Two container hosts, one hypervisor, one design rule: everything survives a reboot without human hands.
Why two nodes
The VirtualBox node carries the automation wing — Node-RED, n8n, Ignition Edge, FUXA, soft-PLCs — while the Proxmox LXC node carries the data core: broker mesh, databases, dashboards, project tools. Splitting them means one node can probe, heal and diagnose the other, which proved priceless during the last outage.
Resilience as a convention
Every container carries a restart-policy label. A small healer sweeps the fleet every five minutes and enforces those labels; Watchtower keeps images fresh; Uptime Kuma confirms the result. Three daemon restarts in a single day, zero manual interventions.
Twin services
Project management now runs identically on both nodes — same HTTPS gateways, same credentials, same seeded users — cloned in one session including a PostgreSQL 18 backend. The pattern generalizes: any service on one node can be mirrored to the other conversationally.
Next on the bench: cross-node monitoring, an MQTT bridge between broker meshes, and letting the operator write this journal after every major change.