- Add API validation for cluster nodes to filter out qdevice VMs
- Only include nodes with working Proxmox APIs in cluster endpoints
- Prevent connection failures when cluster has non-Proxmox participants
- Add detailed logging for cluster node validation process
This resolves issues where Proxmox clusters using corosync qdevice
(external quorum device) would fail to connect because Pulse tried
to connect to the qdevice VM which has no Proxmox API.
- Add client-side URL validation with instant feedback
- Show validation errors inline below URL input fields
- Prevent saving when URLs have validation errors
- Improve error message extraction in API client
- Handle incomplete URLs like 'https://emby.' gracefully
- Backend already had validation, now frontend shows it properly
- Add more specific error messages when metadata save fails
- Better handling of permission and disk space errors
- This should help diagnose why guest URLs fail to save in some cases
- The atomic write operation was already in place but errors weren't clear
- Always query guest agent for running VMs instead of only when disk is 0
- Add duplicate mount point detection to prevent inflated disk totals
- Show allocated disk size as fallback when guest agent unavailable
- Add comprehensive logging for guest agent disk queries
- Include diagnostic script for troubleshooting VM disk issues
- Always query guest agent for running VMs (cluster/resources API always returns 0)
- Show allocated disk size when guest agent unavailable (instead of misleading 0%)
- Fix duplicate mount point counting issue (#425)
- Add comprehensive logging for guest agent queries
- Include diagnostic script for troubleshooting VM disk issues
- Update both monitor.go and monitor_optimized.go for consistency
- Prevent path traversal attacks by cleaning and validating URL paths
- Use secure token comparison to prevent timing attacks
- Return appropriate HTTP status codes for different attack vectors
- Add comprehensive logging for security events
The real issue was not the overall timeout duration, but that DNS resolution and TLS handshake could hang indefinitely. Added specific timeouts for:
- DNS resolution/connection: 10 seconds
- TLS handshake: 10 seconds
- Response headers: 10 seconds
This prevents the connection from hanging on DNS lookup (like with pve-backup.lan) or during TLS negotiation, which was causing the 'context deadline exceeded' errors. (addresses #424)
PBS servers can be slow to respond, especially under load or over slower connections. Increased the timeout from 10 seconds to 30 seconds specifically for PBS version checks during diagnostics.
The /api/state and /api/guests/metadata endpoints are now excluded from
rate limiting as they are polled frequently by the UI for real-time updates.
This prevents the "Loading..." issue when users with multiple nodes access
the application.
- Added skip list in UniversalRateLimitMiddleware for real-time endpoints
- Removed duplicate rate limiting logic from router's ServeHTTP
- Consolidated all rate limiting into the universal middleware
The password change endpoint now handles both scenarios:
- Direct auth: Uses Authorization header when it contains Pulse credentials
- Proxy auth: Uses currentPassword from JSON body when behind proxy Basic Auth
- Prevents proxy auth from interfering with Pulse's own authentication
- Maintains security by always requiring current password verification
- Fixed SendEnhancedWebhook to use service-specific payload generation
- Test webhooks now properly skip template-syntax headers
- ntfy and other plain text services correctly skip JSON validation
- Prevents 'invalid character' errors when testing webhooks
- All webhook payload generation now respects service type
- Fixed webhook ID extraction in UpdateWebhook and DeleteWebhook handlers
- Previous code expected 5 URL parts but path only had 2 after prefix stripping
- Now correctly extracts webhook ID from /api/notifications/webhooks/{id}
- Resolves frontend error when saving webhook changes
Mock cluster endpoints were showing grey dots because the Online field
wasn't being set based on the node status. Now properly reflects the
node's online/offline status with green/grey indicators.
The acknowledge/unacknowledge/clear endpoints were returning 404 due to incorrect path trimming in HandleAlerts. The router was registered with /api/alerts/ but the handler was trimming /api/alerts, causing path parsing to be off by one character.
