ANAS 0.3.2

ANAS 0.3.2 closes the gap AHR has carried since it shipped: it could
detect silent corruption on its disks but could not repair it. It now
can, from the redundancy the pool already has, on a stock Proxmox
kernel. Everything a repair writes is confirm-gated, every outcome is
reported through the PVE notification system, and nothing runs on its
own. A handful of share-user problems reported on GitHub are fixed in
the same release.

Scrubs name what is wrong

The AHR scrub reports the affected files and the exact 4 KiB blocks,
including files in compressed extents, and says how many errors it
attributed out of how many it counted. Bands that could not be checked
are listed with the reason instead of counted as checked, and a band
whose parity disagrees with intact data is called out on its own.

The periodic scrub is the whole scrub

Turning on periodic scrub for an AHR pool now runs both phases on one
schedule: the md parity check of every band, then the btrfs checksum
scrub. While it is on, ANAS runs the system's monthly md checks itself
and disables the distro's mdcheck timers; turning off the last pool
gives them back. Monthly or quarterly.

Repair from parity

From a scrub's findings, a confirm-gated job reconstructs each bad
block from the other members of its stripe, checks the result against
the checksum btrfs stored for that block, and writes it back through
md. Every block ends in one of five outcomes: repaired, unrepairable,
corruption that arrived above md, not corrupt at the mapped location,
or not examined. The confirm dialog states what the run touches and
what it costs.

Rewrite parity

When every file passes its checksum but a band still counts a parity
mismatch, the rot is in the parity member. A confirm-gated rewrite runs
a fresh checksum scrub first and refuses if anything is found, then
recomputes the band's parity from its data. Parity bands only.

Reconcile mirror

A mirror band whose two legs disagree cannot be attributed by the scrub.
Reconcile mirror repeats the scrub to let btrfs heal what it can, then
compares the two legs row by row and settles each differing row by its
checksum, writing the winner to both legs. The pool stays online
throughout. ANAS never runs md's own repair on a mirror.

Share users

• User names with capital letters are accepted.
• The SMB password indicator matches names the way Samba does, so a
  user created with capitals no longer shows as having no password.
• New share users are created without a same-named private group.
• Users and groups can be deleted from their screens. A user still
  referenced by a share, or a group that is still a user's primary
  group, is refused with the reference named.

Fixes along the way

• PVE notifications with non-ASCII characters arrived double-encoded.
• Disks in standby, or whose SMART probe failed once, showed unknown
  health instead of their last reading.
• Uninstall left ANAS timer units behind and left the system's mdcheck
  timers disabled.
• A CephFS mount was classified as NFS.
• Scrubs and repairs report metadata reads that btrfs corrected from
  its mirror copy, an early sign of a member returning bad metadata.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path). After upgrading, a pool with
periodic scrub on stays on the system's mdcheck timers until its toggle
is turned on again, which then takes them over.

Known issues

• A repair drops the node's page cache and holds the band's stripe
  cache at its floor once per block; a busy node will feel it.
• Reconcile mirror reads both legs in full at roughly 20 MiB/s per leg.
• Files without checksums cannot be checked or repaired.
• Stopping a running AHR scrub from the UI is not yet supported.

ANAS 0.3.1

ANAS 0.3.1 is a correctness release. After 0.3.0 shipped the iSCSI target
stack and backup restore, the whole of that new code was reviewed end to
end, every finding was verified against the code, and the fixes were
live-proven on a disposable PVE node — including a hands-on measurement of
what LIO actually does to a live session when a portal is removed. No new
features; the workflows are unchanged. What changed is that several paths
that could quietly do the wrong thing now refuse, confirm, or report the
truth instead.

Deleting a LUN always asks first

Deleting a LUN is now a confirmation in every case, with the backing
object named and an unticked "also destroy the backing" box — previously a
LUN whose backing was kept was deleted on a single click with no prompt,
and the destroy-the-backing option could not be reached from the UI at
all. Destroying a zvol's backing when it still has snapshots is refused up
front and names them (a plain zfs destroy would have failed midway,
after the LUN was already gone), and a LUN whose current size cannot be
read refuses any resize rather than risk truncating it.

