Skip to content

Nimbus Direct v1.4.0

Choose a tag to compare

View all tags
@eurosatofficial eurosatofficial released this 02 Aug 13:22
· 19 commits to main since this release
v1.4.0
fc38762

Nimbus Direct v1.4.0 — API Platform, Integration Keys & Hybrid Console

Nimbus Direct 1.4.0 is the largest release so far. It introduces the complete Nimbus API foundation, customer-managed integration keys, stronger account security, public demo support, full panel dark mode, improved resource synchronization, and a hybrid Proxmox console system.

Nimbus still communicates exclusively through the official Proxmox API. No agent, daemon, package, or custom software must be installed on Proxmox nodes.

Security & Access Center

Administrators now have a centralized security workspace containing:

  • MFA coverage across active accounts
  • Separate required-2FA policies for administrators and customers
  • Restricted enrollment sessions for accounts that must configure 2FA
  • Active session totals
  • Successful and failed login statistics
  • Security-focused audit events with source information
  • Optional successful-login email notifications
  • Password-change and administrator-reset security emails
  • User-visible session review and individual session revocation
  • Administrator-assisted 2FA reset with session invalidation

Security policies default to disabled, preventing an upgrade from accidentally locking out an existing administrator.

All enforcement happens in the backend on every request.

Nimbus API v1

This release introduces the complete versioned Nimbus API for automation, integrations, and future first-party clients.

Features include:

  • HTTPS API discovery and compatibility checking
  • Short-lived bearer access tokens
  • Single-use rotating refresh tokens
  • Refresh-token reuse detection
  • Automatic revocation of compromised device sessions
  • Password, authenticator, and recovery-code authentication
  • Device-session review and revocation
  • Customer assignment and permission enforcement on every request
  • Administrator access to every currently discovered VM and container
  • OpenAPI 3.1 documentation
  • Customer-safe resource, usage, network, task, snapshot, media, notification, maintenance, support, and console endpoints

Customers remain limited to their direct Nimbus assignments. The API never exposes Proxmox credentials or unrestricted Proxmox responses.

Customer integration API keys

Users can now create API keys for Home Assistant, monitoring, automation, scripts, and private integrations.

Administrators define the maximum policy for each user:

  • Allowed permission groups
  • Allowed VMs and containers
  • Maximum active keys
  • Maximum key lifetime
  • Whether non-expiring keys are permitted

Available permission groups include:

  • Server overview
  • Power management
  • Snapshot management
  • Installation media
  • Console access
  • Notifications
  • Maintenance information
  • Support tickets

Users can choose a subset of the administrator-approved permissions and resources. Nimbus displays the complete effective permission summary before creating the key.

Additional protections include:

  • One-time secret display
  • nmb_key_ key prefix
  • Hash-only secret storage
  • Optional expiration
  • Current-password and 2FA confirmation
  • Immediate revocation
  • Live intersection with customer assignments and administrator policy
  • Automatic loss of access when an assignment or permission is removed
  • Integration keys cannot manage passwords, 2FA, sessions, or other API keys

Reducing an administrator policy immediately reduces the affected keys without requiring key rotation.

Hybrid terminal and graphical console

Nimbus now automatically selects the correct Proxmox console:

  • LXC containers use Proxmox termproxy with xterm.js
  • QEMU guests configured with a serial display use termproxy
  • Graphical QEMU guests continue using noVNC

The terminal console includes mobile-friendly controls for:

  • Keyboard access
  • Escape
  • Tab
  • Ctrl+C
  • Clipboard paste

Security protections include:

  • Short-lived, single-use console sessions
  • Encrypted console tickets
  • Same-origin WebSocket routing through Nimbus
  • Server-side Proxmox WebSocket authentication
  • No long-lived Proxmox API token in the browser
  • Backend assignment and permission validation before ticket creation
  • Automatic terminal or graphical mode selection

Both console types use the existing Proxmox VM.Console privilege.

Public read-only demo mode

Nimbus can now power a safely isolated public demonstration instance.

When interactive demo mode and read-only mode are enabled together:

  • Nimbus uses simulated infrastructure
  • Real Proxmox and SMTP configuration is rejected
  • Dashboards, instances, usage history, networking, support, and administrator pages remain browsable
  • Power actions, console access, uploads, configuration changes, account changes, and every other product mutation are rejected centrally
  • The interface clearly identifies the public demo
  • Regularly resetting the demo database is not required for normal visitors

When both demo settings are disabled, Nimbus operates normally.