- Add dynamic metric fluctuations for VMs and containers in mock data
- Fix alert acknowledgment to dim instead of hide alerts
- Implement unacknowledge functionality with backend persistence
- Simplify alert UI to single-click toggle (remove selection system)
- Add proper hysteresis for alert resolution when metrics drop
- Fix SVG icon boundaries in alert displays
- Add webhook disable toggles for testing without notifications
- Fix frontend directory duplication issue (addresses frontend-modern recreation)
- Improve alert sorting to show most recent first
- Make mock system generate realistic metric changes for proper alert lifecycle
- Added ToFrontend() method to StateSnapshot for proper data conversion
- Modified /api/state endpoint to use frontend-formatted data
- Enhanced WebSocket store to handle tag data transformation consistently
- Ensures tags are properly converted between backend strings and frontend arrays
Mock mode was inadvertently clearing real node configuration when toggling.
Added protection to prevent SaveNodesConfig from modifying nodes.enc when
in mock mode. Mock and production data are now completely separated.
Alert IDs like 'pve1:qemu/101-cpu' contain slashes which were breaking the URL path parsing.
Fixed by finding the /acknowledge or /clear suffix and extracting everything before it,
rather than trying to split by slashes.
The acknowledge and clear alert endpoints were incorrectly parsing the alert ID from the URL path, causing 404 errors. Fixed the path extraction logic to properly handle the /api/alerts/{id}/acknowledge pattern.
The change password feature was not working because the backend wasn't
actually verifying the current password before allowing changes. Fixed both
frontend and backend issues:
- Frontend now uses the correct username from localStorage
- Backend now properly validates the current password before allowing change
- Added proper security checks to prevent unauthorized password changes
- Add WebSocket hub reference to AlertHandlers
- Broadcast state after acknowledge, clear, and bulk operations
- Ensures UI acknowledgment counts update immediately without refresh
- Fixes issue where acknowledgment would disappear after 2 seconds
addresses #394 - setup script now correctly uses https:// in generated commands
when Pulse is running behind an HTTPS reverse proxy like Traefik by checking
the X-Forwarded-Proto header
- Update screenshot tool to use MacBook Air resolution (2560x1600)
- Remove empty side borders from screenshots
- Use mock data for all screenshots for privacy
- Fix mobile alert buttons overflowing viewport
- Exempt localhost from API rate limiting for better dev experience
- Update documentation to showcase all features with screenshots
- Reorganize README visual tour into feature sections
- Add high-quality screenshots with 3x device scale factor for crisp text
- Implement mock alert history generator spanning 90 days
- Update documentation with detailed screenshot descriptions
- Add visual tour section to README with key screenshots
- Fix mock mode to properly separate from production data
- Clean up screenshot script to use actual mock data instead of DOM injection
- Enhance FAQ and webhooks docs with relevant screenshots
- Increased rate limits for configuration GET endpoints to prevent 429 errors
- Added automatic retry logic for rate-limited requests with exponential backoff
- Added small delays between initial API calls to prevent burst requests
- Configuration read endpoints now use PublicEndpoints limit (1000/min vs 500/min)
This should resolve the issue where the configuration page sometimes shows
no information and prompts for system setup even when it's already configured.
- show which specific VMs have disk monitoring problems
- list filesystem details showing what's filtered and why
- provide actionable info for troubleshooting guest agent issues
- addresses #367 by giving users better debugging information
- Handle standalone nodes properly in diagnostics (fixes#362)
- Try /nodes endpoint first which works for both clustered and standalone
- Make cluster status optional, not required for connection success
- Set cluster node count to 1 for standalone nodes
- Fix test connection UI showing success styling on errors (fixes#363)
- Return proper HTTP error status when test-config endpoint fails
- Clean up error messages to remove "API request failed: XXX" prefix
- Add debug logging to trace test result states
- Ensure consistent error status codes from all test endpoints
Both issues reported connection problems - standalone nodes failing to connect
and error messages appearing with success styling. These fixes ensure proper
handling of both scenarios.
