Expand the Notifications settings tab: per-user preferences (channels,
critical-only email, Telegram chat id + verify, webhook, quiet hours),
SMTP/Telegram test buttons, a test-notification sender with channel
selection, channel status, and the configured Telegram bot username.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New /ipam/tools page surfacing the existing maintenance endpoints: summary
with recent activity, conflict detection, orphan allocations (with cleanup),
unlinked VMs (scan & link), auto-allocation + next-available lookup, and
per-IP history. Linked from the IPAM dashboard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expand the About tab into a full update manager over the existing backend
endpoints: edit the update repository URL, check for updates (showing
changelog/errors), trigger an update with a strong confirmation, and show a
live progress banner with a reset action while an update runs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Surface the existing SDN backend endpoints in a new SDNManager panel on the
node detail page: zones (CRUD with type-specific fields), VNets (CRUD), and
per-VNet subnets (create/delete, optional IPAM network link), plus an apply
action with a pending-changes indicator and an availability notice.
Fix subnet deletion to pass PVE's full subnet id ({zone}-{network}-{mask})
instead of just the CIDR, which the API rejected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Surface the existing HA backend endpoints (cluster HA status, add/remove
resource) in a new HAResources panel on the node detail page. Lists
HA-managed guests with state/group/restart limits, supports adding a guest
to HA (state, group, max_restart/relocate, comment) and removing it.
Shows a cluster-only notice on standalone nodes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add target node and storage overrides to single and bulk restore flows, and
track Proxmox task progress (parse_task_progress in the monitoring worker,
new ProxmoxTask progress column + migration, enriched task API responses).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wire up the existing node-network backend endpoints (list/create/update/
delete + apply/revert staged config) to a new NodeNetworks component on the
node detail page. Supports bridge/bond/vlan/eth interface types with
type-specific fields and surfaces IPAM linkage.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When Proxmox API returns 400 "unable to parse worker upid", the monitoring
worker was getting empty status {}, treating it as running, and retrying
forever every 5 seconds, causing 100% CPU and log spam.
Now when get_task_status() returns empty dict, we immediately mark the task
as failed with exit_status="Invalid UPID" and move on instead of looping.
Fixes production deployment hang.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- get_vm_status and get_container_status were missing require_vm_access(),
allowing any user with vms.view to see any VM status regardless of ownership.
Now users with vms.view.own can only access their own VMs (403 otherwise).
- Downgrade upload-artifact@v4 → @v3: v4 is not supported on Gitea (GHES)
and caused CI failures on every run.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The ssh_keys module was imported in main.py but missing from api/__init__.py,
potentially causing import issues. Added to ensure all API routers are
explicitly declared and available.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
The migrations/ directory was missing from the Dockerfile COPY instructions,
causing ModuleNotFoundError when app.main tries to import and run migrations
during startup. This caused production deployments to fail with:
ModuleNotFoundError: No module named 'migrations'
The automatic migration runner in main.py (line 157) needs this directory to:
1. Detect database schema changes
2. Run pending migrations
3. Initialize default admin user
Fixes production deployment failure when containers start.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- restore_vm/restore_lxc: add force=True param (needed for in-place overwrite)
- QEMU restore: remove `restore: 1` from params (breaks Proxmox API — restore
is triggered by archive presence alone, unlike LXC where restore: 1 required).
This fixes both single and bulk QEMU restores.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- TemplatesPage: cap auto-import dialog at sm:max-w-md so it no longer
spans the full screen (bare DialogContent defaults to near-full width).
- InstancesPage: the server (multi-server/cluster) filter wrongly reused
the `instances.all_nodes` i18n key, so it rendered "Все узлы" identically
to the node filter. Add a dedicated `instances.all_servers` key (RU/EN)
and use it, so the two filters read "Все серверы" / "Все узлы".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Critical security and robustness fixes from a code audit:
- WS terminal/VNC now require a JWT (?token=), validate the session,
vms.console permission and VM ownership before bridging to Proxmox
(previously the LXC terminal gave unauthenticated root shell access).
Frontend ConsolePage passes the token in both WS URLs.
- Fix SSH fallback for `pvecm delnode`: SSHClient now supports password
auth (it previously crashed with TypeError); ProxmoxClient stores the
password for SSH fallbacks and the host port suffix is stripped.
- Add production startup warnings for default ADMIN_PASSWORD and wildcard
CORS_ORIGINS.
