ProxCtrl 1.4.2

What's new

Crash fixes for closing and leaving the app, safer dialogs with the app lock, fixes for creating containers and moving disks, and plain HTTP for a Proxmox server behind a reverse proxy on your home network, after a warning. (These changes were prepared as 1.4.1 and 1.4.2; 1.4.1 was never released on its own.)

Fixed

• No crash when closing ProxCtrl with the app lock on. With Lock again set to "As soon as you leave", pressing Back on the first screen or swiping ProxCtrl away from recent apps could crash it, because the lock screen (or a dialog) tried to open on a screen that was already closing. The app still locks; it just doesn't try to show anything while it closes, and opens locked next time.
• The fingerprint prompt can't crash ProxCtrl. If Android refuses to show the fingerprint prompt (for example while you're leaving the app), the lock screen and Settings now show the usual error message instead of crashing, and the PIN keeps working.
• Dialogs no longer stay on top of the lock screen. A dialog, menu or bottom sheet that was open when ProxCtrl locked (or when a PIN or Confirm changes screen came up) used to stay on top of the lock screen, where it could still be tapped. It now waits behind the lock and comes back, as it was, after you unlock.
• A console is hidden while ProxCtrl is locked. An open console or node shell is now hidden behind the lock screen and the PIN screens too, and shows again after unlocking.
• Odd answers from a server or a proxy are an error message, not a crash. A connection that breaks while an answer is being read, or an answer that isn't what Proxmox normally sends (for example from a reverse proxy), now shows the usual error card everywhere, including at sign-in.
• Background work can't crash the app. A failure in work that runs on its own (refreshing the widgets and the tile, saving a setting, handling a push from ntfy, starting up) is now ignored until the next try instead of closing ProxCtrl, also while it's closing.
• Links from other apps can't crash ProxCtrl. A link, widget button or shared file from another app whose contents can't be read is now ignored.
• New container: the root password isn't lost silently. If Android closed ProxCtrl in the background while you were in the container wizard, the password you typed (which is never saved) was gone but the wizard still let you create the container without it. The wizard now goes back to Login to ask for it again, and Create stays off until the login step is complete.
• "ID already in use" only when it really is. In the create wizards and the clone dialog, a network hiccup (or typing the ID quickly) could flag a free ID as already in use. Now only Proxmox's own answer that the ID is taken does.
• Moving a TPM disk. Proxmox can't move a VM's TPM state while the VM is running, so its Move button now only shows while the VM is stopped. The format choice no longer shows for TPM state either, because it's always raw.

Changed

• Internal cleanup: removed 19 unused texts.
• http:// addresses are accepted. Proxmox itself always uses HTTPS, but if you reach it through a reverse proxy that only speaks plain HTTP on your home network, you can now enter an address like http://pve.lan (port 80 unless you type another one) instead of getting "Proxmox VE only uses HTTPS". Leaving the scheme out still means HTTPS on port 8006, and https:// addresses work as before, including trusting a self-signed certificate by its fingerprint.
• A warning before the first unencrypted connection. When you tap Connect for an http:// address, ProxCtrl first asks Use an unencrypted connection?: your API token or password, your session and everything you see and change (consoles and ISO uploads too) would travel unencrypted, which is fine on your home network or a VPN but risky anywhere else. Nothing, not even the sign-in options, is sent to the address until you tap Use HTTP. Your answer is remembered for that server, so editing it later doesn't ask again.
• "Not encrypted (HTTP)" label. A server with an http:// address shows Not encrypted (HTTP) under Settings › Servers and under the server on the You page, and the address field says so while you type one.
• Consoles, uploads, widgets and notifications work with an HTTP server. Container and VM consoles and the node shell connect without encryption to such a server, and ISO uploads (also when sharing an ISO to ProxCtrl), the widgets, the Quick Settings tile and the background checks for notifications use it as well.

Security

• Push from ntfy is checked more strictly. Nothing is accepted before ntfy has given ProxCtrl a push address, and the secret token in every push is compared in a way that doesn't leak how much of it was right.
• One unneeded component removed. WorkManager's diagnostics receiver (only useful for developer dumps over USB) is no longer part of the app.
• HTTP only where you chose it. ProxCtrl checks every connection, including consoles, uploads and background checks: plain HTTP only goes to a server address you accepted it for, an HTTPS server is never switched to HTTP, and nothing that started over HTTPS can end up on HTTP. Anything else is refused with "Blocked an unencrypted (HTTP) connection" and nothing is sent.
• Logins never follow a changed address. As before, a saved token secret is only sent to the exact address it was saved for: changing a server from https:// to http:// (or the other way round) needs the secret typed again, and a pinned certificate is dropped for an http:// address, where it can't apply.

