The IP map tooltip read e.ip, but the backend ip-map endpoint returns
the address as ip_address, so the IP rendered as 'undefined'. Align the
IPAMIPMapEntry type with the backend response and build the tooltip from
proxmox_vmid, resource_name/hostname and ip_address.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wire up backend IPAM endpoints that had no frontend:
- edit/delete network (with force) on network detail page
- full pool CRUD (create/edit/delete) on network detail page
- manual allocation create + edit on allocations page
- IP address map visualization per network
Add missing hooks (useCreatePool/useUpdatePool/useDeletePool,
useUpdateAllocation), force support in useDeleteNetwork, typed
ip-map entries, writable allocation fields, and RU/EN locale keys.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- check_stale_db_volume looked for <project>_postgres_data but the
compose volume is <project>_db_data, so stale-volume detection and
--reset-data silently did nothing; use the real name.
- Generate a Fernet key (url-safe base64 of 32 bytes) for backend/.env
in all env-creation paths so sensitive fields are encrypted at rest
instead of stored as plaintext.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The mock_proxmox fixture patched ProxmoxClient with return_value= (constructor
style), but since commit d66928e clients are built via the
ProxmoxClient.from_server classmethod. from_server() therefore returned an
unconfigured child mock, so endpoints serialized a MagicMock and responded 500
— failing 5 tests in test_api_vms.py on every CI run (Backend Tests workflow).
Wire .from_server.return_value (and .return_value) on all patched ProxmoxClient
references to the configured instance so every construction path resolves to
the same mock. Full suite now green (60 passed).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Roles are stored in the new resource:action format and any legacy keys are
converted once at startup by the RBAC v2 DB migration (migrate_rbac_v2), so
the permission engine no longer needs to resolve legacy codes on every check.
- get_user_permissions: store role permission codes as-is (no dual add).
- has_permission: match new-format codes only; drop resolve_permission and the
dotted-code fallbacks.
- Remove now-unused resolve_permission import in middleware.
- LEGACY_PERMISSION_MAP / convert_* are retained as one-shot DB-migration
utilities (upgrade path), not a runtime bridge.
- Tests: adapt fixtures to new-format role permissions; assert legacy keys are
no longer honored at request time.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace all legacy dotted permission codes (vms.view, proxmox.manage, ...)
in PermissionChecker/has_permission across app/api with the new
resource:action format (vm:view, server:manage, ...), per LEGACY_PERMISSION_MAP.
All 33 codes used by the API are now registered in the permission registry.
Also switch the /api/auth/me admin branch to get_all_permissions_v2 so the
endpoint emits permissions in the new format only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
These permissions were referenced by the API (users.manage, proxmox.vm.manage)
but never registered in the permission registry, so they only worked through
the is_admin bypass — non-admin users granted them silently received 403.
- Register user:manage and vm:manage in the registry.
- Add missing legacy mappings: users.manage->user:manage,
settings.manage->setting:manage.
- Grant both new permissions to the admin role (defaults + init.sql seed);
ensure_default_roles_new_format propagates them to existing deployments.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Collapse four duplicated host+auth client-building blocks into a single
ProxmoxClient.from_server() classmethod (the canonical source of truth):
- _helpers._get_proxmox_client now delegates to from_server (107 callers
untouched)
- ipam._build_proxmox_client removed; its one call site uses from_server
- task_queue_service keeps its per-server cache pool, builds via from_server
- monitoring_worker keeps its ValueError-on-missing-auth contract, builds
via from_server
Behaviour preserved (token-first, then password; non-default port appended).
Verified: containers rebuild healthy, smoke test of both auth paths passes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Also drop the stray markdown code fences that wrapped the file and were
being treated as literal ignore patterns.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Drop the /api/servers/auto-setup endpoint, the AutoSetupDialog UI and the
useAutoSetupServer hook. Rename the auto_setup locale strings to
auto_create_token. Also normalize the storages response to an array.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Align the frontend with the /logs API contract: the endpoint returns
{ logs: [...] } with a created_at field, not { items: [...] } / timestamp.
Add a Vite dev-proxy rule for /logs so the request reaches the backend.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Read-only card on the instance Settings tab surfacing the panel-stored config
(cores/memory/disk/network/cloud-init) via the saved-config endpoint.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an 'Auto-setup' dialog that onboards a Proxmox server by password and
lets the backend auto-create the API token (adds all nodes for a cluster).
Show a cluster/standalone badge with node count on the node detail page.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Per-template Deploy button opens a quick-deploy dialog (prefilled from the
quick-deploy endpoint defaults) that creates a VM via /templates/api/deploy.
