Files

T

Sergey Antropoff 777926487b Add a stateful Proxmox API console and broad handler coverage beyond the

initial QEMU slice, backed by imported contracts for majors 6–9.
- Implement durable handlers for access/auth, cluster, LXC, storage, HA,
  firewall, Ceph, SDN, ACME, notifications, pools, mapping, and node ops
- Serve an interactive Web UI with catalog browsing, demo seed controls,
  and OpenAPI/help surfaces
- Bundle PVE 6.4-15, 7.4-16, and 8.4.5 contract revisions alongside 9.2.3
- Support in-memory runtime contract Apply (POST /ui/api/contract/apply)
  so /version and /api2 routes follow the selected major until restart
- Expand seed profiles (including demo-cluster), migrations 007–008, TLS
  gateway config, Compose/Makefile tooling, and compatibility evidence
- Tighten .gitignore for macOS, hidden directories (.*/), and local secrets

2026-07-16 01:08:01 +03:00

1.6 KiB

Raw Blame History

Security

Lab threat model

This project is a local / CI laboratory simulator. It is not hardened as a multi-tenant public Proxmox service. Default credentials, UI demo controls, and compatibility endpoints are convenient for development and intentionally open in the default Compose stack.

Do not expose ports 8006 / 8007 to untrusted networks without additional controls you supply yourself.

Credentials and secrets

Passwords and API-token secrets are stored as scrypt hashes.
Ticket values are HMAC-signed and short-lived.
CSRF binds mutations to ticket sessions.
Logs redact recognized ticket, password, and token representations.
Create/regenerate token responses show the secret once; GET never echoes it.

Change TICKET_SIGNING_KEY for any shared lab. Replace seeded passwords and tokens before demoing to others.

TLS materials

docker/tls/ contains a checked-in self-signed certificate for the local gateway. It exists so unmodified TLS clients (e.g. proxmoxer) can connect. Never reuse these files in production.

Simulator administration

There is currently no separately authenticated /_simulator control plane. Web UI helper routes under /ui/api/* and /admin/compatibility* are available whenever the process is reachable. Treat network exposure as the trust boundary.

Simulated remotes

LDAP sync stamps, OpenID pending state, ACME, and Ceph endpoints persist local simulator state only. They do not open real connections to external IdPs or clusters. Do not rely on the simulator for testing live credential exfiltration defenses against real providers.

1.6 KiB Raw Blame History