PegaProx 1.0.2

A security + maintenance release on top of 1.0.1.

🔒 Security

• Console / per-VM access control (CVE) — a Client-Portal user scoped to specific VMs via a VM-ACL could reach any VM on a cluster their tenant owns (console + all per-VM operations). The per-VM check now enforces the ACL / pool scope even on tenant-owned clusters. Reported by Jörg Morasch (SYMPLASSON Informationstechnik GmbH).
• Broad authorization audit — the same object-level (BOLA / CWE-639) gap is closed across bulk + cross-cluster migrate, PBS restore / protect / notes / prune, migration history and the HA plugin; and tenant-delegate privilege-escalation paths are closed (a delegate can no longer grant permissions it does not hold, reset a higher-privileged same-tenant peer's password / 2FA, or keep console/shell access after being disabled).
• SSRF DNS-rebinding (GHSA-hmcf-9q7f-vx35) — the shared outbound-URL guard validated the host but did not pin it, so a low-TTL rebinding domain could pass the check and connect to an internal address. The validated IP is now pinned for outbound requests. Reported by @senti-man.

🔑 Auth

• OIDC no longer races itself to a logout mid-callback in Firefox (#681).
• OIDC group → role mappings apply custom roles (#682).

🐛 Fixes

• Adding a 2FA cluster — a Proxmox account with two-factor auth now shows a clear, localized message (add with an API token, or temporarily disable 2FA) instead of a silent "connected then offline". Localized in all 8 UI languages (#683).
• SMART health now shows for HDDs without a wearout value (#690).
• Snapshot overview gained multi-select checkboxes + bulk delete (#696).
• EFI / TPM disks accept a raw / qcow2 format, like Proxmox (#678).
• The VM/CT config modal no longer reload-loops (#698); the backup-verification modal no longer overlaps the PBS UI (#701).

✨ Features

• Rolling updates reboot a node only when needrestart -p reports a required restart (#694). PR by @gyptazy.
• Internal / private ACME CA is supported opt-in (#685).
• Cloudflare DNS-01 is a first-class Let's Encrypt provider (#687). Thanks @brngates98.
• Hardware-health rollups are based on live sensor / SEL state and name the contributor (#686).
• The prebuilt VM / LXC appliances ship sshpass, so password-auth SSH works out of the box (#688).
• Self-update is install-method aware (apt / docker / source).

✅ Quality

555 automated tests (authorization, integration, SSRF, SSL-bootstrap, hardware, i18n) run on every PR. The whole branch was re-audited and end-to-end verified before release.

Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚

💛 Sponsors

PegaProx is AGPL-3.0 and built in the open. Huge thanks to our Platinum sponsors who keep it moving:

💎 Platinum

• netwolk GmbH
• Expertize
• Netzware
• Occentus Network

PegaProx 1.0.1

A maintenance + feature release on top of 1.0.

🌏 Languages

• Simplified Chinese (简体中文) — the web UI is now available in Simplified Chinese. Thanks @ranydb.

🖥️ Console

• SPICE is offered in every VM console entry point — a downloadable virt-viewer .vv for audio / USB / multi-monitor sessions, alongside the built-in noVNC.

🔒 Security

• Another Aikido penetration-test pass closed a set of authorization / IDOR gaps: power- and cost-rate reads are now scoped to the caller's clusters (a scoped API token can no longer enumerate every cluster's rates); the client portal's reboot action is gated on vm.restart instead of vm.start; and further authz / validation / SSRF invariants from batches 1–2 are enforced.
• The CIS SSH-hardening control no longer disables TCP forwarding — the built-in VNC console tunnels through it — and applied hardening controls are now selectable for rollback.

🐛 Fixes

• Container disks — adding a disk to a container now targets a container mountpoint (mpN) instead of a QEMU disk key, and never overwrites an occupied slot.
• Unlock — a locked VM/CT can be unlocked even on token-authenticated clusters (falls back to qm / pct unlock over SSH).
• OIDC keeps the full preferred_username instead of truncating at @ (#486).
• RBAC — the storage / snapshot / backup / update action bars follow their backend permissions (#644).
• Scheduled rolling + maintenance updates evacuate local disks by default (#630 / #629).
• Node temperature parsing falls back to plain sensors text when JSON is unavailable (#601).
• In-band BMC reads fall back key → agent → password, so password-only nodes still report hardware health (#609).
• ESXi / cross-hypervisor migration lists route to their own handlers (#654).

