ProxMenux v1.2.6

Fast bugfix cycle over v1.2.5. Repairs the AI Assistant custom OpenAI endpoint flow that stayed silent on LAN / Docker / localhost hosts and the Secure Gateway wizard that provisioned an ARM64 container on x86_64 Proxmox hosts, plus the improvements shipped alongside on develop: atomic notification delivery, custom SSH port for Borg targets, optional GitHub API token for app-version tracking, and richer replication failure notifications.

🔄 Scheduled LXC updates — logs and restart state

• Scheduled LXC updates now retain the complete output from apply_updates.sh, including output inherited from Proxmox VE Helper-Scripts and any child scripts they invoke.
• The Updates tab exposes the latest scheduled-run log directly from the saved schedule state; logs remain private, are bounded when read and retain only the latest ten executions per LXC.
• After a scheduled run, ProxMenux checks /var/run/reboot-required and records the packages responsible when Debian provides them.
• A pending-restart warning appears in the Updates tab and in the existing completion notification. It is cleared by the existing LXC start/reboot lifecycle event, without adding a polling loop.

🔔 Atomic notification delivery

• Notification events now reserve their deduplication fingerprint atomically before AI processing or channel delivery, preventing concurrent collectors, completion callbacks or accidental parallel Monitor processes from sending the same event twice.
• The reservation is shared through SQLite, expires safely if an execution is interrupted and is released when no channel succeeds, preserving retries after temporary transport failures.

🗄 Borg remote target — custom SSH port (discussion #236, reported by @songochain)

• Add Borg destination now accepts a custom SSH port — both in the Monitor's Add Borg destination dialog and in the shell TUI (menu → Host Backup → New Borg target). The default stays at 22; any value between 1 and 65535 is embedded in the persisted ssh://user@host:port/path URL that Borg's SSH scheme supports natively.
• BORG_RSH honours the custom port at backup time — scheduled jobs and manual runs both add -p <port> to the SSH command so the connection lands on the right port instead of falling back to 22.
• The auto-key-install flow (generate-auto) now targets the custom port too, so users who let ProxMenux push the SSH key to the Borg server via sshpass succeed against NAS hosts that expose SSH off 22.
• Backwards compatible: existing borg-targets.txt entries created without a port keep working unchanged — the port is only written into the URL when it differs from 22, and the frontend/backend both interpret a missing port as 22 for older targets.
• Capacity probes over SSH (used to render the "Available" badge on each destination card) also honour the custom port, so the capacity chip lights up even when the target is on a non-standard port.

🎯 App version tracking — optional GitHub API token (discussion #306, reported by @SystemIdleProcess)

• Settings → GitHub API now accepts an optional personal access token for release and tag checks when GitHub's anonymous request quota is exhausted.
• The token is encrypted at rest, is never returned to the browser and can be replaced or removed independently of the Notifications service.
• The anonymous GitHub flow remains the default; a token is not required for public repositories while the shared unauthenticated quota is available.
• The rate-limit error now points to the actual setting and is translated in every Monitor language.

🔁 Replication failure notifications — complete job context (reported by Ale R.)

• Native Proxmox replication webhooks now resolve the replication job ID, affected VM/LXC ID and guest name before rendering the notification.
• The exact error block supplied by Proxmox is preserved as the reason, including multiline failures, with the complete message retained as a safe fallback when the block is absent.
• Replication notifications are identified by their complete job ID, keeping failures from different replication jobs independent during deduplication.

🛠 AI Assistant custom OpenAI endpoint — LAN / Docker / localhost URLs work again (issue #325, reported by @jorgeffonte)

• Custom OpenAI-compatible endpoints reachable on private IPs, loopback or Docker networks (LiteLLM, LM Studio, LocalAI, vLLM, OmniRoute, self-hosted proxies…) are now allowed by the Notifications API — the SSRF guard that fetches the model catalogue and validates the AI configuration recognises these deployments as legitimate local backends instead of blocking them.
• The dropdown feedback loop is complete: when the endpoint or key rejects the request, the reason returned by the server (or the underlying network error) is now surfaced right under the Load button, so misconfigurations no longer look like a silent empty list.
• A new translation key covers the failure copy in every Monitor language.

🛠 Secure Gateway wizard — LXC template matches host architecture (issue #324, reported by @N0X4DD0)

• Alpine template download now filters pveam available results by the host's actual architecture (via dpkg --print-architecture, falling back to uname -m), so an x86_64 Proxmox host downloads the amd64 template instead of picking up the arm64 build as a lexicographic first match.
• Local template selection applies the same architecture filter when reusing an already-downloaded Alpine template, avoiding cross-arch reuse when both variants coexist.
• pct create is invoked with an explicit --arch <host> so the container metadata reflects the host's real architecture, preventing the "exec format error" reported on x86_64 systems where the wizard had been provisioning arm64 containers.
• The oci_manager backend that runs docker, VPN and gateway wizards is the sole caller of this path, so the fix reaches every Secure Gateway variant automatically.