diff --git a/.gitignore b/.gitignore
index 394e5d7e..bb134c56 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 tmp/
 *.iso
 result
+.proxmox
diff --git a/flake.lock b/flake.lock
index 7bf15885..556c3019 100644
--- a/flake.lock
+++ b/flake.lock
@@ -147,11 +147,11 @@
         "pixelfed": "pixelfed"
       },
       "locked": {
-        "lastModified": 1730317447,
-        "narHash": "sha256-Y3AhMe9WsFrjVhbmlTUXJd9TKDa7rFHb9F5hdG2eiJQ=",
+        "lastModified": 1730977329,
+        "narHash": "sha256-1/txLla4VANl2g/oyf5ehG5QSGauO/yvOzrblqzJzN8=",
         "ref": "refs/heads/main",
-        "rev": "007c168081267ed72dfbcec967b24e6ffc16b4a4",
-        "revCount": 96,
+        "rev": "cd194f818df0f1752da4ef15c1e435586d28b596",
+        "revCount": 97,
         "type": "git",
         "url": "https://git.fediversity.eu/fediversity/simple-nixos-fediverse.git"
       },
diff --git a/provision-vm.sh b/provision-vm.sh
new file mode 100755
index 00000000..38420f42
--- /dev/null
+++ b/provision-vm.sh
@@ -0,0 +1,223 @@
+#!/usr/bin/env sh
+set -euC
+
+## Proxmox API doc: https://pve.proxmox.com/pve-docs/api-viewer
+
+################################################################################
+## Parse arguments
+
+username=
+password=
+iso=result/iso/installer.iso
+sockets=1
+cores=1
+memory=2048
+vmid=
+
+help () {
+  cat <<EOF
+Usage: $0 [OPTION...]
+
+Required:
+  --username STR    Username, with provider (eg. niols@pve)
+  --password STR    Password
+  --vmid INT        Identifier of the VM
+
+  If not provided via the command line, username and password will be looked for
+  in a `.proxmox` file in the current working directory, the username on the
+  first line, and the password on the second.
+
+Optional:
+  --iso PATH        Installer ISO (default: $iso)
+  --sockets INT     Number of sockets (default: $sockets)
+  --cores INT       Number of cores (default: $cores)
+  --memory INT      Memory (default: $memory)
+
+Others:
+  -h|-?|--help      Show this help and exit
+EOF
+}
+
+die () { printf "$@"; printf '\n'; help; exit 2; }
+
+while [ $# -gt 0 ]; do
+  argument=$1
+  shift
+  case $argument in
+    --username) readonly username=$1; shift ;;
+    --password) readonly password=$1; shift ;;
+    --vmid) readonly vmid=$1; shift ;;
+
+    --iso) iso=$1; shift ;;
+    --sockets) sockets=$1; shift ;;
+    --cores) cores=$1; shift ;;
+    --memory) memory=$1; shift ;;
+
+    -h|-\?|--help) help; exit 0 ;;
+    *) die 'Unknown argument: `%s`.' "$argument" ;;
+  esac
+done
+
+if [ -z "$username" ] || [ -z "$password" ]; then
+  if [ -f .proxmox ]; then
+    { read username; read password; } < .proxmox
+  else
+    die 'Required: `--username` and `--password`.\n'
+  fi
+fi
+
+[ -z "$vmid" ] && die 'Required: `--vmid`.\n'
+
+printf 'Configuration:\n'
+
+printf '  username: %s\n' $username
+printf '  password: %s\n' $password
+printf '  vmid: %s\n' $vmid
+
+readonly iso
+readonly sockets
+readonly cores
+readonly memory
+
+printf '  iso: %s\n' $iso
+printf '  sockets: %d\n' $sockets
+printf '  cores: %d\n' $cores
+printf '  memory: %d\n' $memory
+
+################################################################################
+## Getting started
+
+readonly apiurl=https://192.168.51.81:8006/api2/json
+
+## FIXME: There seems to be a problem with file upload where the task is
+## registered to `node051` no matter what node we are actually uploading to? For
+## now, let us just use `node051` everywhere.
