Get Started (VirtFusion)
Fast path from a licensed VirtFusion panel to your first plan in marketplace search
This guide takes you from a licensed VirtFusion control panel to a live, sellable plan in marketplace search, in order. It includes panel setup (groups, IP blocks, templates, package, API tokens) and NodeRings connect.
NodeRings is the customer control plane: billing, marketplace, DNS, and VM UI stay in NodeRings. Customers never log into the VirtFusion panel. The Global API token and User API token stay on your agent — NodeRings mothership does not store them.
Using Proxmox or SolusVM 2? Use Get started (Proxmox) or Get started (SolusVM 2) instead. One organization uses one hypervisor driver. Do not mix Proxmox, VirtFusion, and SolusVM in the same nr cluster register or the same org.
One control plane per package. Do not let WHMCS (or another orchestrator) provision the same VirtFusion package and hypervisor group that NodeRings is placing. Two orchestrators on the same inventory will double-book IPs and servers.
Before you start
| You need | Minimum |
|---|---|
| Control server | VirtFusion 6.2+ or 7.x, already installed and licensed |
| Hypervisor | At least one commissioned KVM host (all-in-one control+hypervisor is fine) |
| Agent VM | Ubuntu 22.04+, 2 vCPU, 4 GB RAM, outbound HTTPS |
| Domain | One you control (DNS or HTTPS verify) |
| Guest IPs | Public IPv4 block in VirtFusion; the panel assigns guest addresses (NodeRings IPAM is not used) |
| OS templates | Images in VirtFusion ready to register |
| Global API token | Dedicated token for the agent operator (see below) |
| Client user + User API token | One normal VirtFusion client user (not an admin) and a User API token generated while logged in as that user (see below) |
This page does not cover installing the VirtFusion control server or hypervisor packages.
VirtFusion control panel
The agent stack (virtfusion-operator, prometheus-virtfusion-exporter, vnc-gateway) uses a Global API token (admin) plus a User API token for one client user you create for NodeRings. NodeRings never stores either token. You enter them during agent install.
Finish the panel work below before you register the agent. Copy these integers when you are done: group id, hypervisor id, package id, operating-system id.
One hypervisor per group you will sell. NodeRings treats that group as one node. Extra hosts in the same group make placement dishonest.
Hypervisor group
Compute resources → Hypervisor groups → Create Group (for example edge-1) → Compute resources → Hypervisors → Add Hypervisor → commission → assign the group and set the primary NIC.
Create a hypervisor group (one host)
Step 1 of 4
Create a group
Hypervisor groups → Create Group. Name it for the site (for example edge-1). Copy the ID column — that is the NodeRings group id. Leave the built-in Default group empty.
Add and commission the hypervisor
Hypervisors → Add Hypervisor. Set name and the host’s management IP (the address that serves :8892, not a guest IP). On an all-in-one install, that is the control server itself.
Open the hypervisor → Test Connection → commission. Wait until it is commissioned and enabled. Copy the hypervisor id in the table — it is not the group id.
Limits, storage, and network
On General, set max servers, memory (leave a few GiB for the host), and virtual CPU. Assign the group from the previous step.
On Storage, enable a local mountpoint (often /home) and set Maximum Disk.
On Network, set Type to MacVTap and Interface name to the NIC guests should use (eth0 or ens18). Use a Linux bridge (br0) if you need filtering.
IPv4 block
Register a public IPv4 prefix in VirtFusion. The panel assigns guest addresses from that block. NodeRings does not run IPAM for VirtFusion.
Documentation examples use TEST-NET-3 (RFC 5737). Replace with your real prefix.
| Field | Example |
|---|---|
| Block name | pub-203-0-113 |
| Type | IPv4 |
| Gateway | 203.0.113.1 |
| Netmask | 255.255.255.0 |
| Resolvers | 1.1.1.1, 8.8.8.8 |
| Address range | 203.0.113.10 – 203.0.113.20 |
Connectivity → IP Address Blocks → Create IP Block.
Create an IPv4 block
Step 1 of 3
Create the block
Create IP Block → name it → type IPv4. On General, set gateway, netmask, and resolvers → Enabled → Save Settings.
Add the range
Add start–end addresses. Do not include the hypervisor or gateway unless you intend to assign them to guests. On Addresses, every IP should show Available.
Assign the hypervisor
Select the hypervisor → Assign Hypervisor. Bind it to Primary (eth0 or your bridge) and Update.
