Critical fixes:
- init_admin.py: replace hardcoded admin123 password with ADMIN_PASSWORD env var
- proxmox_client.py, models.py: change verify_ssl default from False to True
- api/proxmox.py: use server.verify_ssl instead of hardcoded verify=False in websocket handler
- ssh_client.py: replace AutoAddPolicy (MITM-vulnerable) with WarningPolicy + load_system_host_keys
Security hardening:
- main.py: add security headers middleware (CSP, X-Frame-Options, HSTS, X-XSS-Protection, Referrer-Policy)
- main.py: fix CORS — allow_credentials=True is incompatible with allow_origins=["*"]; read origins from CORS_ORIGINS env var
- auth.py, logging_middleware.py: validate X-Forwarded-For/X-Real-IP to prevent IP spoofing
Performance:
- monitoring_worker.py: wire up cleanup_expired_connections() as hourly scheduled job (was defined but never called)
Code quality:
- logging_service.py: move `import json` from inside function to module level
- ssh_client.py, proxmox_client.py, api/proxmox.py, rbac/migration.py, task_queue_service.py: replace all bare `except:` with `except Exception:`
- .env.example, config.py: document ADMIN_PASSWORD and CORS_ORIGINS settings
https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R
- Updated `backend/app/main.py`: Added automatic execution of `/app/init_admin.py` during application startup to create default admin account
- Modified `.gitignore`: Removed `.env` from ignored files to ensure environment configuration is available during deployment
- Enhanced `lifespan` context manager: Integrated admin initialization with proper error handling and logging
- Improved startup reliability: Ensures default credentials are provisioned regardless of deployment environment
The fix ensures that new deployments automatically set up the default admin user, resolving widespread issues with missing login credentials. The change is robust, idempotent, and logs all initialization steps for debugging.
- Add repository URL setting to panel_settings table
- Support for multiple git hosting providers (GitHub, Gitea, GitLab, etc.)
- UI selector for predefined repositories (git.tzim.uz and github.com) or custom URL
- Update service now uses repository from database settings
- API endpoints: GET/PUT /api/updates/repository
- Migration for default repository setting
- Translations for repository selection UI
- Add notify_update_available() method to NotificationService
- Add translations for update notifications (ru/en)
- Add 'update' type to default notification types
- Add check_for_panel_updates() background task (runs every 6 hours)
- Notifications include link to settings page for easy update access
- Prevent duplicate notifications for same version
- Added IPAM release in sync_vm_cache when VM is no longer found on Proxmox
- Works when VMs deleted through Proxmox UI (not through panel)
- Logs released IPs count in sync summary
- Also includes server availability monitoring with notifications
- Removed complex cluster detection logic
- Simple global deduplication by node name is sufficient
- Works correctly even when nodes temporarily disconnect/reconnect
- Each node name appears only once regardless of cluster state
- Changed cluster detection to use sorted node names as cluster key
- Global deduplication by node name prevents duplicates
- Works correctly when cluster servers have different IPs
- Changed logic to process ALL nodes from cluster, not just the first one
- Added processedClusterIPs set to avoid duplicate processing of cluster servers
- Now clusters show all nodes (pve1, pve2, pve3) instead of duplicating first node
- Fixed issue where node names were incorrect after node reconnection
- Added color: var(--text-primary) to unlinked allocations IP in ipam_dashboard.html
- Added color: var(--text-primary) to IP address column in logs.html
- Prevents black text on dark theme
- Modified save_vm_instance to check for soft-deleted records before insert
- If a soft-deleted record exists with same server_id+vmid, restore and update it
- Prevents 'duplicate key value violates unique constraint' errors
- Changed textContent to innerHTML for proper HTML icon rendering
- Fixed VNC modal titles in instance_detail.html, proxmox_vms.html, proxmox_server_detail.html
- Fixed command execution output icons in instance_detail.html
- Fixed settings and reinstall modal titles in proxmox_server_detail.html
- Added color styles to IPv4/IPv6 network interface icons
- Fix field names in frontend: ipam_ip -> ip_address, ipam_gateway -> gateway
- Pass ipam_network_id to deploy API for proper network mask lookup
- Extract network mask from IPAM network CIDR (e.g., /24 from 10.10.10.0/24)
- Auto-fetch gateway from IPAM network if not provided
- Add detailed logging for VM IP configuration
- Remove hardcoded /24 mask, use actual network mask from IPAM
This fixes the issue where VMs were getting DHCP instead of the
static IP allocated from IPAM.
- Add ssh_public_key column to User model for storing SSH keys
- Add database migration for ssh_public_key column
- Add SSH key section in user profile settings with validation
- Auto-inject user's SSH key when deploying VMs from templates
- Auto-inject user's SSH key when creating LXC containers
- Support for both regular and smart LXC creation endpoints
- Add i18n translations for SSH key UI (ru/en)
- Validate SSH key format (ssh-rsa, ssh-ed25519, ecdsa-sha2, ssh-dss)
Users can now save their SSH public key in Settings -> Account,
and it will be automatically added to any VM or LXC container
they create, enabling passwordless SSH access.
- Add password field to UserUpdate schema for password change on edit
- Implement password validation in update_user endpoint
- Add i18n translations for password validation errors (ru/en)
- Update SecurityService.validate_password to support language parameter
- Add GitHub icon and repository name 'pvemanager' to header button
- Fix internal server error when updating user password
- Clean up hardcoded translations in frontend