Restore tells you what happened

A restore that failed used to be able to finish silently — the dialog
closed the moment the job was accepted, and with it went the completion
summary, the "these files were not restored" list, and the failure alert.
Those now always arrive, and the LUN and task views refresh when the job
really finishes rather than when it starts. Restoring a backup as a new
LUN works from every door that offers it (the task grid, a task's
Details, and the repository browser), not only from the LUN toolbar; a
long image restore reports "still running" until it actually completes
instead of announcing success early; and restoring into a new directory
whose parent does not exist yet now creates the path instead of refusing
it.

The rest of ANAS is harder to fool

• Growing a volume compares exact bytes. The never-shrink guard, the
  reported size, and the resize dialog were built from zfs list's
  rounded display value; a shrink that fell inside the rounding window
  could pass as a grow and truncate a live volume. Sizes are now exact
  everywhere, from both the iSCSI and the Datasets door.
• Rolling back an AHR snapshot that backs a LUN is refused, the same
  way destroying its pool already was — an unmounted-pool rollback would
  otherwise swap the image out from under a live target with no error
  anywhere.
• An in-place image restore re-checks for a live session at the moment
  it runs, not only when it was requested, so an initiator that reconnects
  while the job waits in the queue can no longer have its disk overwritten
  underneath it.
• Building a ZFS pool refuses a disk that is really an iSCSI LUN this
  node serves (the loop-back case), matching what the AHR composer
  already refused.
• A destroy or export whose iSCSI check could not run says so — the
  refusal used to be indistinguishable from "no LUN holds this."

Hands off means hands off

A stub LUN — a placeholder file served where a real image should be —
belonging to a target ANAS did not create is now reported but never
touched, and it no longer forces the whole node into a state that refuses
every other iSCSI change. A stub on an ANAS-owned target is still taken
offline (serving a placeholder as a disk is how filesystems get formatted
by accident), and the card says plainly that it was a placeholder, not
your data.

Recurring replication to another node

A scheduled replication task pointed at a pool on a peer or a remote is now
judged where the target actually lives, over SSH — it used to be checked
against the local node's pools, so a perfectly good remote target was
rejected as "does not exist" while a pool that existed only locally was
accepted and then failed at run time (issue #46).

Smaller correctness fixes

• The write-back cache setting is applied on a combined grow-and-cache
  change to a zvol LUN, not silently dropped.
• Portal removal that would break a logged-in initiator's ability to
  reconnect is confirmed with a warning naming that initiator — its
  running session is not dropped (LIO keeps serving it), but it could not
  re-login through the removed address, and the dialog now says exactly
  that.
• A wrong PBS password reads as an authentication problem, not a
  datastore-permission one (this was a known issue in 0.3.0).
• A backup restore no longer leaves a "restore did not finish" marker
  behind after a successful retry, a killed restore reports that it was
  killed rather than quoting a progress line, and a restore rate limit is
  validated the same way at both doors.
• A file-backed LUN is refused if its backing dataset is not mounted,
  instead of writing the image to the parent directory.
• A pool that fails to assemble at boot no longer stalls startup (and the
  iSCSI targets) for 90 seconds waiting on a device that is never coming.
• The backup panel's menus no longer rebuild under the cursor, backup
  coverage refreshes after you create a task, a portal edit that only
  duplicates an address is no longer reported as "no changes," and a LUN's
  full serial is always recoverable from its tooltip.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

Known issues

• Stopping a running AHR scrub from the UI is not yet supported.
• After upgrading, if the browser shows a version-mismatch notice that a
  normal reload doesn't clear, do a hard reload (Ctrl+Shift+R) — the same
  browser-cache behavior as a Proxmox VE UI upgrade.

ANAS 0.3.0

ANAS 0.3.0 turns a Proxmox node into a block-storage appliance: a full
iSCSI target stack managed the ANAS way (config files as the API, jobs,
refusals with reasons), and the backup system grows the other half it
always needed — restore. Everything below was built story-by-story,
live-proven on a disposable PVE node, and then run in anger on a real
five-node cluster, including a Windows Server 2025 initiator.

iSCSI target management (epic: iscsi)

A new iSCSI menu manages LIO/targetcli natively: targets with a
stable ANAS-generated IQN, portals, initiator ACLs with one-way and
mutual CHAP (secrets written to configfs, never argv; 12–16 bytes
enforced because initiators enforce it), and LUNs with serial and
attributes preserved across replays. Two backing kinds: a ZFS volume
(zvol) or a raw image file on a dataset or an AHR pool. Every
mutation is a job; dangerous ones are confirmations; impossible ones are
refusals with the reason on the button.