Keep this CIDR on the hypervisor (here 203.0.113.0/24). NodeRings does not copy it into IPAM.
OS templates
A VM template in NodeRings is a VirtFusion operating-system id, not a Proxmox VMID. Those ids are often small (for example 19). Open the template; the id is the last path segment:
https://cp.example.com/admin/server/media/templates/19 → 19.
Media → Operating System Templates.
Operating system templates
Step 1 of 1
Install images
From Updates / Available, install the distros you will sell (Ubuntu 22.04/24.04, Debian 12/13, and so on). Prefer Cloud Micro or other cloud-init images. Wait until each row is Enabled and Cloud-Init: YES.
Copy each OS id
Open each template and copy the numeric id from the URL. That is the NodeRings VM template template ID.
VirtFusion already generates hostname and SSH-key cloud-init on build. Do not create NodeRings cloud-init ISO templates (/infrastructure/cloud-init). Clients can still pass inline user-data or a saved cloud-init profile, and they can launch Instant Apps. NodeRings compiles that Jinja to cloud-config and the operator sends it as VirtFusion User API userData on POST /api/server/{uuid}/build — not as a cidata ISO. Instant Apps that ship as Ubuntu 26.04 (WordPress, Ghost, and the rest of the catalog) need a matching cloud-init OS template registered as a NodeRings VM template. Guest firewall, snapshots, and on-demand backups stay unsupported.
Server package
Each NodeRings plan points at one VirtFusion package id. Create packages in the panel (the API cannot).
Server → Server Packages → Create Package.
Server packages list
Step 1 of 2
Create a shared package
Name it (for example nr-shared-2c-4g). Set CPU, memory, and disk for the shared VPS you will sell → Enabled. NodeRings VirtFusion nodes are shared only.
Template collection
Leave Allow All, or attach a collection that includes the templates above.
Copy the package id
The ID column on Server Packages is what you enter on the plan later.
Do not let WHMCS (or another orchestrator) provision the same package and hypervisor group that NodeRings will place. Two control planes double-book IPs and servers.
Global API token
Settings → Global API → Create Token.
Global API tokens
Step 1 of 2
Open Global API
In the VirtFusion admin sidebar, Settings → Global API (breadcrumb Dashboard → Global API). Click Create Token.
Name the token
Name (for example noderings-agent). Leave Access empty until you know the agent’s egress IPs (blank = any connection). Confirm your admin password if asked. Click Create.
Copy the secret once
The green box shows vf_live_… once. Copy it to a password manager. It cannot be read again from the list (the table only shows name, permissions, and status).
Save the token secret when it's shown. It cannot be read again. Optional Access can list the agent’s egress IPs; leave empty until you know that address.
Notes
- Platform URL is the control origin only (for example
https://cp.example.com) — no/api/v1. The operator appends the API path.
More detail: Agents.
Client user and User API token
Chosen guest passwords and client cloud-init user-data are applied with VirtFusion's User API (POST /api/server/{uuid}/build with userData). The Global Admin API cannot pass userData or a chosen password.
Create one normal client user in VirtFusion for NodeRings (not an administrator). All NodeRings VMs are created as that user. Do not create a VirtFusion user per customer org.
Create the client user
In the VirtFusion admin sidebar, open Users → Create. Use a dedicated name (for example noderings). Give the account a real email you control. This must be a client user, not an admin. After create, copy the numeric user id from the Users table (or from the user URL). You will paste that id on the agent as VIRTFUSION_USER_ID.
Log in as that user
Sign out of the admin panel. Open the client area and log in as the user you just created. Complete any first-login password change if the panel asks.
Generate a User API token
While logged in as that client user, open Account → API (sometimes labelled API tokens). Create a token. Copy the secret once into a password manager. That value is VIRTFUSION_USER_API_TOKEN. It is not the Global API token from Settings → Global API.
Two tokens, two roles. The Global API token manages servers, packages, and hypervisors. The User API token belongs to the client user and is the only way to pass cloud-init userData on build. Mixing them (using the Global token on /api/server) returns 401.
Onboarding path
1. Organization
Create a provider organization, verify your domain, and complete your business profile before NodeRings unlocks infrastructure and billing.
Create organization
Step 1 of 5
Create a provider organization
In the sidebar, open the organization menu → Add organization → choose Provider (sells services to clients) → enter your company name → Create Organization.
