PegaProx v1.1.0

67 commits since v1.0.2. A big one: a full security-hardening pass (Aikido authz re-triage),
rolling-update robustness, console/VNC stability, ESXi→Proxmox Ceph-RBD migration fixes, a usable
phone layout, and a lot of i18n.

🔐 Security & authz

• Closed 15 BOLA / IDOR / token-scope findings from the Aikido AI-pentest re-triage, plus a
  follow-up hardening batch and CodeAnt tightening.
• API-token effective_role now propagates into cluster/search/VMware access (#491); PBS
  cred-exfil and cluster-wide-balance paths are tenant-confined.
• Auto-balance worker, VM inventory and PBS auto-attach can no longer be reached via a pool/ACL
  fallback; a token's custom-role name is preserved so its tenant scope resolves correctly.
• The live resources SSE stream is now scoped to each client's per-VM ACLs (#736).

✨ Features

• Usable phone layout — off-canvas sidebar drawer + responsive shell (#189).
• Re-pin SSH host keys after a node's key changes (e.g. post-CIS-hardening), with an actionable
  log when a node refuses SSH password auth (#717).
• Optional node FQDN suffix for "Open in Proxmox" links (#689).
• sshd-hardening safety rails — reversible umask-027, lockout warnings, apply-confirm
  acknowledgements (#16745).
• Missing VGA options in the hardware dialog (#710).

🐛 Fixes

Rolling updates / maintenance

• Don't burn 120 s waiting for HEALTH_OK on a benign Ceph WARN (slow BlueStore ops) (#747).
• Evacuation no longer fails on VM is locked (migrate) when the guest is already migrating (#647).
• Don't fake a reboot when none is needed; persist soft maintenance across a restart (#715, #720).

Console / VNC

• Serialize SSL access on the PVE VNC leg to stop intermittent disconnects (#713).
• noVNC proxy bind + offload now work under gevent on Python ≥ 3.13 (#740).
• TaskBar auto-expands only for a task you actually just started (#738).

Migration / storage

• ESXi→Proxmox with non-krbd Ceph RBD targets: map librbd URIs to a block device + route the
  EFI fallback through them (#722).
• Preserve source MAC/hostname and force onboot=0 on local replicas (#646).
• Hide node-restricted storages; snapshot a running LXC before a DR test-clone (#708, #709).

UI / display

• PBS passed disk status no longer renders red; the overview "VMs Stopped" count uses the
  explicit stopped status instead of total − running (#751, #749).
• Firefox: a press-drag after cancelling the shell SSH dialog no longer shoves the layout
  off-screen (#727).
• Corporate light/dark theme handling (#742); WebAuthn/passkey-only login prompt (#746); iLO 4
  stale SEL assertions no longer latch a node as Critical (#714); Ceph overview health object (#735).

ACME

• Honour the "allow private CA" checkbox sent with a cert request; write issued certs to the
  directory the TLS listener actually serves from (#730, #725).

🌍 i18n

• New Polish translation (#737), shell-terminal keys across all 8 languages (#726), and a
  backfill of every language to full English parity (de/zh/fr/es/pt/ko/it).

🧰 Project

• A PR template + CONTRIBUTING guide with a scope / AI-review bar; CI now nudges (and auto-closes)
  issues/PRs opened with the template deleted, and asks contributors to name the AI model they used.

💎 Platinum sponsors: netwolk · eXpertiZe · Netzware · Occentus

If PegaProx saves you time, please consider supporting it → https://opencollective.com/pegaprox 🐾