Full diff: v1.4.0...v1.4.2

ProxCtrl 1.4.0

What's new

ProxCtrl can now create containers and VMs and move disks between storages.

New

• Create button on Guests: a violet + button at the bottom right of the Guests tab (hidden in read-only mode and while selecting guests) opens Create, with three choices: New container, New VM, and From a template. If your sign-in lacks VM.Allocate, the page says so and the wizards stay closed.
• New container wizard (eight steps, with Back and Next; the system back gesture goes to the previous step):
  • Template: pick a template storage, then a container template on it. Download templates opens the existing template list for that storage (needs Datastore.AllocateTemplate); come back and tap Refresh to see it. What you entered so far is kept.
  • General: the ID (the next free one is filled in; an ID in use is flagged), the hostname, Unprivileged container (on by default) and Nesting (on by default; needed by modern systemd and Docker). Turning unprivileged off explains that it needs Sys.Modify on / and turns nesting off, because only root@pam can set features on privileged containers.
  • Login: a root password (typed twice, at least 5 characters), SSH public keys (one per line), or both. The password is sent to Proxmox once and never saved, and the whole wizard is kept out of screenshots and the recent-apps preview.
  • Disk: the storage for the root disk (only storages that can hold containers; ones your sign-in can't allocate on are greyed out) and its size in GiB.
  • CPU and memory: cores, memory with quick picks, and swap.
  • Network: the bridge (picked from the node's bridges, or typed when the sign-in can't list them), an optional VLAN tag, the firewall switch, IPv4 (DHCP, static with optional gateway, or none) and IPv6 (none, SLAAC, DHCP, or static with optional gateway).
  • DNS: an optional DNS domain and DNS servers; empty uses the node's settings.
  • Confirm: a summary of everything, Start after creating (on by default), and the privileges your sign-in seems to lack for these choices.
• New VM wizard (eight steps):
  • General: ID (next free one filled in) and name.
  • OS: guest OS type (Linux, Windows 11/10/8/7, Solaris, Other) and an ISO from any ISO storage, or No CD/DVD. Picking Windows 11 turns on UEFI, Secure Boot keys and a TPM, as the web UI does.
  • System: SeaBIOS or OVMF (UEFI); with OVMF, the EFI disk's storage, Pre-enroll Secure Boot keys and TPM 2.0; machine type q35 (default) or i440fx; SCSI controller (VirtIO SCSI single by default, VirtIO SCSI, LSI 53C895A, LSI 53C810, MegaRAID SAS, VMware PVSCSI); and the QEMU guest agent switch (on by default).
  • Disk: bus (SCSI, VirtIO Block, SATA, IDE), storage (only storages that hold VM images), size in GiB, and the format (qcow2, raw, vmdk) on file storages such as directories, NFS and CIFS. VirtIO disks get an IO thread, as in the web UI.
  • CPU: sockets, cores per socket and CPU type (x86-64-v2-AES by default, x86-64-v3, x86-64-v4, host, kvm64, qemu64, or any other you type).
  • Memory: memory with quick picks, Ballooning (on by default) and an optional ballooning minimum.
  • Network: bridge, VLAN tag, firewall and the model (VirtIO, Intel E1000/E1000E, Realtek RTL8139, VMware vmxnet3).
  • Confirm: a summary, Start after creating (off by default) and any privileges that seem to be missing.
• From a template: every template on the server is listed; tapping one opens the existing clone dialog (ID, name, full or linked clone, target storage). Templates your sign-in can't clone say "needs VM.Clone".
• The task log opens after creating: as soon as Proxmox accepts a new container, VM or clone, ProxCtrl opens that task's live log (the same screen as in Tasks), and the Create pages close behind it. The guest list refreshes too.
• Clear permission errors: before creating, the last step lists each privilege your sign-in seems to lack and where (for example "SDN.Use on /sdn/zones/localnetwork/vmbr0"); you can still try, since Proxmox decides. If Proxmox refuses, a red card shows "Your sign-in isn't allowed to do this" with Proxmox's own message, and you stay on the page to change your choices.
• Move disks to another storage: on a guest's page, each disk in Resources has a Move button next to Grow (needs VM.Config.Disk). The dialog lists only other active storages on the guest's node that can hold the disk (VM images, or container directories), with their free space; ones without Datastore.AllocateSpace are greyed out. For VMs moving to a file storage you can keep the format or pick qcow2, raw or vmdk. Delete the original (off by default; otherwise the old disk stays as an unused disk) is blocked when the guest has snapshots, as Proxmox requires. An optional speed limit in MiB/s overrides the storage or datacenter limit. A second dialog confirms the move, and the task card follows it to the end. VMs can move disks while running; for running containers the page says to stop them first. EFI and TPM disks of VMs can be moved too; bind mounts can't.