- dashboard: use tz-aware utcnow() instead of naive datetime.utcnow().
- crypto: narrow decrypt_value except to InvalidToken and log failures.
- ssh_client: guard the shared connection cache with a lock; make
unknown-host-key rejection opt-in via SSH_REJECT_UNKNOWN_HOSTS.
- logging: send loguru console output to stderr instead of stdout.
- Sync version fallback to 1.5.1; remove one-off refactor scripts.
- Add CODE_REVIEW.md audit report.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Bump VERSION and README badge to 1.5.1
- WIKI: add new 'Logs & Audit' section (page layout, levels, API,
query params, response shape, RBAC, retention) and bump version
in the top note; also extend ToC
- CHANGELOG / CHANGELOG.ru: add v1.5.1 entry covering the missing
LogsPage component fix and the .gitignore collision fix
Backend:
- servers.py: instant connectivity check + VM cache sync after create/update;
broadcast server_added/updated/deleted events via WebSocket
- websocket_manager: add broadcast_event() helper for global fire-and-forget events
Frontend:
- use-nodes: invalidate topology, VM list and resources after server create/update/delete
- use-realtime-sync: new hook with useGlobalRealtimeSync subscribing to server_*
WS events and invalidating relevant React Query caches
- AppLayout: mount useGlobalRealtimeSync globally
Deploy:
- deploy.sh: auto-install pve CLI during main/quick deploy (idempotent, --auto mode)
- Replace dynamic import('@/...') with relative './features/.../File.tsx' in router.tsx
to work around UNLOADABLE_DEPENDENCY error from rolldown resolver in vite 8.0.5
which fails to auto-append .tsx for dynamic imports using path aliases.
fix(deploy): make deploy.sh resilient to common build/runtime failures
- Enable pipefail
- build_images_resilient(): retry docker compose build with --no-cache after first failure
- check_stale_db_volume(): warn when reusing an old Postgres volume whose password
no longer matches a freshly generated .env (typical 'backend in restart loop' cause)
- Add --reset-data flag (combinable with any mode) to wipe the old Postgres volume
- Document new flag in --help
The destroy endpoints returned 400 'Cannot delete a running container.
Stop it first.' when the user clicked Destroy on a running instance.
Since the destroy dialog already requires typing the instance name to
confirm, the action is unambiguously intentional — now both endpoints
issue stop_container/stop_vm with force=True, wait up to 15s for the
status to leave 'running', and only then proceed with deletion.
Three related fixes so login/password/SSH key/IP survive a reinstall:
1. backend/app/api/proxmox/lxc.py — on initial LXC deploy save
cloud_init_user='root' and cloud_init_password=req.password to VMInstance
(previously both were None, so reinstall could not restore root password).
2. backend/app/api/proxmox/async_ops.py — _do_reinstall_sync passes
cached.cloud_init_password to create_lxc_container so the new container
gets the same root password as the original.
3. backend/app/workers/monitoring_worker.py — VM sync worker no longer
overwrites VMInstance.ip_address with NULL when no IPAM allocation
exists for that (server_id, vmid). It only updates the field when
IPAM has a value, otherwise the IP saved at deploy/wizard time is
preserved.
Previously the reinstall endpoint required cached.template_id (clone-from-VM-
template flow), so LXC instances created via the wizard from an OS template
file (e.g. local:vztmpl/debian-13-...tar.zst) returned 'VM has no associated
template; reinstall is not available'.
Now reinstall works in two modes:
1) clone-from-template (existing): VM/LXC with cached.template_id pointing
to OSTemplate.vmid
2) ostemplate-file (new, LXC only): cached.template_name like
'storage:vztmpl/...tar.zst'. Reinstall stops, deletes, then re-creates
the container with the same VMID using create_lxc_container, preserving
network config, storage, rootfs size, swap, features, ssh_keys, etc.
pulled from the previous container config + VMInstance cache.
Ubuntu 24.04 / Debian 13 ship with systemd >= 255 which requires
features=nesting=1 in unprivileged LXC containers. Without it,
container start emits 'WARN: Systemd 255 detected. You may need
to enable nesting.' Now nesting is enabled by default unless the
caller explicitly passes a 'features' string.
proxmoxer URL-encodes parameters automatically. The extra urllib.parse.quote()
call was double-encoding SSH keys, causing Proxmox to reject them with
'500 Internal Server Error: SSH public key validation error'.