📦 Platform

• ARM64 / aarch64 build artifacts are now published (#674). Thanks @gyptazy.
• cryptography is pinned to 50 and pyOpenSSL to 26.4 to keep the vulnerable 49 line out (#650).

✅ Quality

438 automated tests (authorization, integration, SSL-bootstrap, hardware, i18n) run on every PR, and the whole branch was re-audited before release.

Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚

💛 Sponsors

PegaProx is AGPL-3.0 and built in the open. Huge thanks to our Platinum sponsors who keep it moving:

💎 Platinum

• netwolk GmbH
• Expertize
• Netzware
• Occentus Network

PegaProx 1.0

PegaProx 1.0 🎉

PegaProx is out of Beta. Started in September 2025, the whole 0.9.x line is now hardened and rounded out into the first stable release.

What's in the box

Manage many Proxmox VE (and XCP-ng) clusters from one modern web UI:

• Fleet management — VM/CT lifecycle, live console (VNC / SSH / SPICE), snapshots & snapshot policies, cloud-init — across many clusters at once, in a dense Corporate layout or the card-grid Cloud (Preview) layout (full parity).
• Migration — near-zero-downtime ESXi → Proxmox (V2P) and XCP-ng → Proxmox, with an opt-in cutover-confirmation gate.
• HA & rolling updates — HA monitoring, node evacuation with a RAM pre-flight, and rolling cluster updates.
• Storage & Ceph — Ceph management, StarWind starlvm, and a cross-node datastore browser.
• Cross-cluster — load balancing, a replication overview, and cross-cluster EVPN vNets (SDN).
• Backup & DR — PBS reporting, backup-SLA tracking, and re-runnable Site-Recovery / DR drills.
• Access & security — LDAP, OIDC (Entra ID / Keycloak / Google), enforced 2FA + WebAuthn/FIDO2, fine-grained RBAC with per-VM ACLs and tenant isolation, an encrypted-at-rest database (SQLCipher), and a quota-bound Client Portal.
• Observability & compliance — temperature & long-term metric history, a Prometheus exporter, SIEM & config-drift, and compliance mapping (CIS, ANSSI / DR / RGS, CMMC / NIST).

---

New in 1.0 (since 0.9.15)

🔒 Security

A full post-release penetration test closed:

• a BMC-credential exfiltration on the test-BMC endpoint,
• an ESXi/XCP password ever landing on a process argv (now passed over stdin / SSHPASS),
• a BMC/Redfish SSRF oracle, and
• an SSH-amplification path in the Ceph mirror views.

The TLS bootstrap now fails closed (#633): if TLS is the intended posture and a usable certificate can't be loaded or generated, PegaProx refuses to start with an actionable error instead of silently serving plaintext on the TLS port. Thanks @SpyrosPsarras for the report.

✨ Features

• Cross-cluster EVPN vNets (#612) — vNets spanning multiple clusters in the same AS: create / edit / membership / drift-detection, with optional reconcile and drift → alert fan-out. Thanks @cybrwerk.
• V2P / ESXi cutover confirmation (#562) — migrations gain an opt-in "wait for confirmation before cutover" gate. Thanks @ajoergensen.
• Sortable Top Resources (#621) — the Top Resources table now sorts by any column. Thanks @ccesario.
• Per-schedule reboot timeout (#630) — scheduled rolling updates carry their own reboot/online timeout instead of a fixed 10 minutes.

🐛 Fixes

• Nested resource pools (#634) — hierarchical pools now show their members and VM counts. Thanks @prasannak81.
• Multi-disk ESXi → PVE to classic LVM (#636) — no longer aborts when a target volume already exists. Thanks @shepart.
• XCP-ng → PVE resume (#546) — transfers resume by HTTP range instead of failing on a broken pipe.