Changed

• The README lists the privileges for creating guests and moving disks (VM.Config.Network, VM.Config.HWType, SDN.Use on /sdn/zones/localnetwork), and the command that adds them to the operator role.
• The guest list has a little more room at the bottom so the + button never covers the last guest.

Removed

• An unused placeholder screen for tabs that weren't built yet (and its two texts) was removed from the code. Nothing changes on screen.

Full diff: v1.3.0...v1.4.0

ProxCtrl 1.3.0

What's new

ProxCtrl now has a light mode that follows the device theme. The home-screen widgets get the Signal look too.

New

• Light mode that follows the device theme: ProxCtrl now switches between Signal dark and the new Signal light by itself, whenever your phone switches between dark and light mode (including scheduled or sunset switching). There's no setting for it and no theme picker: it always follows the phone. Wallpaper colours (Material You) stay off.
• Signal light colours: a warm off-white background (#F5F5F1), white cards with a thin grey border, near-black text and grey secondary text. The violet accent (#B48CFF) still fills the most important things (the CPU card on the Overview, main buttons, the selected tab, switches that are on, the PIN dots, the profile picture on the You page), with dark content on it, the same as in dark mode. Where the accent is text or an icon on a light background (the slash in PROX/CTRL, RUN states, checkmarks, the focused text field, the fingerprint key on the lock screen, chart lines), it's a deeper violet (#6A3BDB) so it stays readable on white. Warnings are a darker amber and errors a darker red in light mode.
• Every screen in both modes: Overview, Guests, Storage, Tasks, Node and every page behind them, the You page and Settings, dialogs, bottom sheets, text fields, switches (light grey track with a grey knob when off), progress bars (light track, dark fill), the floating tab bar (white with a thin border), the lock screen (white keys, light grey empty PIN squares), Confirm changes, Share → ProxCtrl and the pinned guests widget's settings.
• Status and navigation bars follow too: their colour is the app's background, with light icons in dark mode and dark icons in light mode. The window behind the app as it starts also matches, so there's no dark flash in light mode.

Changed

• Home-screen widgets in the Signal look, light or dark with the phone: a card with a thin border and rounded corners, small upper-case mono labels, square status dots (violet when running or healthy, grey when stopped, amber or red for problems), 6dp bars (the CPU bar in violet, RAM and disk in the text colour) and mono times. The node status widget shows the health ("ALL GOOD", "2 ISSUES") and uptime on top and the node's name in large type. In the pinned guests widget each guest shows its ID in mono, its name and its state, and Start is a violet button while Shut down is a grey one. "ProxCtrl is locked" uses the same card. Widgets already on your home screen change at their next update.
• Notifications use the Signal violet as their accent colour.
• Consoles stay dark: the VM and container consoles and the node shell are terminals, so they keep their dark look (and light status bar icons) in light mode too, like a photo or video viewer. Everything else follows the phone.

Removed

• The frosted-glass blur library (haze) is no longer part of ProxCtrl. The tab bar hasn't used it since 1.2.0, so nothing changes on screen, but the app is a little smaller.

Full diff: v1.2.0...v1.3.0

ProxCtrl 1.2.0

What's new

ProxCtrl gets the new Ctrl / Signal look shared by every Ctrl app: near-black, one violet accent, square-cornered shapes and two new fonts. Only the look changed. Every screen, feature, setting and button works as before.