Security posture by default: a target is created with demo mode off,
dynamic ACLs off, and discovery closed to unknown initiators — an
initiator must be listed on the target before it can even enumerate it
(the dialog says so). Every listed initiator sees all of that target's
LUNs, and the dialog says that too.

ZFS volumes are first-class

Datasets now lists zvols with size, volblocksize and usage; create and
grow from the UI (grow is live — the initiator rescans and sees the new
size). PVE-owned guest volumes stay read-only and hands-off.

Reboot lifecycle, honestly

Target restore is ordered after ZFS volumes and AHR activation, with the
reverse at shutdown. A file-backed LUN whose filesystem didn't mount is
quarantined, never served — serving a stub file as an empty disk is
how filesystems get formatted by accident. The dashboard explains a
disabled target and Repair fixes what it can.

The rest of ANAS knows a LUN is there

Destroying a zvol, exporting a pool, or unmounting a filesystem that
backs a LUN is refused with "held by LUN " — with the connected
initiators in the sentence. A live initiator is never yanked: a target
with sessions or LUNs cannot be deleted, a LUN in use cannot be deleted.

Backups know about block devices (epic: backup2)

A backup task is now files or block. A block task backs up one LUN
per task as a fixed-chunk .img archive (zvol snapshots are used when
the backing is a zvol), grouped per LUN so retention applies per disk.
File sources on ZFS and AHR are backed up from a snapshot — a
multi-hour run reads one instant in time, and the run record says which.

Nested filesystems are never silently skipped

A files source is scanned for nested filesystems (child datasets, btrfs
subvolumes, mounts) by device identity, and each archive chooses:
include none, all, or specific paths. What the choice does not cover is
reported — as information, not a warning: the run stays green, the
notification level does not rise, and the note rides the mail body and
the task's Details. Only a scan that could not finish is still a
warning. A source rooted on a remote mount (NFS/CIFS) is never walked.

Restore, finally — and one dialog for all of it

• Selective file restore with a desktop-grade picker that browses
  the live tree and the archive catalog side by side.
• Destinations follow the patterns every backup tool taught you:
  into the original (overwrite matching files, keep the rest) or
  somewhere else (any path; an existing directory asks for explicit
  confirmation, then merges — a pre-existing directory is never deleted,
  even by a failed restore's cleanup).
• Whole-image LUN restore: onto the original LUN (the target goes
  offline for the duration; refused outright while an initiator is
  logged in) or as a new LUN with a fresh serial on any target —
  the source LUN is never touched, nobody logs out.
• One Restore dialog behind every door — the LUN toolbar, the task
  grid, the task's Details, or bare "Restore from repository…". It asks
  only what the selection doesn't already know, and it tells you a
  destination is impossible before the server has to.

Task details are instant

Opening a backup task's Details no longer waits on the boundary scan —
the screen renders at once and the scan streams in. A slow cross-node
request now says "timed out" instead of the false "node is unreachable"
(and a genuinely unreachable node still says so).

Proven with a Windows initiator

The whole path — closed discovery, ACL login, NTFS format, data, reboot,
reconnect — was proven end-to-end against a Windows Server 2025
initiator with stock ANAS target defaults. No target-side changes were
needed.

Fixes along the way

• The target dialog kept only the last-added initiator/portal row on
  submit (an ExtJS keyed-collection eviction the DOM hid); every row now
  survives, on create and edit.
• An enabled task that never ran reports never-run, not success.
• Toolbars collapse into an overflow menu instead of clipping.
• Password managers are kept out of every credential field.
• Growing a LUN-backed volume explains the VM-side steps from both
  doors, with one shared sentence.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

Known issues

• A PBS credential with a wrong password is reported as a
  datastore-permission problem ("wants Datastore.Audit") rather than an
  authentication failure; the fix is to re-save the credential.
• Stopping a running AHR scrub from the UI is not yet supported.
• After upgrading, if the browser shows a version-mismatch notice that a
  normal reload doesn't clear, do a hard reload (Ctrl+Shift+R) — the
  same browser-cache behavior as a Proxmox VE UI upgrade.

ANAS 0.2.12

A dialog-honesty release. A systematic audit of every create/edit dialog
— triggered by one mount option that refused to clear — found a set of
bugs where the UI accepted an edit, reported success, and did something
other than what it showed. Several affect data integrity or access
control. Upgrading is recommended for all installations.

