AlchemillaHQ/Sylve v0.3.0

on GitHub

Virtual Machines and Jails

• Added staged, same-cluster migration for VMs and Jails. Sylve performs an initial recursive ZFS transfer while the guest can remain online, revalidates the target, stops the source for a final incremental sync, transfers ownership, recreates the guest on the target, and cleans up the source only after successful cutover.
• Migration includes preflight checks, actionable warnings, progress reporting, early-stage cancellation, durable recovery, and guards against conflicting lifecycle, backup, replication, and storage operations. This is intentionally not live migration, but the bulk transfer occurs before the interruption window.
• Added built-in pkgbase Jail bootstrapping for FreeBSD 15.0 and 15.1, with both Base and Minimal variants stored as reusable ZFS datasets.
• Expanded Jail networking with multiple interfaces, VLANs, raw network objects, cleaner inherited-network handling, and more reliable rc.conf synchronization without duplicate entries.
• Added Jail execution timeouts, FSTab presets including a Simple Linux layout, additional allow.* capabilities, optional Sylve-managed DevFS, safer custom DevFS rules, console-log rotation, and nested-filesystem cleanup during lifecycle and HA transitions.
• Expanded VM configuration with boot ROM selection, ARM64 U-Boot support, extra Bhyve options, native libvirt XML for QEMU Guest Agent and VirtIO 9P devices, validated VNC bind addresses, serial-console management, and multi-user serial-console access.
• Improved VM networking and storage with per-device enable controls, better boot-order handling, sparse ZFS volumes by default, safer disk import/attach/detach transactions, multi-pool path correctness, and protection against raw-disk truncation.
• Reworked PCI passthrough selection into a searchable, usage-aware list that keeps stale assignments visible for removal. CPU pinning and multi-socket topology handling were also corrected.
• Lifecycle actions now favor graceful shutdown and reboot paths, expose clearer pending states, and apply stronger deletion, snapshot, ID-reuse, and destructive-action guards.

Networking and firewall

• Added integrated PF firewall management with ordered traffic rules, NAT and masquerade rules, combined TCP/UDP rules, reusable network objects, bulk operations, counters, route suggestions, and service-aware telemetry.
• Added advanced PF configuration sections and rendered previews for custom pre/post rule fragments and object tables.
• Added live PF logging with filtering and more resilient capture startup across modern BPF-tap and legacy pflog interface paths.
• Added a complete WireGuard server workflow with peer provisioning, key generation, route management, IPv4/IPv6 masquerading, managed firewall rules, status and transfer metrics, and export as text, file, or QR code.
• Added persistent outbound WireGuard clients with configuration import, route and FIB controls, MTU and keepalive settings, lifecycle management, and connection metrics.
• Added managed IPv4 and IPv6 routes, including network-object references and optional IPv6 scope interfaces.
• Added mDNS settings and record management, including Samba-managed records and a FreeBSD-compatible responder lifecycle.
• Improved standard and manual switches with manual addressing, clearer IPv6 behavior, optional offload disabling, upstream gateway guidance, scoped Jail epair handling, bridge recovery, and more reliable dhclient process management.
• Hardened DHCP ranges, leases, interfaces, network-object ordering, port-conflict detection, and runtime reconciliation throughout the networking stack.

Clustering, backups, and replication

• Added durable, manifest-backed backup generations so recursive datasets and multi-pool VM storage roots are committed and restored as one coordinated set.
• Expanded restore workflows with in-place job restore, out-of-band restore, guest metadata recovery, encrypted-source handling, destination validation, progress visibility, and rollback when a multi-root restore cannot complete safely.
• Added guest-centric backup pages for VMs and Jails, friendly workload names, stronger source discovery, runner-aware target readiness, strict live-inventory placement checks, and cluster-wide job/event visibility.
• Made backup scheduling, provisioning, key rotation, queued restores, job deletion, runner rebinding, and follower-completed operations durable across Raft leadership changes and restarts.
• Hardened replication with fresh ownership leases, continuous fencing evidence, protected autostart, safe demotion and cutover, standby recovery, crash reconciliation, clone-dependency checks, mutation guards, and bounded forced-recovery behavior.
• Hardened the cluster control plane with deterministic replicated state, follower verification and repair, quorum-aware scheduling, safer leader forwarding, authenticated SSH command boundaries, dynamic listener addressing, duplicate-node rejection, and conflict-aware peer removal.
• Added cluster-wide ZFS encryption-key handling and safer encrypted backup/restore and failover behavior.

Replication remains early access in the v0.3.x series. It is hidden behind the Replication experimental UI toggle, requires at least three Raft voters for HA policies, and should be used alongside independent backups rather than as a replacement for them.

