each new request. It is a true Agentic Gateway. Concretely, this means it orchestrates autonomous agents equipped with tools. These agents can be configured to tap directly into our cluster’s private APIs (like the REST APIs of Prism Element or Prism Central), code, browse the web, and synthesize certain information. In short, we don’t just ask the AI questions anymore, we delegate tasks to it.

OpenClaw dashboard

Why Self-hosted?

In the field, the question of data governance arises the second the word “AI” is pronounced. Out of the question to send sensitive information to servers over which I have no control!

Choosing the Self-hosted route with OpenClaw means taking back absolute control. Data flows, execution logs, and API credentials stay locked down warm and safe on my network, isolated from the internet if desired.

Architecture and Tech Stack

For this project, a simple “Next, Next, Finish” on the corner of a table was out of the question. Here is the robust technical architecture I ended up validating for my deployment.

OpenClaw deployment technical stack infographic

The Foundation: Nutanix AHV & Ubuntu 24.04 LTS

To run this beast, you need solid foundations. I provisioned a virtual machine running Ubuntu 24.04 LTS hosted directly on my Nutanix AHV cluster.

On the sizing side, I went with 8 vCPUs, 32 GB of RAM, and 250 GB of dedicated storage. You might tell me: “32 GB for a gateway, isn’t that a bit too much?” The gateway will have to ingest substantial data streams, maintain the cache of the various active agents, and potentially handle heavy parallel API querying. And besides, I can allocate these resources in my lab, so why deprive myself?

The Application Engine: NodeJS 22

At the heart of OpenClaw, the magic happens thanks to NodeJS 22. It is the execution engine that runs the gateway and its AI agent integrations.

Why is Node 22 an excellent architectural choice here? For its asynchronous management (Event Loop). When you ask OpenClaw to do a status report on 50 VMs, the gateway will initiate multiple API calls to Prism Central while keeping your WebSocket stream open to reply in real-time in the chat interface. NodeJS excels in this non-blocking concurrency management.

Network Routing: Caddy

The usual operating mode for OpenClaw is to deploy it locally on the machine from which you will connect to it, or to set up a tunnel to access the remote instance. Let’s not lie to ourselves, I wanted to type the IP in my browser and be able to access my instance, whether I’m on my PC or my tablet.

To make this possible, I use a Caddy Reverse Proxy. Caddy manages traffic routing and HTTPS encryption fully automatically.

I can already hear you saying: “Yes, but if a guy connects to your local network, he will have access to your instance!”. Well no! Because OpenClaw natively integrates a Device Whitelisting system. If your PC has never been connected to the instance, you will have to provide the “Gateway Token”. Then, you will have to accept this new connection on the OpenClaw instance side. As you can see, only previously authorized devices can enjoy your local instance.

The Entry Point: Discord

The choice of entry point, which will allow you to interact with OpenClaw, is often a matter of taste and colors.

OpenClaw directly integrates a chat system so you can talk to it. It’s good, it’s native, but inaccessible if I’m not at home. The system also offers to configure external entry points like Telegram, WhatsApp, Discord, or even Teams and Slack. And that is clearly a big plus because it gives almost unlimited possibilities!

OpenClaw agent answering on a Discord server

What’s Next?

The goal of this article was to present the architecture envisioned for my OpenClaw assistant, to understand what we are deploying and why. We therefore have a coherent technical stack, performant thanks to Nutanix AHV, and hosted locally.

In a future article, I will explain how to install OpenClaw step by step until you have a functional instance.

Read More