SMB edits could write into the wrong share's config

Editing an SMB share (or SMB Settings) with a change that both removed
and added directives could place the added lines — including guest ok
— into the following share's section of smb.conf, silently changing
that share's access. On the last share in the file the edit failed with
an opaque error instead. The config editor now recomputes its section
map during the edit, and a new test matrix pins every edit shape to its
own section. (#36)

Also fixed in SMB config handling: parameters at their Samba defaults
are no longer pinned into sections that never declared them; blank
Workgroup / Server string / comment fields now remove the directive
instead of writing an empty one; and clearing "Hosts allow/deny" now
works on sections written with Samba's synonym spellings (allow hosts, etc.). (#42)

Dataset Permissions could wipe named access grants

If the Permissions dialog failed to load the current access state, it
stayed open showing defaults and an empty grants list — and Apply then
removed every named user/group ACL from the dataset, reporting success.
The dialog now closes on a failed load, and the daemon only clears
named grants when the request explicitly asks for it. Property edits
are also now applied as a single atomic operation, so an invalid value
can no longer leave a dataset half-updated. (#37)

Replication and snapshot-schedule edits could silently retarget

Opening an edit dialog while a peer was unreachable or an inventory
fetch failed could silently substitute the first available pool,
dataset, or location for the stored one — so saving an unrelated change
(like a schedule tweak) rewrote where data comes from or goes. Edit
dialogs now keep the stored selection, mark it "(unavailable)", and
block Save with the reason until inventory confirms it. Changing a
replication task's source or target now requires explicit confirmation.
A remote whose SSH host key changed (rebuilt server) can now be
re-trusted from the UI with both fingerprints shown, and the Host key
column now displays the pinned key. (#39, #40)

Mount options can now actually be cleared

Clearing a pre-filled option in the mount edit dialog — the idle
timeout, NFS/CIFS tuning values, extra options — was silently ignored:
the save reported success and kept the old value. Every option now
supports set / clear / keep explicitly, and saving a dialog you didn't
change rewrites nothing (previously it could pin default values into
hand-written fstab entries). Disabling automount also removes its
idle-timeout remnant. (#34)

Two more mount-edit fixes: a mount configured for on-demand mounting
(automount) that had idled out showed as unmanageable "local storage"
until re-triggered — it now keeps its identity and its Edit/Unmount
buttons (#35); and the Server / Share fields, which edits silently
ignored, are now read-only on edit with Test connection probing the
mount's real, stored target (#38).

Backup repository fixes

"Test connection" on an existing repository failed authentication
unless the secret was retyped; it now uses the stored secret exactly
as a save would (#41). Testing a repository addressed by IP returned
an internal error instead of a result (#44). A task's file-limit
setting is no longer reset to default by unrelated edits (#41), and
the Import Pool dialog now uses the pool GUID it displays, fixing
imports when two exported pools share a name.

Guarding against the whole class

Every fix ships with regression tests, and three new contract test
suites now run in CI that iterate the API schemas programmatically —
a future field or option added without honest clear/round-trip
semantics fails the build rather than shipping as a new instance of
this class.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

Known issues

• Stopping a running AHR scrub from the UI is not yet supported.
• After upgrading, if the browser shows a version-mismatch notice that
  a normal reload doesn't clear, do a hard reload (Ctrl+Shift+R) —
  the same browser-cache behavior as a Proxmox VE UI upgrade.

ANAS 0.2.11

A single-fix release: AHR pool expansion and disk replacement were
broken in the field, failing before doing any work. If you use Hybrid
RAID pools, upgrade before attempting an expand or replace.

AHR expand and replace failed immediately at the partition step

Expanding a Hybrid RAID pool (and replacing a member disk, which shares
the same partitioning path) failed on its first step with
spawn /usr/sbin/partx ENOENT. The daemon invoked partx at its
Red Hat location; on Debian — every PVE node — it lives at
/usr/bin/partx. The failure struck after the first new disk's
partition table was already written, leaving that disk carved and
labeled for the pool but never joined to any array, which made it look
absorbed without any capacity arriving. No data was ever at risk: the
job halted before touching the existing arrays, and re-running the
expansion after this fix picks up cleanly — already-carved slices are
recognized and skipped. (#33)

Versions 0.2.x prior to this release are affected wherever the expand
or replace path runs partx (any expand of a live pool, and every
disk replacement).