Complete panel dark mode

Persistent appearance settings are now available throughout the web panel:

  • System
  • Light
  • Dark

Dark mode covers:

  • Sign-in and account pages
  • Customer dashboards
  • Instance lists and details
  • Usage charts
  • Snapshot and ISO management
  • Network information
  • Notifications and maintenance
  • Support tickets
  • Operations Center
  • Security & Access Center
  • Administration forms and dialogs
  • Terminal and graphical console interfaces

Additional contrast corrections were made to support conversations, security counters, status panels, shared form controls, and resolved-ticket notices.

Resource synchronization improvements

Resource synchronization is now safer and more accurate:

  • Guests removed from Proxmox disappear after the next successful synchronization
  • Missing guests are marked stale
  • Stale guests are excluded from dashboards, counts, API-key resource lists, and action authorization
  • Existing customer assignments remain preserved in the database
  • A failed Proxmox request never removes or marks resources stale
  • Assignments automatically become usable again if the same cluster, resource type, and VMID return
  • Customers cannot interact with a stale resource
  • Administrators only see currently discovered resources in active inventories

This preserves customer configuration during temporary Proxmox failures without leaving deleted VMs permanently visible.

Correct QEMU storage usage

Nimbus now collects real QEMU filesystem usage through the official QEMU Guest Agent API.

The implementation:

  • Reads persistent guest filesystems
  • Filters temporary, pseudo, image, read-only, and duplicate mounts
  • Combines valid persistent filesystem usage
  • Preserves the last valid reading while a VM is stopped
  • Preserves the last valid reading during temporary Guest Agent failures
  • Displays usage as unavailable when no valid reading exists
  • No longer presents 0 GB as genuine QEMU usage

LXC storage continues to use the official Proxmox container metrics.

This feature does not install anything inside a VM. It only uses an already configured QEMU Guest Agent through the Proxmox API.

Network address reliability

Network information now loads more consistently across:

  • Customer dashboards
  • Instance lists
  • Instance details
  • Network pages
  • API resource responses

Nimbus prefers live Guest Agent or LXC interface information and falls back to allowlisted static configuration when live information is unavailable.

Cached address discovery is reapplied when dashboards and resource lists refresh, preventing addresses from disappearing until the Network page is opened.

Administrator resource access

Interactive administrators can now view and control every currently discovered VM and container, including resources that are not assigned to a customer.

Customer sessions and customer API keys remain strictly limited to active direct assignments.

Public API documentation

The release includes expanded documentation for:

  • API discovery
  • Authentication flows
  • Token rotation
  • Device sessions
  • Integration API keys
  • Permission groups
  • Resource authorization
  • Power actions
  • Snapshots
  • ISO management
  • Networking
  • Notifications
  • Maintenance
  • Support tickets
  • Console sessions
  • OpenAPI 3.1 endpoint discovery

Coming soon: Nimbus Direct for iOS

The new Nimbus API is also the foundation for the upcoming native Nimbus Direct iOS app.

The app is still under active development and is not considered part of the stable 1.4.0 release. It will be published separately when authentication, infrastructure management, console access, notifications, and the remaining mobile workflows are ready for production use.

Database upgrades

Nimbus automatically applies the new additive migrations during startup:

  • Security & Access Center state
  • Nimbus API device and refresh-token sessions
  • User integration API keys
  • Future native notification infrastructure
  • Hybrid console session metadata

No manual database migration command is required. Existing customers, assignments, configuration, and audit history are preserved.

Back up the SQLite volume and APP_SECRET before upgrading.

Upgrade instructions

Release file:

  • nimbus-direct-1.4.0.zip

Extract the archive over the existing installation while preserving your .env, secrets directory, and Docker volume.

Rebuild Nimbus using the internal Proxmox routing overlay:

docker compose \
  -f compose.yaml \
  -f compose.internal.yaml \
  up -d --build --force-recreate panel

Proxmox permissions

No new node-side software is required.

The hybrid console uses the existing:

VM.Console

Live QEMU network and filesystem information requires:

VM.GuestAgent.Audit

Nimbus continues to use direct local resource assignments and does not require one Proxmox resource pool per customer.

Verification

This release was verified with 78 passing automated tests covering:

  • Customer and administrator authorization
  • Direct resource assignments
  • Security policies and MFA enforcement
  • Failed-login audit events
  • Integration API-key scope intersection
  • Token rotation and refresh-token reuse
  • Public demo read-only enforcement
  • Stale-resource synchronization
  • QEMU storage usage
  • Network address discovery
  • Terminal and graphical console selection
  • Snapshot and ISO isolation
  • Customer support isolation
  • Credential encryption
  • Audit logging
  • Dark-mode rendering

Nimbus Direct 1.4.0 transforms the panel into a complete infrastructure platform with a secure first-party API, controlled automation access, stronger account protection, and a much more capable console experience.

Assets 2
Loading