# netbox-proxbox v0.0.27

netbox-proxbox 0.0.27

| Field |Value |
| --- | --- |
| Canonical URL | https://emersonfelipesp.com/netbox-proxbox/releases/v0.0.27 |
| GitHub URL | https://github.com/emersonfelipesp/netbox-proxbox/releases/tag/v0.0.27 |
| Tag | v0.0.27 |
| State | latest |
| Author | emersonfelipesp |
| Created | 2026-09-24 23:32 UTC |
| Published | 2026-09-24 23:40 UTC |
| Target | main |
| Synced | 2026-09-25 21:05 UTC |
| Assets | 0 |

## Release notes

# Version 0.0.27

## Standalone virtual machine consoles and hardened synchronization

Current backend-runtime pairing: netbox-proxbox 0.0.27 <-> proxbox-api 0.0.23.post2 <-> proxmox-sdk 0.0.15 <-> netbox-sdk 0.0.13. This netbox-sdk version is proxbox-api's REST dependency only and does not provide the semantic MCP bridge.

This release adds a permission-gated Console tab directly to synchronized NetBox virtual machines. QEMU guests support noVNC and terminal sessions, and LXC guests support terminal sessions. The browser connects through the public proxbox-api relay without receiving Proxmox credentials, private topology, or reusable upstream tickets.

RC15 paired with `proxbox-api 0.0.23.post1` and failed the real-stack Page
Coverage gate because the expected backup inventory record was missing. RC16
pairs with post2, which restores that record, but its next Page Coverage run
failed because the mock returned no list-shaped node network response. RC17
retains post2 and adds Proxmox-compatible `{"data": [...]}` network envelopes
for `pve01`, `pve02`, and `pve03`. RC17 passed Page Coverage and TestPyPI but
failed all Docker E2E cells before container startup because `packaging` was
not installed for backend selection. RC18 installs it before that script runs.

- Restores Docker E2E setup across the complete matrix by installing
  `packaging` before the backend-selection script imports it.
- Promotes the RC18 package after Page Coverage, TestPyPI validation on Python
  3.12 and 3.13, and all 66 Docker E2E cells passed.

- Restores node network synchronization in the real-stack Page Coverage gate
  by returning list-shaped Proxmox network data for every fixture node.