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

Known issues

• Stopping a running AHR scrub from the UI is not yet supported.
• After upgrading, if the browser shows a version-mismatch notice that a
  normal reload doesn't clear, do a hard reload (Ctrl+Shift+R). (#31)

ANAS 0.2.10

A usability release shaped by live review: task status stops lying about
long runs, notifications extend to snapshots and replication, and six
screens got more legible against real data.

Long-running jobs are no longer reported as failed

Backup, snapshot, and replication runs that took longer than about 90
minutes were marked failed even though the job itself kept running and
completed successfully. Task status now follows the job to its real
outcome, however long it takes. (#30)

Notifications for snapshot schedules and replication

Snapshot schedules and replication tasks can now send notifications
through the Proxmox notification system, the same way backup tasks do.
Each schedule and task has a Notify setting: On failure (the default
— you hear about problems and nothing else) or Always. Runs that
complete with warnings — for example, retention pruning that had to skip
a held snapshot — notify in both modes. Notification text has also been
cleaned up: the repository line no longer repeats the datastore name,
special characters no longer render incorrectly in some delivery
channels, and the boilerplate closing line is gone.

The Scrubs screen can act, not just report

Scrubs can be started and stopped directly from the Scrubs screen
(stopping applies to ZFS scrubs; a resilver can't be stopped, and
stopping a running AHR scrub isn't supported yet). A running scrub shows
its progress right in the Last scrub column — percent complete, and
speed/ETA where available. The Scope column has been reduced to a small
info icon, giving the space to the scrub results.

Charts you can read at a glance

Chart scales now use familiar round steps (5 MiB/s, 100 MiB/s, 1 GiB/s)
instead of arbitrary data-driven numbers. Once a chart scales up for a
burst it stays put — the scale never jumps down behind your back; a
small fit control appears when you want to zoom back in. Headline I/O
figures show a short-window average, so a pool doing bursty writes no
longer reads "0 IOPS" between flushes, and an average line is drawn
alongside the raw activity. Chart areas with no samples yet are hatched
instead of looking idle. Read/write figures are labeled R and W. Pools
with a single vdev no longer show a vdev panel that repeats the pool
panel — per-disk detail remains.

Mounts: clearer at a glance, tidier on the way out

The Mounts grid has a new Managed by column (PVE, AHR, ANAS, or
local) replacing the badges scattered across other columns. The Persist
column now names how a mount comes back after a reboot — fstab, ZFS, or
Proxmox storage configuration — with "session" reserved for mounts that
genuinely won't return. Removing a remote mount asks whether to also
remove the leftover mountpoint directory (only ever an empty directory).

Actions where you can see them

Snapshots and Change mount for Hybrid RAID pools moved from the pool
detail window to the main toolbar. The Datasets tree's per-row action
icons are gone — every action lives on the toolbar, and the explanation
of why a PVE-managed pool is hands-off now shows on the PVE badge itself.

Disk Health recognizes partition-built pools

On nodes whose ZFS pools reference their member disks by partition GUID,
the Disk Health view showed every disk as unassigned — grouped under
"Other" with no pool, vdev, or ZFS error information. Those disks now
show their pool membership like any other. (#32)

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

Known issues

• Stopping a running AHR scrub from the UI is not yet supported.
• After upgrading, if the browser shows a version-mismatch notice that a
  normal reload doesn't clear, do a hard reload (Ctrl+Shift+R). (#31)

ANAS 0.2.9

A hygiene-and-honesty release: backup runs now notify you the way your
old cron jobs did, several surfaces stop understating or overstating
reality, and two bugs that could bite the backup migration are fixed
before anyone hit them.

Backup runs notify through PVE (16.12)

A finished backup run now sends a notification through the Proxmox
notification system — the same matchers and targets the rest of PVE
uses, typed anas-backup so you can route it. Per-task mode with
vzdump's semantics: Always (the default) mails every run with the
full detail — per-archive sizes and dedup reuse, duration, prune counts,
warnings; On failure mails only failed runs and runs that completed
with warnings. A failed run or a prune warning notifies in both modes; a
biweekly off-week skip never notifies (a non-event is a non-event).
Delivery is best-effort: a broken mail target never fails the backup.
Overdue stays dashboard-only, honestly — when a timer never fired,
there's no process alive to send you anything.