Verify your domain
On Provider onboarding, enter the domain you will list on the marketplace (for example acme.com) and choose a verification method:
At your DNS host, add a TXT record:
- Name:
_nrings-challenge.<your-domain>(foracme.com, use_nrings-challenge.acme.com) - Value: the verification code shown in the dashboard
On your public web server, create:
- URL:
https://<your-domain>/.well-known/nrings-challenge.json - Content:
{ "_nrings-challenge": "<verification-code>" }(use the code from the dashboard)
Click Add Domain, apply the challenge, then Verify. DNS can take a few minutes to propagate.
Complete your organization profile
Fill in the details NodeRings uses for marketplace review and customer-facing listings:
- Organization name (legal company name)
- Support email, billing email, and support phone
- Business address (country, region, city, postcode)
- Tax identifiers (VAT ID, tax ID where applicable)
- DDoS provider and ASN (if you operate your own network)
- Provider logo (PNG or SVG, max 512 KB)
- Business owner name and social profiles (optional)
Request review
Click Request review and save. NodeRings reviews your listing; infrastructure unlocks after approval. Set up Stripe Connect under Organization → Billing → Payout when ready.
More detail: Organization · Domain verification.
2. Stripe Connect
Marketplace revenue is paid out through Stripe Connect. NodeRings charges the customer, keeps the platform commission for your tier, and transfers the rest to your Stripe account. Until Connect is active with charges and payouts enabled, you can still build infrastructure, but you cannot receive marketplace payouts.
A Community platform subscription is attached when you create the organization. Connect is available on Community and paid tiers. Open /billing/payout → Payout Methods → Connect Account.
Create Connect Account
Step 1 of 4
Choose how to connect
On Payout Methods → Connect Account, choose Create Connect Account or Use existing Stripe account. Creating a new account still opens Stripe's hosted onboarding (signing in there can reuse verified business and bank details, but NodeRings still gets a new Stripe account). Use existing connects the Stripe account you already use, including its balance and payout history. The existing account must be a Standard account that is not connected to another platform or to a different NodeRings organization. Disconnect a manual payout account first if one is configured.
Complete Stripe onboarding
If you created a new account, status is Pending and charges and payouts stay disabled until you finish Stripe's hosted form. Click Complete Setup & Onboarding, provide business and identity details, then return to the dashboard.
Confirm Active
When onboarding succeeds, the account shows Active with Charges Enabled and Payouts Enabled. You can set a payout schedule under Payout Schedule. If Stripe Connect is not available in your country, use Manual Payout instead (funds are held longer before release).
Stripe Connect is recommended: customer payments split at charge time and transfer to your Stripe account. Disconnecting only removes the link in NodeRings; it does not delete the Stripe account.
More detail: Billing & Payouts.
3. Region
A region is where you tell NodeRings where your infrastructure lives. It is the geography customers see when they pick a plan, for example “Frankfurt, Germany” or “Akron, United States”. Behind that label you map your real site: country, city, datacenter, and availability zone.
Regions page
Step 1 of 2
Pick the geography
Select country and city that reflect where your VirtFusion hypervisors actually run. This is what customers use to choose your plans.
Choose datacenter
Select the facility from the list, or choose Other if you do not want to disclose your datacenter provider on the marketplace. Other still lets you sell, only the specific facility name is hidden.
Choose availability zone
Pick zone_a, zone_b, or another zone only when the infrastructure is truly separate (distinct top-of-rack switches, routers, or hypervisor rows). If everything shares one fabric, use a single zone. Splitting zones without real isolation misleads customers about fault tolerance.
Save the region
Click Create Region. The region is then available when you attach nodes and plans.
You can operate multiple regions (different cities or zones). Customers buy a region; you assign each hypervisor to the region and zone where it physically sits.
More detail: Regions.
4. Agent
An agent is a lightweight k3s Kubernetes cluster you install on a VM inside your own infrastructure. You provision and operate it. NodeRings has no direct shell or root access. VM orders reach your VirtFusion control server through a scoped, encrypted peering channel and Custom Resources, not by NodeRings logging into your network.
The agent must reach NodeRings (API + Liqo), VirtFusion control HTTPS :443, and hypervisor VNC TCP 5900–5999.
Agents page
Step 1 of 3
Register the agent
Enter an agent name and the VM’s public IPv4 address. These are the only required fields to establish the secure channel between your site and NodeRings. Description is optional.
Choose gateway region
Select the gateway region closest to your agent VM. This is the datacenter where the NodeRings control-plane cluster runs. Picking a nearby gateway keeps the peering tunnel short and stable (for example Amsterdam if your agent sits in western Europe).