- Restores backup synchronization in the real-stack Page Coverage gate with
  `proxbox-api 0.0.23.post2`, which hydrates typed virtual-machine identity
  before filtering backup records.
- Resolves expected Proxmox VMIDs through the typed sync-state API during
  release validation, rejects incomplete, malformed, ambiguous, or
  ignored-filter responses, and verifies the linked NetBox virtual machine.
- Validates the canonical Proxbox home redirect during release checks, rejects
  ambiguous redirect and job-ID forms, and requires every polled Core Job
  resource to match the authoritative response header ID.
- Exposes the exact NetBox Core Job ID on successful Proxbox sync enqueue
  responses and uses that identity during release validation, avoiding
  first-page loss and concurrent same-name false positives under one bounded
  monotonic deadline.
- Gives disposable Page Coverage and Docker E2E Proxmox endpoints an explicit
  60-second request timeout and one bounded retry, avoiding hosted mock-server
  timeouts without changing production endpoint defaults.
- Bounds Proxmox fetch concurrency at one in disposable Page Coverage and
  Docker E2E stacks through the supported plugin settings API, preventing the
  lightweight mock server from dropping simultaneous VM configuration requests
  without changing production defaults.
- Exposes the existing endpoint `credential_storage_backend` field through the
  REST serializer, allowing an explicit `legacy_encrypted` override when
  netbox-openbao is unavailable without changing the global OpenBao setting.
- Keeps the disposable Page Coverage stack self-contained by selecting local
  encrypted storage on its singleton settings before any endpoint credentials,
  without weakening the OpenBao default used by production configuration.
- Runs public release metadata validation with the locked publish virtual
  environment, preventing hosted runners from selecting an unprovisioned
  system interpreter before TestPyPI or PyPI publication.
- Authorizes each console request against the exact NetBox virtual machine and Proxbox endpoint.
- Restores durable endpoint bindings and fails closed when a target cannot be proved.
- Supports the certified NetBox 4.5.8 through 4.7.0 GA matrix with real-Django compatibility coverage.
- Adds pull-based Proxmox metrics and deterministic reconciliation with the existing InfluxDB source.
- Preserves bounded session lifetimes, origin checks, redacted diagnostics, and server-side TLS policy.
- Restores the published `0085_remove_vm_reflection_custom_fields` migration byte-for-byte so package deployment preserves immutable migration history.
- Keeps public release promotion limited to exact repository-linked package provenance; deployment authorization and host evidence remain outside this public repository.
- Adds `credential_reference_id` additively for existing schemas, copies populated historical references without dropping the downgrade-compatible column, and fails closed on structurally ambiguous predecessors. Fresh installs receive the generic field from the sanitized `0064` migration source.
- Resolves the companion RPC plugin's selected backend before considering the sole-backend fallback and refuses to create monitoring rows when selection remains ambiguous.
- Removes the retired external SSH-credential fallback. Every enabled API + SSH node must have a local `NodeSSHCredential`; disabled and API-only nodes are reported separately and do not block the upgrade. Run `python manage.py audit_node_ssh_credentials --fail-on-missing`, create local credentials for every blocker, and do not restart NetBox until the command exits successfully with zero blockers. Requests for nodes without a local credential now return HTTP 404 with an actionable provisioning message.
- Replaces the generic VM console endpoint-unavailable response with stable diagnostics that distinguish backend connectivity from missing, disabled, drifted, or inconsistent NetBox endpoint and node relations.
- Shows exact administrator remedies and, when the caller has core Job add permission, a CSRF-protected **Repair all enabled endpoints** action with an explicit warning that the full synchronization can reconcile stale NetBox inventory outside the displayed VM.

Deploy `proxbox-api 0.0.23.post2` before installing this plugin release. This
backend preserves the earlier duplicate virtual-machine reconciliation fix and
restores backup records by hydrating typed VM identity before backup filtering.

| NetBox | netbox-proxbox | proxbox-api | netbox-sdk | proxmox-sdk |
|---|---|---|---|---|
| 4.5.8-4.7.0 GA | v0.0.27 | v0.0.23.post2 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc18 | v0.0.23.post2 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc17 | v0.0.23.post2 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc16 | v0.0.23.post2 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc15 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc14 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc13 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc12 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc11 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc10 | v0.0.23.post1 | v0.0.13 | v0.0.15 |
| 4.5.8-4.7.0 GA | v0.0.27rc9 | v0.0.22.post1 | v0.0.13 | v0.0.13 |
| 4.5.8-4.7.0 GA | v0.0.27rc8 | v0.0.22.post1 | v0.0.13 | v0.0.13 |
| 4.5.8-4.7.0 GA | v0.0.27rc7 | v0.0.22.post1 | v0.0.13 | v0.0.13 |
| 4.5.8-4.7.0 GA | v0.0.27rc6 | v0.0.22.post1 | v0.0.13 | v0.0.13 |
| 4.5.8-4.7.0 GA | v0.0.27rc5 | v0.0.22.post1 | v0.0.13 | v0.0.13 |
| 4.5.8-4.7.0 GA | v0.0.27rc4 | v0.0.22.post1 | v0.0.13 | v0.0.13 |

## Assets

No binary assets attached.

Source archives:

| Format |URL |
| --- | --- |
| zip | https://api.github.com/repos/emersonfelipesp/netbox-proxbox/zipball/v0.0.27 |
| tar.gz | https://api.github.com/repos/emersonfelipesp/netbox-proxbox/tarball/v0.0.27 |