✅ Quality

• The SSL-bootstrap, authorization and integration test suites run on every PR.

Thank you to everyone who filed, fixed and sponsored along the way. 💚

---

💛 Sponsors

PegaProx is AGPL-3.0 and built in the open. Huge thanks to the sponsors who keep it moving:

💎 Platinum

• netwolk GmbH
• Expertize
• Netzware
• Occentus Network

🥇 Gold

• SocialFurr

🥈 Silver

• uvensys GmbH
• Datimo
• TechniData AG Limited

🥉 Bronze

• IDK Manager
• LINET Services GmbH

Want to help keep PegaProx going? → https://opencollective.com/pegaprox 💚

🛠️ Commercial Support

Need SLA-backed help running PegaProx in production? Commercial support is now available — details at → https://pegaprox.com/sponsors.html

---

Full changelog: v0.9.15...v1.0

v0.9.15 — security hardening, Cloud parity & temperature monitoring

v0.9.15 — security hardening, Cloud-layout parity & temperature monitoring

A big one. The headline is a broad security-hardening pass (a full CodeAnt + pentest sweep, re-implemented by hand), the Cloud (Preview) layout reaching full feature parity with the Corporate layout, and per-host temperature monitoring gaining history + alerting — plus a stack of scale/perf work and a real integration-test harness.

⚠️ Beta. As always, snapshot / back up before upgrading.

🔒 Security & hardening (the big theme)

A broad authorization + input-validation sweep across the API surface:

• Tenant isolation / IDOR / BOLA — per-VM ACL enforcement on VM detail/action/firewall routes; tenant-scope gates on VMware, PBS, cluster, DR-drill, history, alerts and cross-hypervisor-migration reads so one tenant can't see another's resources.
• SSRF — outbound guards on OIDC jwks_uri, template image_url, and the ACME chain (redirect + second-order re-validation).
• RCE — ISO/template filenames and ESXi VMDK path components are validated/quoted before they ever reach a root SSH shell.
• Web — CSRF check hoisted, HTTP-response-splitting closed at the redirect handlers, unsafe-eval dropped from the CSP.
• Logs & secrets — tainted-log-line sanitisation (CWE-117), vnc-ticket redaction in URL logs, SIEM secret masking, session invalidation on admin password reset.
• TLS — VNC/console TLS verification now honours the per-cluster ssl_verify flag (7 sites).
• Deps — Flask 3.1.3 (CVE-2026-27205), PyJWT 2.13 (5 PyJWKClient CVEs), pyasn1 ≥ 0.6.4, pytest 9; rollback path-containment (CWE-22).
• License — adds an AGPL §7(b) attribution term (NOTICE + portal footer).

☁️ Cloud (Preview) layout — full parity

The Cloud layout now mirrors Corporate end to end: complete SDN CRUD, Plugins / Scripts / Schedules, Config Drift / SIEM / Alert Channels / Update Manager, real HA / Networks / Storage / Site-Recovery components, a Reports group (Insights, Costs, Power & Carbon, API Health), Automation (Snapshot Policies, Templates), Topology + Compliance, and the real pegasus logo.

✨ Features

• Temperature monitoring — history + alerting (#601) — the per-node lm-sensors panel now stores the hottest temperature over time (sparkline + min/max/avg), and there's a new temperature alert metric (per node, or cluster-wide hottest) in °C with absolute thresholds, wired into the existing alert/webhook pipeline. Thanks @jostrasser for the ask.
• Show VM IDs in the sidebar — opt-in via My Profile, translated in all 7 languages.

⚡ Performance & scale

• Sidebar filter debounce + native windowing so 1000+-VM trees stay smooth.
• TTL-cached VM-ACL and cluster-topology lookups; capped concurrent syslog TCP handlers.

✅ Quality

• A full-stack integration-test harness (real app + faked managers) + 166 blueprint tests, security-invariant unit tests, and a route-authz contract test — now run on every PR in CI.

