Skip to content

PegaProx v1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@MrMasterbay MrMasterbay released this 31 Aug 09:07
· 2 commits to main since this release
v1.1.0
e67358a

PegaProx v1.1.0

67 commits since v1.0.2. A big one: a full security-hardening pass (Aikido authz re-triage),
rolling-update robustness, console/VNC stability, ESXi→Proxmox Ceph-RBD migration fixes, a usable
phone layout, and a lot of i18n.

🔐 Security & authz

  • Closed 15 BOLA / IDOR / token-scope findings from the Aikido AI-pentest re-triage, plus a
    follow-up hardening batch and CodeAnt tightening.
  • API-token effective_role now propagates into cluster/search/VMware access (#491); PBS
    cred-exfil and cluster-wide-balance paths are tenant-confined.
  • Auto-balance worker, VM inventory and PBS auto-attach can no longer be reached via a pool/ACL
    fallback; a token's custom-role name is preserved so its tenant scope resolves correctly.
  • The live resources SSE stream is now scoped to each client's per-VM ACLs (#736).

✨ Features

  • Usable phone layout — off-canvas sidebar drawer + responsive shell (#189).
  • Re-pin SSH host keys after a node's key changes (e.g. post-CIS-hardening), with an actionable
    log when a node refuses SSH password auth (#717).
  • Optional node FQDN suffix for "Open in Proxmox" links (#689).
  • sshd-hardening safety rails — reversible umask-027, lockout warnings, apply-confirm
    acknowledgements (#16745).
  • Missing VGA options in the hardware dialog (#710).

🐛 Fixes

Rolling updates / maintenance

  • Don't burn 120 s waiting for HEALTH_OK on a benign Ceph WARN (slow BlueStore ops) (#747).
  • Evacuation no longer fails on VM is locked (migrate) when the guest is already migrating (#647).
  • Don't fake a reboot when none is needed; persist soft maintenance across a restart (#715, #720).

Console / VNC

  • Serialize SSL access on the PVE VNC leg to stop intermittent disconnects (#713).
  • noVNC proxy bind + offload now work under gevent on Python ≥ 3.13 (#740).
  • TaskBar auto-expands only for a task you actually just started (#738).

Migration / storage

  • ESXi→Proxmox with non-krbd Ceph RBD targets: map librbd URIs to a block device + route the
    EFI fallback through them (#722).
  • Preserve source MAC/hostname and force onboot=0 on local replicas (#646).
  • Hide node-restricted storages; snapshot a running LXC before a DR test-clone (#708, #709).

UI / display

  • PBS passed disk status no longer renders red; the overview "VMs Stopped" count uses the
    explicit stopped status instead of total − running (#751, #749).
  • Firefox: a press-drag after cancelling the shell SSH dialog no longer shoves the layout
    off-screen (#727).
  • Corporate light/dark theme handling (#742); WebAuthn/passkey-only login prompt (#746); iLO 4
    stale SEL assertions no longer latch a node as Critical (#714); Ceph overview health object (#735).

ACME

  • Honour the "allow private CA" checkbox sent with a cert request; write issued certs to the
    directory the TLS listener actually serves from (#730, #725).

🌍 i18n

  • New Polish translation (#737), shell-terminal keys across all 8 languages (#726), and a
    backfill of every language to full English parity (de/zh/fr/es/pt/ko/it).

🧰 Project

  • A PR template + CONTRIBUTING guide with a scope / AI-review bar; CI now nudges (and auto-closes)
    issues/PRs opened with the template deleted, and asks contributors to name the AI model they used.

💎 Platinum sponsors: netwolk · eXpertiZe · Netzware · Occentus

If PegaProx saves you time, please consider supporting it → https://opencollective.com/pegaprox 🐾

Assets 2
Loading