Skip to content

Nimbus Direct v1.7.0

Choose a tag to compare

View all tags
@eurosatofficial eurosatofficial released this 11 Aug 22:28
· 9 commits to main since this release
v1.7.0
3d07d1c

Nimbus Direct 1.7.0 — Passkeys & Advanced Console Controls

Nimbus Direct 1.7.0 introduces passwordless WebAuthn authentication and a significantly improved graphical VM console.

Passwordless passkeys

Users can now sign in securely without entering their Nimbus password.

  • WebAuthn passkey authentication
  • Support for Touch ID, Face ID, Windows Hello, Android screen lock, and hardware security keys
  • Discoverable credentials with mandatory user verification
  • Strict hostname and HTTPS origin validation
  • Credential counter verification
  • One-time authentication challenges
  • Rename and remove personal passkeys
  • Administrator-assisted passkey reset
  • Automatic session revocation after administrative resets
  • Passkey activity included in security auditing and notifications
  • Passkey adoption visible in the Security & Access Center

Nimbus stores only public credential information. Private keys and biometric information never leave the user’s device.

Advanced noVNC console controls

The graphical QEMU console now includes a dedicated responsive toolbar.

Available controls:

  • On-screen keyboard
  • Ctrl, Alt, and Super/Windows modifier keys
  • Tab and Esc
  • Ctrl+Alt+Delete
  • Safe clipboard text paste
  • Fit display to window
  • Optional remote-display resizing
  • Low-bandwidth, balanced, and sharp quality modes
  • Persistent display preferences
  • Fullscreen mode
  • Explicit console disconnect

The toolbar works across desktop and smaller browser layouts.

VM power commands are intentionally not exposed through noVNC. Shutdown, reboot, reset, and other power actions continue through Nimbus so assignment permissions, rate limits, task tracking, and audit logging remain enforced.

Security improvements

  • Passkey registration requires the current Nimbus password
  • Administrative passkey resets require administrator-password confirmation
  • Failed passkey attempts are recorded safely for known accounts
  • Security changes revoke affected sessions where appropriate
  • WebAuthn challenges are short-lived, scoped, hashed, and single-use
  • Existing Proxmox credentials remain entirely server-side
  • Console sessions continue using encrypted, short-lived, one-time tickets

Enabling passkeys

Add the permanent public Nimbus hostname to .env:

WEBAUTHN_RP_ID=nimbus.example.com
WEBAUTHN_ORIGIN=https://nimbus.example.com
WEBAUTHN_RP_NAME=Nimbus Direct

WEBAUTHN_RP_ID must be the public hostname without a scheme or port. WEBAUTHN_ORIGIN must exactly match the HTTPS address used to access Nimbus.

Leave WEBAUTHN_RP_ID and WEBAUTHN_ORIGIN empty to keep passkeys disabled.

After deployment, users can enroll a passkey under Settings → Passkeys.

Upgrade notes

  • Release archive: nimbus-direct-1.7.0.zip
  • No manual database migration is required
  • The WebAuthn migration is applied automatically during startup
  • No additional Proxmox permissions are required
  • Graphical consoles continue using the existing VM.Console privilege
  • Passkeys require no Proxmox privileges
  • Back up the Nimbus data volume before updating

Rebuild the panel using both Compose files:

docker compose \
  -f compose.yaml \
  -f compose.internal.yaml \
  up -d --build --force-recreate panel

Verification

Nimbus Direct 1.7.0 passes the complete 92-test project suite, including dedicated tests for:

  • WebAuthn origin and relying-party validation
  • User-scoped passkey management
  • One-time challenge consumption
  • Administrator reset protection
  • Session revocation
  • Demo-mode isolation
  • Console toolbar controls
  • Connection-aware console actions
  • Prevention of noVNC power-command bypasses
Assets 2
Loading