🤝 Community

• PR #617 — snapshot-name validation against PVE's rules. Thanks @MatrixNeoKozak! 🙌

---

💛 Sponsors

PegaProx is AGPL-3.0 and built in the open. Huge thanks to the sponsors who keep it moving:

💎 Platinum

• netwolk GmbH
• Expertize
• Netzware
• Occentus Network

🥈 Silver

• TechniData AG Limited — welcome aboard! 🎉

Want to help keep PegaProx going? → https://opencollective.com/pegaprox 💚

Full changelog: v0.9.14.1...v0.9.15

v0.9.14.1 — migration aio, maintenance capacity pre-check & portal teardown

v0.9.14.1 — migration aio, a maintenance capacity pre-check, portal teardown & security

A focused follow-up to v0.9.14: three new features, two fixes, dependency-security hardening, and a warm welcome to a new Platinum sponsor.

✨ Features

• Per-disk aio mode in the migration wizard (#598) — the ESXi→PVE wizard now lets you pick the QEMU async-IO backend (threads / native / io_uring) for the migrated target disk. Leave it on default and nothing changes (PVE's io_uring).
• Maintenance-Mode RAM pre-check (#611) — before you evacuate a node, PegaProx simulates the migration and warns you (non-blocking) if it would push a remaining node past ~90 % memory, or if the cluster simply lacks the headroom. You can always proceed — it's a heads-up, not a hard block.
• Client Portal self-service teardown (#556) — the "down" half of self-service: quota-bound portal users can now destroy their own CTs/VMs, not just create them. Opt-in per hoster (allow_destroy), gated strictly to the caller's own guests, with a type-the-exact-name confirm and a full audit trail.

🐛 Fixes

• VM wizard OVMF quick-templates (#607) — creating a Windows 11 / 2022 VM from a quick template no longer fails with efidisk0: unable to parse volume ID ':1' when the EFI-storage field is left blank; it now falls back to the VM's main storage.
• Reverse-proxy log noise + console URLs (#614) — behind a reverse proxy the container no longer spams TLS-handshake noise (Invalid HTTP method '\x16\x03\x01…') into the logs, and PEGAPROX_BEHIND_PROXY=true now also routes the VNC/SSH console WebSockets through the proxy — no separate Settings toggle required.

🔒 Security & hardening

• Dependency floors raised to clear Aikido findings: cryptography 49 + fido2 2.2.1, pillow 12.3, setuptools 83, requests 2.34 — all as >= floors so future patch bumps roll in cleanly.
• The remaining request-controlled Site-Recovery log lines are sanitised (CWE-117). A pre-release Aikido scan came back clean (only known, risk-accepted findings).

Full documentation: https://docs.pegaprox.com

❤️ Sponsors

PegaProx lives entirely from sponsorships and donations. Huge thanks to our sponsors — and especially our 💎 Platinum partners:

• Netwolk GmbH
• Expertize
• Netzware
• Occentus Network — welcome aboard! 🎉

Want to support PegaProx? Become a sponsor. Every euro keeps the lights on. 💛

v0.9.14 — StarWind shared storage, ProxLB tags + more

v0.9.14 — StarWind shared storage, ProxLB-tag placement, and a batch of features, fixes & performance work

✨ Features

• StarWind VSAN LVM (starlvm) storage — PegaProx now recognises, creates, edits and rescans StarWind's starlvm type as first-class shared block storage, with thin-provisioned snapshots on a shared LUN. A one-click installer deploys the StarWind SAN plugin across your cluster nodes over SSH (signed apt source, admin-gated). → Docs
• ProxLB VM tags drive placement (#426) — an opt-in, per-cluster option that derives affinity / anti-affinity / ignore / pin rules from ProxLB-style VM tags (plb_affinity_*, plb_anti_affinity_*, plb_ignore, plb_pin_<node>), feeding the existing balancer.
• Extra CPU Flags editor (#410) — a tri-state (+enabled / −disabled / default) toggle panel in the VM Hardware tab for the standard Proxmox CPU flag set.
• Site Recovery — Test Failover NIC isolation (#413) — test-failover clones can be brought up with every NIC disconnected so a DR test can't collide with production IPs; planned / failback now fails fast with clear guidance when the target VMID is already replication-seeded.
• Client Portal self-service containers (#556) — portal users can create LXC containers within their tenant quota, from an admin-curated template / target set.
• Ceph metrics in the Prometheus exporter (#540) — pegaprox_ceph_health_status, pegaprox_ceph_osd_up, pegaprox_ceph_osd_in.
• French compliance frameworks — Diffusion Restreinte (II 901) and RGS, both mapped to the ANSSI-BP-028 control set.
• ESXi migration wizard — a non-root ESXi SSH user (#602) and a VLAN tag on the target NIC (#598).
• LXC OS type + IP are now shown in the VM detail views (#560).