New 'Download CT template' dialog browses the node's appliance repository
(available-lxc-templates) and pulls a template to a vztmpl storage.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Move the guest-agent exec-status polling loop into a shared _wait_exec_status
method reused by execute_command and execute_script. No behavior change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Drop dead route handlers that have an active replacement and zero callers
(frontend, backend, tests):
- create-lxc, create-lxc-smart -> superseded by POST /lxc/deploy
- clone-lxc -> superseded by container/{vmid}/clone
- {server_id}/lxc-templates -> duplicate of /lxc-templates/{server_id}
- dashboard/stats -> dashboard uses resources/all + alerts
- permissions (v1) -> superseded by permissions/v2
The identically-named ProxmoxClient/SecurityService methods are kept (they
back the surviving endpoints).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Tasks page now shows the live Proxmox task log/status for UPID-backed tasks.
Instance Settings tab gains an admin-only 'Execute script' card that runs a
script in the guest via the QEMU agent and shows stdout/stderr/exit code.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Surface two previously-unused admin endpoints: assign/clear a VM's owner from
the instance Settings tab, and a /instances/snapshot-archives page listing
snapshots preserved from deleted guests (with config detail), linked from the
Instances header for admins.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New Storages tab in Backups: list cluster storages, add (dir/nfs/cifs/pbs
with type-specific fields), edit content/nodes, delete, and view native PVE
vzdump backup schedules — all over the previously-unused storage CRUD and
proxmox-jobs endpoints.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expand the Notifications settings tab: per-user preferences (channels,
critical-only email, Telegram chat id + verify, webhook, quiet hours),
SMTP/Telegram test buttons, a test-notification sender with channel
selection, channel status, and the configured Telegram bot username.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New /ipam/tools page surfacing the existing maintenance endpoints: summary
with recent activity, conflict detection, orphan allocations (with cleanup),
unlinked VMs (scan & link), auto-allocation + next-available lookup, and
per-IP history. Linked from the IPAM dashboard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expand the About tab into a full update manager over the existing backend
endpoints: edit the update repository URL, check for updates (showing
changelog/errors), trigger an update with a strong confirmation, and show a
live progress banner with a reset action while an update runs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Surface the existing SDN backend endpoints in a new SDNManager panel on the
node detail page: zones (CRUD with type-specific fields), VNets (CRUD), and
per-VNet subnets (create/delete, optional IPAM network link), plus an apply
action with a pending-changes indicator and an availability notice.
Fix subnet deletion to pass PVE's full subnet id ({zone}-{network}-{mask})
instead of just the CIDR, which the API rejected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Surface the existing HA backend endpoints (cluster HA status, add/remove
resource) in a new HAResources panel on the node detail page. Lists
HA-managed guests with state/group/restart limits, supports adding a guest
to HA (state, group, max_restart/relocate, comment) and removing it.
Shows a cluster-only notice on standalone nodes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add target node and storage overrides to single and bulk restore flows, and
track Proxmox task progress (parse_task_progress in the monitoring worker,
new ProxmoxTask progress column + migration, enriched task API responses).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wire up the existing node-network backend endpoints (list/create/update/
delete + apply/revert staged config) to a new NodeNetworks component on the
node detail page. Supports bridge/bond/vlan/eth interface types with
type-specific fields and surfaces IPAM linkage.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When Proxmox API returns 400 "unable to parse worker upid", the monitoring
worker was getting empty status {}, treating it as running, and retrying
forever every 5 seconds, causing 100% CPU and log spam.
Now when get_task_status() returns empty dict, we immediately mark the task
as failed with exit_status="Invalid UPID" and move on instead of looping.
Fixes production deployment hang.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- get_vm_status and get_container_status were missing require_vm_access(),
allowing any user with vms.view to see any VM status regardless of ownership.
Now users with vms.view.own can only access their own VMs (403 otherwise).
- Downgrade upload-artifact@v4 → @v3: v4 is not supported on Gitea (GHES)
and caused CI failures on every run.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The ssh_keys module was imported in main.py but missing from api/__init__.py,
potentially causing import issues. Added to ensure all API routers are
explicitly declared and available.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The migrations/ directory was missing from the Dockerfile COPY instructions,
causing ModuleNotFoundError when app.main tries to import and run migrations
during startup. This caused production deployments to fail with:
ModuleNotFoundError: No module named 'migrations'
The automatic migration runner in main.py (line 157) needs this directory to:
1. Detect database schema changes
2. Run pending migrations
3. Initialize default admin user
Fixes production deployment failure when containers start.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- restore_vm/restore_lxc: add force=True param (needed for in-place overwrite)
- QEMU restore: remove `restore: 1` from params (breaks Proxmox API — restore
is triggered by archive presence alone, unlike LXC where restore: 1 required).