Toggling a task no longer drops its cadence

Enable/disable rewrites the whole task, and it carried retention and
notification mode through but not the structured cadence — so toggling a
biweekly task silently turned it into a weekly one. Found during 16.12's
build, fixed before any real task hit it.

The New Task wizard's double Schedule is gone

A merge leftover showed the Schedule field twice, and the stray copy
could block creating cadence-based tasks. One Schedule fieldset remains.

Hybrid RAID grid: Used / Free / Capacity (#28)

The AHR pool grid showed only total usable space; checking free space
meant hovering a tooltip. It now carries Used, Free, and a Capacity bar
at the same widths and fullness thresholds as the ZFS Pools grid.

An AHR band that cannot start says so

A band mdstat reports as unable to assemble used to show as amber
"degraded" — the same word as a band that's merely down a member. It now
reports inactive (red) — the same fact that makes the pool offline,
so the two levels can never disagree. And the expansion gate, which
matched bad bands only by the word "degraded", now names every state
explicitly: an offline pool is refused a reshape with the honest reason
(nothing is assembled to reshape).

The Scrubs page shows the last scrub (17.3)

Each ZFS pool now shows when it was last verified and how it went —
repaired bytes, errors, duration, date — read from the same zpool status output ANAS already collects. AHR rows say "no record" plainly:
md keeps no completion timestamp, and ANAS won't invent one.

CI lint is green — and blocking

Nine YAML quoting findings in the issue templates were the whole reason
the lint job stayed red-by-design. They're fixed, and the job now blocks:
a red lint means something again.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

ANAS 0.2.8

The backup feature grows the two pieces that hand-rolled cron jobs still
had over it — a real cadence and retention — both designed from a live
fleet's actual backup scripts and live-proven against a disposable PBS
before shipping. Plus Ceph OSD disks stop hiding as "Other".

Backup cadence: weekly, every other week, monthly (16.10)

A backup task's schedule can now be a structured cadence — weekly on one
or more weekdays, every other week on a weekday with an explicit even/odd
ISO-week phase, or monthly on a weekday's first occurrence — with the raw
OnCalendar field still available as Custom. ANAS adds scheduling logic
only where systemd calendars genuinely can't express the schedule:
weekly/monthly run as plain timers with Persistent=true as their
missed-run catch-up, and only biweekly gets a gate — the timer fires
weekly and an off-week fire completes as a distinct, visible
"skipped (off week)", never a fake success and never a failure. A
missed or failed on-week run heals on the next fire (at most one
shortened interval; the configured phase never drifts). Run Now always
runs — only scheduled fires are gated — and overdue is measured against
the real period, so a healthy off-week skip never reads late.

Per-task retention (16.11)

A task can carry an optional retention policy (keep-last/daily/weekly/ monthly/yearly). After each successful backup the same job runs a PBS
prune with exactly those keeps and reports kept/removed counts; a prune
failure never fails the backup — the data is already safe, so the job
completes with a visible warning. Leave the policy empty and ANAS never
prunes: retention stays PBS-side, exactly as before. A dry-run Preview in
the wizard shows what a policy would keep and remove before you save it.
Garbage collection remains PBS's job throughout.

Ceph OSD disks read as Ceph OSDs (#29)

On a converged node the Disks view showed OSD disks as "Other" —
indistinguishable from leftover partitions. They now classify as
Ceph OSD and group under a Ceph heading, detected purely from the
lsblk output ANAS already reads (the bluestore signature or the Ceph VG
naming, covering DB/WAL devices) — no Ceph tooling is invoked or
required, and non-Ceph nodes do zero extra work. Like ZFS and AHR
members, an OSD disk is never offered as available.

Known issues

• The biweekly skip and heal decide from local systemd/journald state
  only; if the journal has rotated away the last success record, ANAS
  errs toward running — a redundant backup is safe, a missed one is not.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

ANAS 0.2.7

A patch release closing the mount-edit bug arc (#23–#27) — five defects
found in one live debugging session, all in the Remote Share edit flow.
The headline: editing a CIFS mount could silently flip it read-only and
silently rotate its credentials to whatever your password manager
autofilled, and the save reported success either way. All five are fixed.