🐛 Fixes

• Single-node maintenance no longer hangs ~5 minutes when there is no other node to evacuate to.
• The datastore browser no longer shows 0 bytes for a disk whose VM lives on another node (shared/SAN storage).
• The task bar attributes a VNC console session to the PegaProx user who opened it; blank Windows console previews get an RFB frame-grab fallback.
• Cross-cluster Site-Recovery failover maps source→target storage correctly (it previously fell back to the default target storage on every run).
• Offline / air-gapped browsers auto-latch and no longer route cluster API calls through an ambient proxy; the update check no longer spins.

🔒 Security & hardening

• The VMs-backup-status endpoint is now scoped to the caller (cluster access + per-VM ACL) — closes a read BOLA.
• The Site-Recovery pre-flight sanitises the plan VM name before it reaches any log line (CWE-117 log-injection). A pre-release Aikido security scan came back clean.

⚡ Performance

• Real-time SSE broadcasts are de-duplicated, the heavy poll aggregates gained short-TTL caches, datacenter/status is parallelised, and the unused 3 MB @babel/standalone bundle was dropped from production — the WebUI is noticeably snappier at scale.

Full documentation: https://docs.pegaprox.com

❤️ Sponsors

PegaProx lives entirely from sponsorships and donations. Huge thanks to our sponsors — and especially our 💎 Platinum partners:

• Netwolk GmbH
• Expertize
• Netzware

Want to support PegaProx? Become a sponsor. Every euro keeps the lights on. 💛

v0.9.13.3 — Snapshot schedules, Replication overview + fixes

v0.9.13.3 — flexible snapshot schedules, a replication overview, and a stack of fixes

🌡️ A note from the team: we're in the middle of a brutal heatwave here (40–42 °C+), so the PegaProx team is moving a little slower than usual — issue and PR turnaround may lag a bit until it cools down. We're fully blaming the weather. Thanks for your patience while we (and our CPUs) try not to melt. 🫠

✨ Features

• Flexible snapshot schedules (#586) — snapshot policies now support cron (a real 5-field expression), monthly (a day-of-month, clamped to the month length so day 31 still fires on Feb/Apr), and once (a single run at a datetime), on top of hourly / daily / weekly. "Run now" works on a disabled policy, and a new prune-only mode sweeps retention without creating new snapshots.
• Replication overview tab (#430) — a single Automation → Replication tab showing every replication job's status: local PVE replication across all connected clusters plus all cross-cluster jobs, with OK / failed / never-run health, KPI tiles and CSV / PDF export.

🐛 Fixes

• One slow or unreachable cluster no longer wedges the whole UI (#594) — the all-clusters overview runs concurrently with per-request timeouts, slow clusters back off, and the UI no longer fast-polls when SSE drops.
• The migration wizard now honours an explicit virtio disk bus (#597) — it was silently falling back to SCSI.
• A node no longer stays stuck (Updating) in the sidebar after a successful node update (#592).
• Pool / resource-pool group grants match case-insensitively, so LDAP/AD group users see their VMs (#555).
• Per-cluster storage figures refresh proactively now (both the selected cluster and sidebar-expanded clusters) instead of only on select/expand.
• Failed backups/tasks render red, not green (#590); PVE-native tags surface in Tags & Labels (#585); the PBS update-log render is guarded against non-string lines (#584); Active Sessions / audit log show the real client IP behind a reverse proxy (#583); boot-order edits no longer send an empty config to PVE (#580); SSO (OIDC/Entra) admins can re-authenticate for sensitive ops (#587).