Provision on your agent VM
After you create the agent it appears as Unprovisioned. Select it in the list, open the Provisioning tab, and copy the Installation command. SSH into your Ubuntu agent VM and paste the command there.
You must pass VirtFusion as the driver (the default installs Proxmox). Prefer Create agent in the console: it copies a command that already includes --org-id.
On the agent VM, use a service account token (Access Control → Service Accounts). Do not run nr auth login on the VM:
export NR_API_TOKEN='<service-account-token>'
echo $NR_API_TOKEN
nr cluster register \
--name "Frankfurt VirtFusion" \
--agent-ip <public-ipv4> \
--gateway-region AMS01 \
--hypervisor-driver virtfusion \
--org-id <org-uuid>When prompted, provide the control origin, Global API token, client username, numeric user id, and User API token:
| Env | Meaning |
|---|---|
VIRTFUSION_URL | Control origin only, e.g. https://cp.example.com — no /api/v1 |
VIRTFUSION_TOKEN | Bearer token from Global API token |
VIRTFUSION_USER_NAME | Username of the client user |
VIRTFUSION_USER_ID | Numeric id of that client user (Users table) |
VIRTFUSION_USER_API_TOKEN | Token from Account → API while logged in as that user |
export VIRTFUSION_URL="https://cp.example.com"
export VIRTFUSION_TOKEN="…" # Global API; agent Secret only
export VIRTFUSION_USER_NAME="noderings"
export VIRTFUSION_USER_ID="5"
export VIRTFUSION_USER_API_TOKEN="…" # User API; agent Secret only
nr cluster register --hypervisor-driver virtfusion --name edge-vf-01 --agent-ip 203.0.113.10 --gateway-region AMS01 --org-id <org-uuid>The CLI installs k3s, Calico, Liqo peering, and virtfusion-operator into virtfusion-system (not proxmox-system).
Verify
On the agent:
nr cluster verify --name edge-vf-01Expect Helm namespace virtfusion-system, CRDs in vm.virtfusion.com, and Deployments for the VirtFusion operator, exporter, Alloy, and vnc-gateway.
VirtFusion tokens never leave your agent. NodeRings mothership does not store them. Do not paste them into Helm --set, ~/.nr, or a mothership values file.
More detail: Agents · CLI & automation.
5. Platform and node
Your agent controls one platform (the VirtFusion control server) and one or more nodes (each node is one hypervisor group).
Before you add a platform, confirm your agent is provisioned and shows a green status in /infrastructure/agents. If the agent is still Unprovisioned or offline, finish §4 Agent first.
Platform
/infrastructure/platforms-nodes → Add Platform.
Platforms & Nodes page
Step 1 of 2
Add a platform
Give it a name, select driver VirtFusion, and choose the agent you provisioned. API tokens are not entered here — they stay on the agent.
Set the endpoint URL
Enter the control-server origin only, for example https://cp.example.com. Do not append /api/v1. Do not use a hypervisor management IP.
The agent VM must be able to reach this URL. The operator probes GET /connect. The platform is online when that succeeds and hypervisor metrics flow (vf_hypervisor_up). The endpoint URL cannot be changed after the platform is created.
Each endpoint URL can be registered once per organization. If this org already has a Proxmox platform, create is rejected — one driver per org.
Node
A node is one VirtFusion hypervisor group (one host). Add a shared compute node. Do not set dedicated cores.
Enter both ids from VirtFusion admin. Group id is what VirtFusion create uses as hypervisorId. Hypervisor id is the host id. They are not the same number.
Add Node
Step 1 of 3
Add a node
Under your platform, click Add Node. Enter:
| Field | Meaning |
|---|---|
| Hypervisor id | Host id from the Hypervisors table |
| Group id | Hypervisor group id from Hypervisor group |
Attach region
Select the region from §3 Region where this host physically sits.
Skip Proxmox-only fields
Do not fill vmbr0, local-lvm, VMID seed, vzdump, NIC model, or dedicated/topology. VirtFusion nodes are shared only.
Resource overallocation
Set CPU, memory, and storage overallocation percentages for this node:
| Setting | Meaning |
|---|---|
| 100% | No overselling, each VM gets dedicated resources up to the physical limit |
| 200% | Up to 2× sell-through on that resource |
A plan still cannot exceed a single node’s physical size.
More detail: Platforms & nodes.