Now passes the SSH key as-is (only stripped of whitespace), letting proxmoxer
handle encoding.
Backend:
- Add DeployTask.kind column ('deploy'|'reinstall'|'clone'|'change_password')
+ Migration 23: ALTER TABLE deploy_tasks ADD kind, drop NOT NULL on template_id
- Update DeployTask.to_dict() with kind-aware Russian descriptions
- New backend/app/api/proxmox/async_ops.py with three workers:
_do_reinstall_sync, _do_clone_sync, _do_change_password_sync
All run on shared _deploy_executor thread pool from templates.py and
report progress through _update_deploy_task (DB + WebSocket broadcast)
- Rewrite five vms.py endpoints to return 202 + DeployTaskStartResponse:
POST /vm/{vmid}/clone, /container/{vmid}/clone,
POST /vm/{vmid}/reinstall,
POST /vm/{vmid}/change-password, /container/{vmid}/change-password
Frontend:
- DeployTask: add 'kind' and 'server_id' fields
- useCloneInstance/useReinstallInstance/useChangePassword now return
AsyncTaskResponse {task_id, status, name}; remove invalidateQueries
- InstanceActionDialogs: each onSuccess pushes task to deploy-tasks-store
with appropriate kind, shows 'launched in background' toast
- InstancesPage:
* ghostRows only for kind in {deploy, clone}, deduped by (server_id, vmid)
* reinstall / change_password tasks shown as inline overlay (badge + ring)
on the existing VM row's status column
- AttributeError: OSTemplate has no 'template_vmid' field; the actual column is 'vmid'.
- Use OSTemplate.get_vmid_for_node() to support cross-node replicated templates,
falling back to source_node/vmid otherwise.
- VMInstance.memory is stored in bytes, but Proxmox config expects MB.
Specific endpoints (clone, reinstall, change-password) were being intercepted
by the generic /{action} handler because they were registered AFTER it.
Fix: move CloneRequest, ChangePasswordRequest models, _resolve_server,
_get_client_or_503 helpers, and all 5 specific endpoint functions BEFORE
the generic @router.post('.../{action}') handlers.
Remove duplicate definitions from the old 'Additional Instance Operations'
section at the end of the file.
- Add wait_for_containers() function that checks container health status
- Commands now wait up to 120 seconds for all containers to become healthy
- Improved error handling with better error messages
- Frontend container waits for app healthcheck before starting
- Users see clear progress messages instead of hanging indefinitely
- Fixes pve start and pve restart hanging issues
- Add server filter dropdown (populated dynamically from loaded VMs)
- Add node filter dropdown (narrows to nodes of selected server)
- Both filters persisted in URL params and restored on reload
- Toolbar restructured into 2 rows: filters row + actions row
- Responsive breakpoints: ≤900px text labels hidden, ≤768px 2-per-row,
≤480px full-width filters, stats hidden on mobile
- Snapshots toolbar migrated to inline flex (no legacy class dependency)
- Update VERSION, CHANGELOG, README, WIKI to v1.3.1
- Context menu now shows Terminal (xterm.js) for lxc type and VNC Console for qemu
- Added openTerminalConsole() / connectTerminalConsole() / closeTerminalModal() functions
- Added terminalModal HTML alongside existing vncModal
- Backend endpoints /api/{server_id}/container/{vmid}/terminal and
/proxmox/ws/terminal/{server_id}/{node}/{vmid} already existed and are ready
Root cause of 'Connection closed' / VNCAuth failure:
- vncproxy was called without generate-password=1
- vnc_data.password was None → noVNC sent empty DES-encrypted challenge → Proxmox rejected
Fix:
- Add generate-password=1 to both qemu and lxc vncproxy requests
- If Proxmox returns password field (Proxmox 8.x VNCAuth): use it
- If not (Proxmox 9.x NoAuth): fall back to ticket as password
- Add diagnostic logging (password_len, has_generate_password)
Remove the 'onFirstMessage' hack where backend sent VNC password as
first text WebSocket message and frontend passed the already-open WS
to noVNC's RFBClass. This caused RFB handshake failures because noVNC
couldn't properly manage a WebSocket it didn't create.
Changes:
- Backend: remove send_text(password) before proxy start
- Backend: improve proxy error logging from debug to info level
- Frontend (virtual_machines.html, instance_detail.html): pass WebSocket
URL string to RFBClass constructor - noVNC creates and manages its own
WebSocket connection, allowing proper RFB protocol handshake