Changed

• New colours: a near-black background (#08080A), dark grey cards (#141417) with a thin border, off-white text, and one violet accent (#B48CFF) for whatever matters most: the selected tab, switches that are on, main buttons, running guests and healthy nodes. Warnings stay yellow and failures red, so problems still stand out. Stopped guests and offline items are grey.
• New fonts: Space Grotesk for all text and headings, and JetBrains Mono for numbers, IDs, states, section labels and the PROX/CTRL wordmark. Both are bundled in the app (nothing is downloaded, no Google Fonts). They replace Manrope.
• Top of every tab: the PROX/CTRL wordmark on the left (with a violet slash) and your profile picture on the right as a rounded square with your server's initial, with a small violet square while ProxCtrl is connected. Tapping it still opens the You page with your servers, Settings and About. Tab titles are bigger and bolder below it.
• Overview: each node now starts with its status ("NODE · ONLINE") and its name in large type, with the Proxmox VE version and uptime below. CPU load is a big violet card with the percentage in large numbers, the thread count and a bar chart of the last CPU readings. Memory and root disk are two cards side by side with used / total and a bar. Kernel, IO delay, load, swap and the CPU, memory and network trends are in a Details card below. The node shell button sits next to the node's name.
• Overview guests list: under "Needs attention", a Guests list shows your first guests by ID, each with its name and a RUN / STOP / PAUSE state with a small square (violet when running). Tap a guest to open it, or the heading ("3 / 4 RUNNING") to open the Guests tab.
• Tab bar: a floating dark bar with rounded corners, a bit higher above the bottom of the screen. The selected tab is a violet block with its icon and name; the other tabs show their icon only. On tablets and in landscape the side rail uses the same colours.
• Pushed screens (guest, node pages, storage, tasks, settings and so on) have a square back button and the title next to it, instead of the Material top bar.
• Cards and settings groups: rounded cards (22dp corners) with a thin border, section headings in small upper-case mono type ("PRIVACY", "NOTIFICATIONS"), and thin lines between rows. Icons in rows are plain outlined icons instead of coloured circles.
• Switches: new rounded-square switches. On is a violet track with a dark knob, off is a dark track with a grey knob. The whole row is still one switch for TalkBack.
• Buttons: main buttons are violet with dark text and rounded corners (Support, Unlock, Done). Secondary buttons (Stop, Run now, Refresh, Copy, Load more and so on) are dark with a thin border.
• Text fields: dark fill with a thin border and rounded corners; the border and cursor turn violet while you type.
• Progress and usage bars: 6dp bars with rounded ends on a dark track (CPU, memory, disk, uploads, running tasks).
• Status dots are now small squares instead of circles.
• Dialogs and bottom sheets: dark cards with large rounded corners and a thin border.
• Charts draw in violet and off-white.
• Lock screen: a violet rounded square with a lock, "VKNXWORKS · CTRL" and "Locked" in large type, and the PIN shown as small squares that fill in violet. The keypad uses large rounded keys in mono type, three across. When fingerprint unlock is on, the fingerprint key sits bottom left on the keypad (outlined in violet) instead of a "Use fingerprint" button below; delete is bottom right. For PINs that aren't checked automatically, the bottom-left key turns into a violet OK key once enough digits are entered. "Confirm changes" and choosing or changing your PIN use the same keypad. How the lock works hasn't changed.
• You page: a close button and "PROFILE" at the top, then a violet avatar with your server's initial, its name and its address in mono type. Support ProxCtrl is now a violet button at the bottom instead of a row in About, with the version and "GOOGLE-FREE · TELEMETRY-FREE · ARM64" below it.
• Status and navigation bars always show the app's background with light icons.

Removed

• Theme and wallpaper colours: the Signal look is dark only, so the Appearance section in Settings (Theme: Follow system / Dark / Light / Pure black, and Use wallpaper colours) is gone. ProxCtrl no longer follows the system's light mode or your wallpaper colours. Your old choice is kept in the settings file but no longer does anything.

Licences

• Space Grotesk and JetBrains Mono are licensed under the SIL Open Font License 1.1. Their licence texts are in the repository (FONT-LICENSE-SpaceGrotesk.txt, FONT-LICENSE-JetBrainsMono.txt) and inside the app (assets/licenses/). The Manrope font and its licence were removed.

Full diff: v1.1.10...v1.2.0

ProxCtrl 1.1.10

What's new

Fixed

• ProxCtrl now really asks to show notifications: on Android 13 and later an app can only show notifications after you allow it, and ProxCtrl only asked when you turned Check in the background or Push from Proxmox on. If that question was missed or answered with no, checks and push messages kept arriving but every alert (node or guest down, high CPU, storage, backups, updates and Proxmox's own notifications) was silently dropped. With background checks or push on, ProxCtrl now asks once by itself as soon as it's unlocked, and never again after that, so it doesn't nag on every start.
• Allow notifications always does something: once you'd said no twice, Android stops showing its question, and the Allow notifications button on the Notifications screen did nothing at all. It now opens ProxCtrl's notification settings in Android when the question can't be shown any more (and when notifications are turned off there), and the app lock doesn't lock you out when you come back.

Changed

• Notification switches show the truth: while notifications are blocked, Check in the background, Push from Proxmox and the event switches show as off, because nothing can reach you, and the red banner at the top explains why. The push address and setup commands are hidden until notifications are allowed. Turning any of the switches on asks for the permission (or opens Android's settings when it can't ask any more). As soon as you allow notifications, the switches show your saved choices again; you don't have to set anything twice.
• Settings shows when notifications are blocked: the Notifications row in Settings reads "Notifications are blocked: tap to allow them" while background checks or push are on but ProxCtrl can't show notifications.