Storage, disks, and file services

• Added first-class iSCSI initiator and target management, including CHAP and MutualCHAP, portals, ZFS-volume LUNs, connection status, reconnect controls, service reconciliation, and guards that prevent disconnecting storage used by an imported ZFS pool or deleting a target with live sessions.
• Rebuilt the ZFS dashboard with pool health and capacity summaries, live and historical bandwidth/IOPS/latency, scrub and resilver state, ARC/L2ARC telemetry, and cache-pressure indicators.
• Expanded ZFS pool creation and management with special and dedup VDEVs, improved topology rendering, custom pool mountpoints, device detach, safer striped-pool creation, and clearer child devices for log and special VDEVs.
• Added filesystem and volume properties for read-only state, sparse/refreservation behavior, and volume flashing. Snapshot, dataset deletion, encryption, rollback, and replication-state guards were tightened.
• Added scheduled and on-demand S.M.A.R.T. self-tests, progress and history, abort support, stable disk identity tracking, periodic health monitoring, and notification templates.
• Significantly improved ATA, SCSI/SAS, and NVMe health parsing, including temperature, wearout, sector, transport, and self-test data, while reducing false alerts for unavailable or protocol-specific fields.
• Improved disk partitioning and wiping with stale GPT recovery, safer create/delete semantics, 4Kn detection, and collision-resistant disk identifiers.
• Expanded Samba management with per-share enable controls, Apple extensions and AppleDouble handling, guest ACL fixes, managed mDNS entries, more resilient reconciliation, granular auditing, and audit-log rotation fixes.
• Added browser uploads to Downloader and File Explorer with shared size/concurrency limits, staging, completion tracking, safer paths, and better handling of large files and interrupted transfers.

Services, notifications, and authentication

• Added certificate management for imported PEM material, self-signed certificates, direct Let's Encrypt issuance, and free Sylve.app-managed certificates. Certificates can be renewed, exported, archived, retried, and scheduled for activation on restart.
• Added Dynamic DNS with Cloudflare, Namecheap, and free Sylve.app providers; A, AAAA, and dual-stack records; STUN, interface, and manual address sources; scheduled/manual synchronization; and integration with WireGuard exports and managed TLS.
• Added a notification center with in-app notifications plus ntfy, SMTP email, and Discord transports. Rules support testing, bulk updates/deletion, and templates for disk S.M.A.R.T., self-test, and ZFS pool-state events.
• Added import and management of FreeBSD/PAM users, improved local-user and group management, editable administrator details, login rate limiting, clearer login diagnostics, and a one-shot admin.forcePasswordReset recovery option. PAM authentication is disabled by default and can be enabled explicitly with auth.enablePAM.
• Tightened session lifecycle, JWT parsing, cluster token scopes, internal trust boundaries, audit consistency, credential redaction, and authorization across HTTP, WebSocket, SSE, downloads, and inter-node requests.
• Added persistent FreeBSD sysctl management with a configured-only view. Existing vfs.zfs.arc_max entries are migrated to the canonical vfs.zfs.arc.max OID, and an explicit ARC maximum overrides Sylve's automatic tuning.

Interface, observability, and CLI

• Redesigned the resource sidebar with search, list/tree views, sorting, expand/collapse controls, status indicators, and guarded quick actions for VM and Jail lifecycle operations and migration.
• Improved node, VM, Jail, network, and ZFS dashboards with delta-based historical charts, smoother refresh behavior, total disk capacity, better responsive layouts, and visibility-aware polling.
• Added clearer request outcomes, detailed error toasts, safer confirmation dialogs, better destructive-action states, session-expiry handling, debounced connection-loss reporting, and consistent modal behavior.
• Added a root-only local CLI and interactive console over a protected Unix socket. Current workflows cover notes, lifecycle tasks, network objects and switches, downloads, Jail creation/lifecycle/networking/shell access, and extensive VM creation, lifecycle, storage, networking, hardware, options, snapshots, templates, consoles, and QEMU Guest Agent operations.
• Added readable and JSON CLI output, stable result and task IDs, command history, a live TUI status bar, and improved terminal themes.
• Added commit information to the version summary and improved audit, notification, backup, replication, and lifecycle activity views.
• Added and refined Czech, German, and Simplified Chinese localization alongside regenerated catalogs for the wider UI changes.

Documentation, API, and project quality

• Reworked the documentation into a broad first-pass guide for the complete application, with updated navigation, screenshots, videos, safety notes, configuration references, and task-oriented explanations.
• Added end-to-end one-shot guides for a simple VM and Jail, plus refreshed Jellyfin, Rocky Linux, Technitium DNS, and AdGuard Home workflows.
• Added detailed CLI and console documentation, full VM and Jail sections, networking and firewall guides, storage and iSCSI guides, authentication, notifications, certificates, Dynamic DNS, backups, replication, clustering, and migration documentation.
• Regenerated and corrected Swagger/OpenAPI annotations and standardized REST behavior across the backend.
• Consolidated CI and release gates, added frontend type and Svelte checks, introduced repository-wide quality/fix targets, split deterministic and external-state test lanes, improved test-duration reporting, and substantially expanded unit, integration, cluster, ZFS, console, and FreeBSD acceptance coverage.
• Added a demo build and embedded documentation demos, refreshed contributor and translation guidance, and documented the project's LLM contribution policy.

Reliability fixes

This release also contains a large number of targeted fixes, including:

• VM storage deadlocks, atomic imports, disk detach behavior, VNC validation, PCI update serialization, CPU pinning, guest-agent state, and deletion-policy correctness.
• Jail CTID reuse, bootstrap handling, custom DevFS replacement, resolver placeholders, console monitoring, lifecycle cleanup, and network configuration synchronization.
• Standard-switch bridge recovery, DHCP client teardown, IPv6 bridge behavior, PF rule/object ordering, large PF tables, firewall counters, and PFLog recovery.
• ZFS event coalescing and cache invalidation, encrypted restore handling, custom mountpoints, dataset deletion rules, snapshot cleanup, and pool telemetry recovery.
• SCSI/SAS/NVMe S.M.A.R.T. parsing, disk usage detection, Samba guest permissions and auditing, iSCSI service reconciliation, and large upload completion.
• Frontend routing, sidebar state, request result handling, modal layering, responsive tables, stale status indicators, browser crypto compatibility, locale catalogs, and hidden-tab polling.