+node=node051
+
+from_response () { echo "$response" | jq -r "$1"; }
+
+printf 'Authenticating...'
+response=$(
+    http \
+        --verify no \
+        POST $apiurl/access/ticket \
+        "username=$username" \
+        "password=$password"
+    )
+readonly csrfToken=$(from_response .data.CSRFPreventionToken)
+readonly ticket=$(from_response .data.ticket)
+printf ' done.\n'
+
+http_ () {
+  response=$(
+    http \
+      --verify no \
+      "$@" \
+      "Cookie:PVEAuthCookie=$ticket" \
+      "CSRFPreventionToken:$csrfToken"
+  )
+}
+
+wait_ () {
+  upid=$1
+  while :; do
+    http_ GET $apiurl/nodes/$node/tasks/$upid/status
+    status=$(from_response .data.status)
+    case $status in
+      running) printf '.'; sleep 1 ;;
+      stopped) break ;;
+      *) printf ' unexpected status: `%s`\n' "$status"; exit 2 ;;
+    esac
+  done
+}
+
+################################################################################
+## Upload ISO
+
+if [ -z "$node" ]; then
+  printf 'Picking random node...'
+  http_ GET $apiurl/nodes
+  node=$(from_response .data[].node | sort -R | head -n 1)
+  printf ' done. Picked `%s`.\n' "$node"
+fi
+readonly node
+
+absiso=$(cd "$(dirname "$iso")"; pwd)/$(basename "$iso")
+readonly isoname=installer-$vmid.iso
+
+printf 'Uploading ISO...'
+ln -sf $absiso /tmp/$isoname
+http_ --form POST $apiurl/nodes/$node/storage/local/upload \
+  filename@/tmp/$isoname \
+  content==iso
+rm /tmp/$isoname
+wait_ $(from_response .data)
+printf ' done.\n'
+
+################################################################################
+## Create VM
+
+printf 'Creating VM...'
+
+http_ --form POST $apiurl/nodes/$node/qemu \
+  \
+  vmid==$vmid \
+  name==fedi$vmid \
+  pool==Fediversity \
+  \
+  ide2=="local:iso/$isoname,media=cdrom" \
+  ostype==l26 \
+  \
+  bios==ovmf \
+  efidisk0=='linstor_storage:1,efitype=4m' \
+  agent==1 \
+  \
+  scsihw==virtio-scsi-single \
+  scsi0=='linstor_storage:32,discard=on,ssd=on,iothread=on' \
+  \
+  sockets==$sockets \
+  cores==$cores \
+  cpu==x86-64-v2-AES \
+  numa==1 \
+  \
+  memory==$memory \
+  \
+  net0=='virtio,bridge=vnet1306'
+
+wait_ $(from_response .data)
+printf ' done.\n'
+
+################################################################################
+## Install VM
+
+printf 'Installing VM...'
+
+http_ POST $apiurl/nodes/$node/qemu/$vmid/status/start
+wait_ $(from_response .data)
+
+while :; do
+  http_ GET $apiurl/nodes/$node/qemu/$vmid/status/current
+  status=$(from_response .data.status)
+  case $status in
+    running) printf '.'; sleep 1 ;;
+    stopped) break ;;
+    *) printf ' unexpected status: `%s`\n' "$status"; exit 2 ;;
+  esac
+done
+
+printf 'done.\n'
+
+################################################################################
+## Start VM
+
+printf 'Starting VM...'
+
+http_ --form POST $apiurl/nodes/$node/qemu/$vmid/config \
+  ide2=='none,media=cdrom' \
+  net0=='virtio,bridge=vnet1305'
+wait_ $(from_response .data)
+
+http_ POST $apiurl/nodes/$node/qemu/$vmid/status/start
+wait_ $(from_response .data)
+
+printf 'done.\n'