NASty 0.0.13 — VMs, snapshots & storage triage

This is the VMs, snapshots & storage-triage release. NASty's virtual machines grow up — attached disks survive a host reboot, starting a VM tells you the truth instead of faking success, and you can edit NICs and resize disks straight from the VM card. Data recovery gets two new routes: whole-subvolume rollback to a snapshot and file/folder restore out of a snapshot without rolling anything back. Storage triage gets louder and clearer with live scrub/evacuate/rebalance progress, an operations panel to cancel and pause array work, and a bundled diskwatch diagnostics TUI. Apps deployment gets multi-port ingress fixes, per-host TLS and firewall visibility, and the sidebar gains an opt-in Common menu. On the latest kernel (6.18.37), with a sweep of security and dependency housekeeping.

Headline changes

• VM lifecycle hardening (#593, #584, #585). Attached virtual disks now survive a host reboot — loop devices re-map correctly on boot instead of disappearing. Starting a VM reports the truth: if it can't launch (a missing bridge, a bad config), you get a real error instead of a phantom "running" — start now waits for the QMP monitor before claiming success. And you can edit a VM's networking (mode + bridge) and resize its disks right from the VM card, gated to stopped VMs.

• Snapshot recovery, two ways (#577, #576). Whole-subvolume rollback returns a subvolume to a snapshot with a clean quiesce → swap → resume, and file & folder restore pulls individual files or directories back out of a snapshot without rolling back the whole thing.

• Storage triage you can see (#562, #556, #561, #596). Live progress for scrub / evacuate / rebalance, streamed straight from bcachefs moving_ctxts. A new operations panel to cancel a scrub/evacuate or pause reconcile/copygc. Stable device ordering plus a guided force-remove flow. And a bundled read-only diskwatch disk-diagnostics TUI (devices, SMART, IO, hot files, bcachefs-aware) for triage over SSH or the built-in terminal.

• Opt-in Common navigation menu (#589). A Full ↔ Common toggle offers a curated short-list of the pages you actually use, without forcing it on anyone — flip back to Full anytime. The theme switch moves into the profile dropdown, and the power button is now icon-only.

VMs

• Virtual disks survive a host reboot — loop devices re-map correctly on boot (#593).
• VM start reports a real error instead of a phantom "started"; waits for QMP before claiming success (#584).
• Edit NIC mode/bridge and resize virtual disks from the VM card, gated to stopped VMs (#585).
• Always-on QEMU guest agent + per-box VMware/Hyper-V toggle; KVM guest-tools hint (#550, #551).
• Manual disk-type override for VM environments where detection is unreliable (#555).

Storage & snapshots

• Whole-subvolume rollback to a snapshot — quiesce → swap → resume (#577).
• Restore individual files or folders from a snapshot (#576).
• Live scrub/evacuate/rebalance progress from bcachefs moving_ctxts (#562).
• Operations panel — cancel scrub/evacuate, pause reconcile/copygc (#556).
• Device management: stable ordering + guided force-remove (#561).
• diskwatch disk-diagnostics TUI bundled on the CLI (#596).

Apps & Docker

• Ingress upstream port persists — fixes 502s on multi-port apps (#582).
• TLS certs for app ingress hosts registered and surfaced on deploy (#564).
• Docker-published app ports surfaced on the Firewall page, with contiguous ranges collapsed into one row (#565, #566).
• Host-network deploys; port-range parsing in the paste-docker-run creator; Edit shows only published ports; subdomain preserved on Edit; engine-managed manifest keys preserved across reinstall; Networks section rendered below the apps table (#568, #569, #567, #570, #573, #572).

Networking & notifications

• Custom bridge MTU emitted under 802-3-ethernet.mtu — a jumbo-frame bond no longer breaks the bridges on top of it (#583).
• SMTP notifications work against a no-auth relay (#560).

System & UI

• Opt-in Common navigation menu; theme toggle moved to the profile dropdown; icon-only power button (#589).
• Accurate hardware-configuration.nix header on fresh installs — no longer points at a file that doesn't exist on the appliance (#587).

Dependencies & security

• Weekly nixpkgs bump — Linux 6.18.36 → 6.18.37 (#557, #597).
• anyhow bumped to 1.0.103 — RUSTSEC-2026-0190 (#590).
• Evaluated and documented two DoS-only quick-xml advisories reachable only via the operator-chosen backup target — RUSTSEC-2026-0194 / RUSTSEC-2026-0195 (#598).
• WebUI in-range dependency bumps: SvelteKit / Svelte / Vite / svelte-check / CodeMirror (#563).

---

Proxmox users: NASty requires UEFI. Switch the VM firmware from SeaBIOS to OVMF before installing, otherwise NASty won't boot after the first restart.

⬇