This fixes both single and bulk QEMU restores.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- TemplatesPage: cap auto-import dialog at sm:max-w-md so it no longer
spans the full screen (bare DialogContent defaults to near-full width).
- InstancesPage: the server (multi-server/cluster) filter wrongly reused
the `instances.all_nodes` i18n key, so it rendered "Все узлы" identically
to the node filter. Add a dedicated `instances.all_servers` key (RU/EN)
and use it, so the two filters read "Все серверы" / "Все узлы".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Critical security and robustness fixes from a code audit:
- WS terminal/VNC now require a JWT (?token=), validate the session,
vms.console permission and VM ownership before bridging to Proxmox
(previously the LXC terminal gave unauthenticated root shell access).
Frontend ConsolePage passes the token in both WS URLs.
- Fix SSH fallback for `pvecm delnode`: SSHClient now supports password
auth (it previously crashed with TypeError); ProxmoxClient stores the
password for SSH fallbacks and the host port suffix is stripped.
- Add production startup warnings for default ADMIN_PASSWORD and wildcard
CORS_ORIGINS.
- dashboard: use tz-aware utcnow() instead of naive datetime.utcnow().
- crypto: narrow decrypt_value except to InvalidToken and log failures.
- ssh_client: guard the shared connection cache with a lock; make
unknown-host-key rejection opt-in via SSH_REJECT_UNKNOWN_HOSTS.
- logging: send loguru console output to stderr instead of stdout.
- Sync version fallback to 1.5.1; remove one-off refactor scripts.
- Add CODE_REVIEW.md audit report.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Bump VERSION and README badge to 1.5.1
- WIKI: add new 'Logs & Audit' section (page layout, levels, API,
query params, response shape, RBAC, retention) and bump version
in the top note; also extend ToC
- CHANGELOG / CHANGELOG.ru: add v1.5.1 entry covering the missing
LogsPage component fix and the .gitignore collision fix
Backend:
- servers.py: instant connectivity check + VM cache sync after create/update;
broadcast server_added/updated/deleted events via WebSocket
- websocket_manager: add broadcast_event() helper for global fire-and-forget events
Frontend:
- use-nodes: invalidate topology, VM list and resources after server create/update/delete
- use-realtime-sync: new hook with useGlobalRealtimeSync subscribing to server_*
WS events and invalidating relevant React Query caches
- AppLayout: mount useGlobalRealtimeSync globally
Deploy:
- deploy.sh: auto-install pve CLI during main/quick deploy (idempotent, --auto mode)
- Replace dynamic import('@/...') with relative './features/.../File.tsx' in router.tsx
to work around UNLOADABLE_DEPENDENCY error from rolldown resolver in vite 8.0.5
which fails to auto-append .tsx for dynamic imports using path aliases.
fix(deploy): make deploy.sh resilient to common build/runtime failures
- Enable pipefail
- build_images_resilient(): retry docker compose build with --no-cache after first failure
- check_stale_db_volume(): warn when reusing an old Postgres volume whose password
no longer matches a freshly generated .env (typical 'backend in restart loop' cause)
- Add --reset-data flag (combinable with any mode) to wipe the old Postgres volume
- Document new flag in --help
The destroy endpoints returned 400 'Cannot delete a running container.
Stop it first.' when the user clicked Destroy on a running instance.
Since the destroy dialog already requires typing the instance name to
confirm, the action is unambiguously intentional — now both endpoints
issue stop_container/stop_vm with force=True, wait up to 15s for the
status to leave 'running', and only then proceed with deletion.
Three related fixes so login/password/SSH key/IP survive a reinstall:
1. backend/app/api/proxmox/lxc.py — on initial LXC deploy save
cloud_init_user='root' and cloud_init_password=req.password to VMInstance
(previously both were None, so reinstall could not restore root password).
2. backend/app/api/proxmox/async_ops.py — _do_reinstall_sync passes
cached.cloud_init_password to create_lxc_container so the new container
gets the same root password as the original.
3. backend/app/workers/monitoring_worker.py — VM sync worker no longer
overwrites VMInstance.ip_address with NULL when no IPAM allocation
exists for that (server_id, vmid). It only updates the field when
IPAM has a value, otherwise the IP saved at deploy/wizard time is
preserved.