6. VM templates
Register VM templates with the VirtFusion operating-system id from OS templates. No Proxmox VMID, no pvesh, no NodeRings cloud-init ISO.
The onboarding CLOUD_INIT checklist step auto-passes for a VirtFusion org. Skip /infrastructure/cloud-init (ISO templates). Clients still use Instant Apps, a cloud-init profile, or inline user-data on create VM — applied as User API userData.
VM Templates page
Step 1 of 4
Register in NodeRings
Click Create VM Template. Select node, distro, and the VirtFusion operating-system id (the number in the template URL).
Cover the catalog you sell
Preflight expects every OS you list to be registered on the node. Match the distro to the VirtFusion image (Ubuntu 24.04 Cloud Micro → Ubuntu 24.04, and so on).
More detail: VM templates.
7. Guest IPs
VirtFusion assigns guest addresses from the IP block on the hypervisor. NodeRings does not run IPAM for this driver: the Network page is SMTP-only (no IPAM tab), and marketplace preflight omits ip_available. Cloud-Init Templates (ISO) stay hidden; clients still pass user-data or a profile on create VM. Preflight omits cloud_init_template.
Keep the IPv4 (and optional IPv6) block attached to the hypervisor in VirtFusion. Extra IPs still use the ADDITIONAL-IP addon; VirtFusion allocates those addresses.
Onboarding steps for IPAM networks and prefixes auto-pass for VirtFusion.
If the hypervisor has no free IPv4 in its block, create/build fails. Confirm available addresses in VirtFusion before selling.
8. Plans and addons
A plan is the VM size and price customers buy. Clone a shared plan template (no DC-* dedicated-core plans). Full reference: Plans & Addons.
Plans and Addons tabs
Step 1 of 6
Create a plan
Plans tab → Create Plan → shared billing type, region, and template. Set VirtFusion package id to the package from Server package (metadata.virtfusion.package_id).
CPU throttle and network rate
CPU throttle is a percent (NodeRings 0–100 maps to VirtFusion 0–99). Ignore cpuUnits. Enter NIC rate in MB/s as usual; the operator converts to kB/s.
Create addons
Required marketplace addon for VirtFusion: ADDITIONAL-IP only. Do not require DAILY-BACKUP or WEEKLY-BACKUP. NodeRings does not create on-demand backups on VirtFusion.
More detail: Plans & Addons.
9. Preflight check
After plans and addons exist, NodeRings validates that your infrastructure can actually sell them before they appear in marketplace search.
Platform/node health uses vf_hypervisor_up (not pve_up). Live validation provisions an OS-only pilot (SSH key, no Instant App).
Two stages, both required
| Stage | How it runs | Marketplace impact |
|---|---|---|
| Preflight | Automatic; re-runs every few minutes | Any red gate removes the plan from search until fixed |
| Live validation | Manual; you start each plan × node run | Plan lists only after at least one node passes preflight and live validation |
Preflight check dashboard
Step 1 of 5
Wait for preflight to go green
Fix red gates (agent, platform, node, templates, addons). The next automatic cycle usually picks up changes within a few minutes.
Run live validation per plan × node
Use Start validation for every combination you sell on. Repeat when you add nodes or plans.
Confirm marketplace ready
Summary shows Ready with no blockers, and live validation shows Validated: Yes for at least one node in the sell region.
Customers can find and buy your plan
On the client marketplace, your organization name, plan price, and listing details appear under recommendations.
Preflight quick fixes
| Red gate | Try this |
|---|---|
agent_online | Agent provisioned; platform linked to agent |
platform_online | Control HTTPS up; metrics flowing (vf_hypervisor_up) |
node_online | Node active, in plan region, not in maintenance |
plan_physical_fit | Node has enough physical CPU, RAM, and disk for the plan |
plan_capacity | Node has sell headroom after overallocation |
os_template | Register missing VM template (VirtFusion OS id) on that node |
addons_created | Create ADDITIONAL-IP with the same billing type as the plan |
More detail: Preflight Check.
Stuck?
See the full Troubleshooting guide, or jump to a common issue:
| Problem | Read |
|---|---|
| Agent not provisioned / no green status | Troubleshooting → Agent |
| Platform offline | Endpoint without /api/v1; token on the agent only |
| Wrong group vs hypervisor id | Platform and node |
| Console fails | Agent must reach hypervisor TCP 5900–5999 (classic RFB, not Proxmox :8006) |
| Domain verify fails | Domain |
| Red preflight | Preflight Check |
| Architecture / security | How it works → What a sale looks like |