The edit dialog now sends what you selected (#26)

The Access radio (Read/write vs Read-only) mirrored its state into a
hidden form field — the one field in the dialog that stores values as DOM
strings. 'false' is a truthy string, so every save sent ro: true
regardless of the radio: editing any read/write mount flipped it
read-only, and no edit could ever flip it back. The mirror is gone; the
submit and the fstab preview now read the radio directly.

Your password manager can no longer rotate your credentials (#23)

The credentials fields carried no autocomplete hints, so inside the PVE
web UI browser password managers happily autofilled the PVE login
password into the SMB password box — and the dialog treated any non-blank
password as "rotate the credentials file". Every edit became a credential
rotation with the wrong secret. The password field now declares
autocomplete="new-password", and on edit a rotation is only sent when
you actually typed (or pasted) into the field.

Credentials are proven before they're committed (#24)

mount.update used to overwrite the 0600 creds file first and try the
mount last — a failed save left a poisoned creds file that would kill the
mount at the next automount cycle or reboot, where nofail hides it.
Rotation now writes the candidate to a temp file and proves it with a
probe mount — the same probe the Add wizard's Test button uses — before
replacing the real file. A rejected password fails the job and leaves the
creds file and fstab byte-identical.

A completed save now means the new options are live (#25)

The update flow discarded the unmount result, and a busy mountpoint (a
virtiofs export, an open shell) meant the remount silently no-op'd — the
job reported success while the mount kept its old options. A refused
unmount is no longer mounted over: the flow falls back to an in-place
mount -o remount, then reads the mount table back and only completes
when the requested read/write flag is actually live. When it isn't, the
job fails naming the holding processes ("held open by: …") instead of
claiming success. The audit log now records which options an edit
requested, not just the mountpoint.

Persistence is edit-time identity (#27)

The edit dialog offered a Persistent checkbox that the daemon silently
ignored. Persistence is now identity on edit — shown, not editable — like
the protocol and server fields, and the API schema no longer accepts it
on update (older UIs sending it are stripped, not rejected).

Known issues

• Rotating CIFS credentials now requires the SMB server to be reachable
  at edit time — an unprovable secret commits nothing, so a rotation
  against a powered-down NAS fails where it previously "succeeded" (and
  quietly broke the mount). Deliberate, but a behavior change.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an
existing install is the upgrade path).

ANAS 0.2.6

A single-fix release, and a rare one: the fix was proven live by the
reporter before it shipped. Pools created or imported through ANAS now come
back after a reboot even on hosts where ZFS's cachefile mechanism fails.

Pools survive reboot — per-pool import units, like PVE itself (#22)

ANAS ran a bare zpool create / zpool import and left the boot-time
import entirely to /etc/zfs/zpool.cache. That usually works — but on some
PVE hosts (root-on-ZFS in particular, where the initramfs can restore a
stale cachefile copy over the real one at early boot) the cache reaches
boot without the pool in it, and the pool is simply gone until someone
reimports it. The reporting host lost its pool on every reboot, UI
reimports notwithstanding. Proxmox hit this same failure years ago (their
bug #2554) and their GUI's answer is a per-pool systemd unit,
zfs-import@<pool>.service, which imports the pool by name at boot
independently of the cache.

ANAS now does exactly what PVE does: pool create and pool import both
enable the unit (an import targeted by GUID resolves what it actually
imported by diffing the pool list), and pool destroy disables it. The two
boot-import mechanisms back each other up from here on.

Details that matter:

• Best-effort by design. By the time the unit is touched, the
  create/import/destroy has already succeeded — a systemctl hiccup
  surfaces as a warning in the job result, never as a failed job.
• The unit name is escaped exactly as systemd escapes it — a hyphenated
  pool is zfs-import@my\x2dpool.service, not zfs-import@my-pool.service.
• Existing pools created by earlier ANAS versions don't have the unit
  yet. Either enable it once by hand
  (systemctl enable zfs-import@<pool>.service) or export and reimport the
  pool through the ANAS UI on 0.2.6, which now enables it for you.

Known issues

• The import unit is a oneshot, like every stock ZFS boot unit — a disk
  that enumerates after the ZFS import units run (very slow USB
  enclosures) can still miss the boot import. Not observed in the wild; the
  reported failure was cache staleness, which this release fully covers.

Install / upgrade

Untar on the PVE node and run sudo ./install.sh (re-running over an existing
install is the upgrade path; it will add samba/nfs-kernel-server if missing).