Full diff: v1.1.9...v1.1.10

ProxCtrl 1.1.9

What's new

Fixed

• Fingerprint unlock works again after you leave the app: once you'd left ProxCtrl with the back gesture or by swiping home, the lock screen no longer asked for your fingerprint when you came back, and tapping Use fingerprint did nothing either; only the PIN worked until the app was force-closed. The fingerprint prompt was asked for while ProxCtrl was still coming back on screen, and the phone dropped it without answering, which left ProxCtrl waiting for an answer that never came. Now the prompt only opens once ProxCtrl is fully back on screen, a prompt that never answered can't block the next one, and the lock screen offers your fingerprint again every time you come back to it, not just the first time after it locked.
• Confirm changes asks for your fingerprint again after you leave the app: the same fix applies to the Confirm changes screen. If you leave ProxCtrl while it's asking and come back, it offers your fingerprint again, and Use fingerprint always works.
• The one-time unlock with the phone's screen lock (after updating from the old app lock) is asked for again when you come back, and can't get stuck in the same way.

Full diff: v1.1.8...v1.1.9

ProxCtrl 1.1.8

What's new

Security

• Sharing an ISO only accepts files from other apps: the Share → ProxCtrl screen accepted any address another app handed it, including file:// addresses and ProxCtrl's own files, so another app could get ProxCtrl to upload one of its private files to your server. It now only takes files offered by another app (a content:// address that doesn't belong to ProxCtrl, also when written with a user number in front), and otherwise says there's no file to upload.
• Only the pinned guests widget can open the Start / Shut down question: any app could open ProxCtrl straight into "Start …?" or "Shut down …?" for one of your guests. Nothing happened without your confirmation, but the question could be made to pop up out of nowhere. The widget's buttons now carry a secret only ProxCtrl knows, and requests without it are ignored. Widgets already on your home screen pick it up at their next update (about every 15 minutes, or when you open ProxCtrl).
• Widgets and the tile say "ProxCtrl is locked" while it's locked: with the app lock on and Background checks while locked off, the node status and pinned guests widgets kept showing your guests' names and the node's last known state, and the Quick Settings tile the node's name and health, while ProxCtrl was locked. They now only say "ProxCtrl is locked" until you unlock it, then show your server again.
• Your server logins are always sealed with the app lock: if ProxCtrl was stopped in the split second between setting up the app lock and encrypting your server logins with the PIN, they could stay encrypted with the Android Keystore only. ProxCtrl now checks every time you unlock and seals anything that was missed.

Full diff: v1.1.7...v1.1.8

ProxCtrl 1.1.7

What's new

Fixed

• Clear message when a certificate can't be read: when you add a server with a self-signed or changed certificate and the app can't fetch that certificate to show you, it now says either that it can't reach the server (check the address and network) or that it couldn't read the certificate the server presents. Before, it showed the phone's raw technical error text, or just the server's address.

Full diff: v1.1.6...v1.1.7

ProxCtrl 1.1.6

What's new

Changed

• The page behind your profile picture is now called You, the same name as in every Ctrl app (before: "Account"). It still holds your servers, read-only mode, what your sign-in may do, Settings and About, and the profile picture at the top right of every tab is still the only way into Settings. Screen readers now announce the profile picture as "You" instead of "Account and settings".
• README: Getting started now says what's behind the profile picture, and the app lock and Support sections say to tap your profile picture.

Full diff: v1.1.5...v1.1.6

ProxCtrl 1.1.5

What's new

Changed

• Hide in screenshots and Hide in recent apps are now two separate switches in Settings > Privacy and security, both off by default. Hide in screenshots makes screenshots and screen recordings show a blank screen (the recent-apps view too). Hide in recent apps only shows a blank card in the recent-apps view, so screenshots still work. They replace "Hide in screenshots and recent apps".
• What changes if you never touched it: the old switch was on by default, so ProxCtrl used to block every screenshot and always showed a blank card in recent apps. Both new switches start off, so screenshots of ProxCtrl now work and recent apps shows a preview. Turn both switches on to keep the old behaviour. With the app lock on, recent apps still always shows a blank card, because a preview there would show your servers without the PIN.
• Signing in to a server, consoles, the node shell and the lock and PIN screens are still always kept out of screenshots and recordings, whatever the switches say. Sharing an ISO and the pinned guests widget's settings follow the same switches.

Full diff: v1.1.4...v1.1.5