Version 0.0.23.post2

netbox-proxbox 0.0.23.post2 adds bounded endpoint auto-configuration and
credential establishment for the Proxbox backend. It retains the existing
backend and SDK pairing and supports NetBox 4.5.8 through 4.6.99
(validated against 4.5.8 through 4.5.10 and 4.6.0 through 4.6.5).

Current pairing: netbox-proxbox 0.0.23.post2 <-> proxbox-api (guest-VM-interface writer build / next release) <-> proxmox-sdk 0.0.12 <-> netbox-sdk 0.0.10.

Compatibility

NetBox	netbox-proxbox	proxbox-api	netbox-sdk	proxmox-sdk
>=4.5.8	v0.0.23.post2	guest-VM-interface writer build / next release	v0.0.10	v0.0.12

Migration 0075_fastapi_backend_key_target_fingerprint adds the durable,
credential-free target binding for existing and new backend rows. Run the
normal NetBox migration step during upgrade. No companion-backend upgrade is
required.

Endpoint auto-configuration

• Operators may create or enable a Proxbox backend without pasting an API key.
  After the row commits, the plugin probes only the exact URL or IP, port, and
  TLS policy saved in that row. A healthy empty backend can complete its
  one-time key bootstrap automatically; an initialized backend without a
  locally held key remains pending and requires explicit recovery.
• When no backend row exists, startup discovery is limited to plugin-configured
  targets and same-site names derived from NetBox's trusted public origin. It
  does not scan the network, accept arbitrary user-supplied discovery targets,
  or follow redirects.
• NetBox endpoint configuration can be derived from the trusted local public
  origin, and the corresponding token is established through the already
  authenticated backend boundary rather than exposed in the UI.

Security behavior

• The persisted endpoint is the complete discovery allowlist. Any IP or domain
  that is not the configured target or an explicitly derived same-site target
  is rejected before credentials are sent.
• Backend ciphertext is bound to a credential-free fingerprint covering the
  canonical HTTP target, fallback IP, TLS flags, and WebSocket target. Target
  drift fails closed until the operator explicitly re-establishes trust.
• Disabled endpoints never perform discovery or network access. HTTP and
  WebSocket authentication reject redirects, and ambient proxy settings are
  disabled for the credential-bearing WebSocket client.

Operations

On startup, a successfully configured installation logs backend key
verification and the NetBox endpoint push. A configuration that cannot be
proved safe logs a pending result and continues serving NetBox without
attempting an untrusted connection.