Version 0.0.23.post2
netbox-proxbox 0.0.23.post2 adds bounded endpoint auto-configuration and
credential establishment for the Proxbox backend. It retains the existing
backend and SDK pairing and supports NetBox 4.5.8 through 4.6.99
(validated against 4.5.8 through 4.5.10 and 4.6.0 through 4.6.5).
Current pairing: netbox-proxbox 0.0.23.post2 <-> proxbox-api (guest-VM-interface writer build / next release) <-> proxmox-sdk 0.0.12 <-> netbox-sdk 0.0.10.
Compatibility
| NetBox | netbox-proxbox | proxbox-api | netbox-sdk | proxmox-sdk |
|---|---|---|---|---|
| >=4.5.8 | v0.0.23.post2 | guest-VM-interface writer build / next release | v0.0.10 | v0.0.12 |
Migration 0075_fastapi_backend_key_target_fingerprint adds the durable,
credential-free target binding for existing and new backend rows. Run the
normal NetBox migration step during upgrade. No companion-backend upgrade is
required.
Endpoint auto-configuration
- Operators may create or enable a Proxbox backend without pasting an API key.
After the row commits, the plugin probes only the exact URL or IP, port, and
TLS policy saved in that row. A healthy empty backend can complete its
one-time key bootstrap automatically; an initialized backend without a
locally held key remains pending and requires explicit recovery. - When no backend row exists, startup discovery is limited to plugin-configured
targets and same-site names derived from NetBox's trusted public origin. It
does not scan the network, accept arbitrary user-supplied discovery targets,
or follow redirects. - NetBox endpoint configuration can be derived from the trusted local public
origin, and the corresponding token is established through the already
authenticated backend boundary rather than exposed in the UI.
Security behavior
- The persisted endpoint is the complete discovery allowlist. Any IP or domain
that is not the configured target or an explicitly derived same-site target
is rejected before credentials are sent. - Backend ciphertext is bound to a credential-free fingerprint covering the
canonical HTTP target, fallback IP, TLS flags, and WebSocket target. Target
drift fails closed until the operator explicitly re-establishes trust. - Disabled endpoints never perform discovery or network access. HTTP and
WebSocket authentication reject redirects, and ambient proxy settings are
disabled for the credential-bearing WebSocket client.
Operations
On startup, a successfully configured installation logs backend key
verification and the NetBox endpoint push. A configuration that cannot be
proved safe logs a pending result and continues serving NetBox without
attempting an untrusted connection.