🔒 Security & hardening

• The DR plan name is sanitised before it reaches any log/audit line (CWE-117 log-injection).
• The CIS hardening profile now bounds the logs it enables — journald SystemMaxUse, auditd max_log_file/num_logs, and process-accounting rotation — so a hardened node can't fill /var/log (#595).

❤️ Sponsors

PegaProx lives entirely from sponsorships and donations. Huge thanks to our sponsors — and especially our 💎 Platinum partners:

• Netwolk GmbH
• Expertize
• Netzware

Want to support PegaProx? Become a sponsor. Every euro keeps the lights on. 💛

v0.9.13.2 — Aikido full Code and assesment Audit + Bugfixes

PegaProx Beta 0.9.13.2 — a security-audit hardening pass plus a batch of fixes and UI polish on top of 0.9.13.1.

🔒 Security (audit response)

A third-party security audit flagged a set of authorization gaps. These were reviewed by hand and closed:

• API-token object-level scoping — object-level checks (user_can_access_vm & co.) now honour a token's scoped role, floored to the owner's current role, instead of the owner's stored role. An admin-owned, viewer/user-scoped token can no longer bypass per-VM/per-cluster checks.
• Closed object-level access gaps — cluster-access gate on PBS backup restore; per-VM authorization on the VMware console-ticket endpoint; cluster-access checks on the VMware → Proxmox migration routes (and no more leaking other tenants' nodes/storage in the plan); per-VM vm.snapshot checks on snapshot-policy create/update/run (legacy policies keep running unfiltered).
• Multi-tenant isolation + role hierarchy in user & role administration — a tenant-scoped admin is confined to their own tenant, and nobody can create or assign a role above their own.
• Per-action permissions on scheduled actions — scheduling a stop/reboot/snapshot now requires the matching permission, not just vm.start.

🛠️ Fixes

• ESXi migration (vmkfstools clone): handles VMDK/folder names with spaces, and disks spread across multiple datastores (#561).
• Cross-cluster replication: "keep replica" now actually skips teardown on delete (#564); a job can be deleted when its cluster is gone (#563).
• Resource-pool visibility no longer pins an empty/errored membership build for the full TTL (#555).
• Load balancing won't migrate a VM to a node that can't fit its RAM.
• LXC detail shows OS type + IP (#560); QEMU guest-agent status no longer flickers.
• Language selector moved to user prefs + CSV export of cluster subscriptions, with a formula-injection guard (#558).
• update.sh aborts and restores on a partial fallback download (#168).

🎨 UI

• Corporate layout visual refresh — rounded cards, KPI accent chips, pill capacity bars, status dots, consistent density; Reports sub-nav aligned with the other sections.
• VNC screenshot preview in the corporate Console tile (uses qm screendump, no console-open task spam).

---

❤️ Sponsors

PegaProx lives entirely from sponsorships and donations. Huge thanks to our sponsors — and especially our 💎 Platinum partners:

• Netwolk GmbH
• Expertize
• Netzware

Want to support PegaProx? Become a sponsor. Every euro keeps the lights on. 💛

v0.9.13.1 — Cross-cluster replication mapping & a security pass

🔁 Cross-cluster replication mapping, near-zero-downtime ESXi migration & a security pass

New

• Per-NIC bridge mapping for cross-cluster replication (#532) — a multi-NIC VM now keeps each card on its own destination bridge instead of all of them landing on the single configured one.
• Pin the replica VMID + optional teardown (#552) — set the target VMID for a replication job (keep IDs in sync across both sides) and optionally remove the replica VM when you delete the job, instead of leaking a fresh VM on every recreate.
• VDDK-free near-zero-downtime ESXi → Proxmox migration (vmkfstools_clone) is now the default/recommended transfer mode and the first thing auto tries — ~3–4 s cutover, with live progress on thick-LVM / raw-RBD targets.
• Per-tenant resource quotas + chargeback rollup (#502) and alert escalation chains with ack & auto-resolve (#501).

Fixed

• Fix QEMU args now warns that custom args: block live / cross-cluster migration before it writes them (#424).
• Resource-pool membership is honoured in cluster/VM visibility and the client portal (#555).
• Portal VNC console passes the vncproxy ticket through and honours the reverse proxy (#547); the external console link uses the correct console type (#551).
• ISO-upload streaming + multipart field order (#525); numeric IP sorting in the VM list (#431); CIS-control rollback + SSH-access / PAM controls (#386/#433/#434); ceph-detection without a cluster (#403); no SSE re-auth loop on a connected node with no VMs (#554).

Security

• Cross-cluster replication endpoints now enforce per-cluster access on source and target (create / run / delete), with input validation and an ownership-checked, guarded replica teardown.
• Tenant chargeback / quota scoped to the caller's own tenant (BOLA); resource-pool / VM-ACL cluster reach no longer grants blanket VM control beyond the explicitly granted VMs; the portal console validates the passed vncproxy port/ticket before it steers a connection; tag endpoints are tenant-scoped.

Upgrade: in-app updater (Settings → Updates) or ./update.sh. Docker: docker compose pull && docker compose up -d.

---

💎 Platinum Sponsors

• netwolk GmbH — Swiss managed-services partner
• Expertize.nl — Dutch Proxmox specialists
• Netzware — Austrian IT & infrastructure

PegaProx runs entirely on sponsorships and donations — server costs, certificates and the developer hours behind every release. Massive thanks 🙌. Sponsor PegaProx → opencollective.com/pegaprox | pegaprox.com/#sponsor

v0.9.13 — Cloud (Preview) layout, RBAC permission model & fixes

☁️ Cloud (Preview) layout + a big batch of fixes

New

• Cloud (Preview) layout — an opt-in, card-grid alternative to the Modern/Corporate UI (Settings → Layout style). Full per-cluster parity: VMs, Containers, Datastores, Resource Pools, Networks, Clusters, Hosts, HA, Backups, Firewall, Replication, Ceph, SDN, Storage, Backup Servers (PBS), Site Recovery and Monitoring — plus inline actions (run / enable / delete backup jobs, toggle / delete firewall rules, run replication).
• RBAC overhaul — admin-only endpoints are now permission-driven instead of hardcoded to the admin role, so custom roles finally work across alerts, users, settings, clusters, console/shell and API tokens (+4 new permissions). Admin still holds every permission — fully backward-compatible.

Fixed

• Console — Client-Portal VNC console opens again (#537); the terminal WebSocket uses the main port behind a reverse proxy (#539); a 500 on the VNC fallback route; the SSH-WS helper writes to a writable dir on read-only installs (#528).
• ESXi → Proxmox migration — the dd progress parser reads the final byte count, so a fully-copied disk is no longer mistaken for incomplete and deleted (#538); the selected NIC model is honoured on every interface (#536); real datastore-upload and qm errors are surfaced instead of "[object Object]" / success notices (#524, #438); RBD target volumes are activated before write; SSHFS / live-mirror fallback probing is more robust with real stderr in the logs (#535).
• Docker — images rebuild from scratch each release, so apt always pulls the current Debian security patches (openssl CVEs).
• Sponsor logos self-heal from the update mirror / GitHub when missing locally, and survive a read-only images/ directory.
• i18n — backfilled 146 UI translation keys that were rendering raw key names.
• Updater — always re-downloads the newest full tree (never skips on a version match), with full-tree fallback and post-copy verification.

Upgrade: in-app updater (Settings → Updates) or ./update.sh. Docker: docker compose pull && docker compose up -d.

---

💎 Platinum Sponsors

• netwolk GmbH — Swiss managed-services partner
• Expertize.nl — Dutch Proxmox specialists

PegaProx runs entirely on sponsorships and donations — server costs, certificates and the developer hours behind every release. Massive thanks 🙌. Sponsor PegaProx → opencollective.com/pegaprox | pegaprox.com/#sponsor