- Fixed /api/config/system endpoint to return all persisted settings fields including allowEmbedding, discoveryEnabled, and allowedEmbedOrigins
- Added comprehensive input validation for all settings with proper min/max bounds
- Fixed security headers to properly allow/deny iframe embedding based on user preference
- Added real bug detection test suite that validates behavior, not just status codes
The iframe embedding checkbox now properly persists its state and actually controls whether Pulse can be embedded in iframes. When enabled, removes X-Frame-Options header and sets CSP frame-ancestors to allow embedding.
addresses #360
- Add detailed lockout feedback in login API responses showing remaining attempts
- Display lockout warnings in the frontend with attempt counters
- Show time remaining when account is locked (15 minute lockout duration)
- Add visual indicators (lock icon) for lockout status
- Implement /api/security/reset-lockout endpoint for admin recovery
- Store lockout information with expiration tracking
- Provide clear user guidance about lockout duration and recovery
PBS often runs in Docker containers, so the container check was preventing
legitimate setups. Also fixed the script to check for proxmox-backup-manager
instead of pveum (which is PVE-only).
- Added required field validation for name, type, and host in node configuration
- Added duplicate node prevention by name (returns 409 Conflict)
- Added IP address format validation to reject invalid IPs
- Added port range validation (1-65535)
- Added validation for negative polling intervals in system settings
- Added HEAD request support for health and version endpoints
- Reduced node addition timeout from 10s to 3s to prevent UI hanging
These validation improvements were discovered through comprehensive testing
and prevent invalid data from being accepted by the API.
The setup script no longer mentions VM disk monitoring at all, as requested.
This avoids confusion about what works or doesn't work on different
Proxmox versions. The permissions are still set up correctly behind
the scenes, but users don't need to see confusing information about it.
The setup script was incorrectly claiming that VM disk monitoring works
on Proxmox 9 with API tokens. This is not true due to an upstream
Proxmox limitation where API tokens cannot access guest agent data
even with the correct permissions.
Updated the setup script to clearly explain:
- This is a known Proxmox 9 limitation, not a Pulse issue
- API tokens are blocked from accessing get-fsinfo
- Available workarounds (use root@pam or wait for upstream fix)
- Link to issue #348 for full context
This should prevent further confusion for users running Proxmox 9.
- Fixed reactivity issue where PVE node tables weren't showing on hard refresh
- Removed component re-mounting caused by IIFE wrapper in App.tsx
- Added text truncation with ellipsis to prevent row height changes
- Fixed table visibility to properly hide when filtering excludes all nodes
- Added cache-busting headers to ensure browser loads latest JS/CSS files
- Remove max-width constraint on search fields to utilize available space
- Node summary table now updates based on search/filter criteria
- Only show nodes with matching guests when filtering is active
- Calculate node metrics based on filtered guests only
- Show matched guest count in node summary when filtering
- Provides better visual feedback on what the filters are affecting
- Setup scripts now accept both temporary setup codes and permanent API tokens
- Setup codes (6 chars): For manual setup by others, expire in 5 minutes
- API tokens: For automation and trusted environments, no expiration
- Modified auto-registration endpoint to accept API tokens directly
- Fixed JSON escaping issues with exclamation marks in bash scripts
- Updated README with clear documentation of both authentication methods
- Discovery modal now shows cached results immediately while scanning
This enables both secure manual setup (via temporary codes) and reliable
automation (via API tokens) without compromising security.
The discovery functionality was broken because the router was using a
simple GET-only handler instead of the complete HandleDiscoverServers
function that supports both GET (cached results) and POST (manual scans
with subnet parameters).
Changes:
- Updated router to use configHandlers.HandleDiscoverServers instead of r.handleDiscovery
- Removed the redundant handleDiscovery function
- Discovery endpoint now supports both GET and POST methods as expected by frontend
- Added proper authentication requirement for discovery endpoint
This addresses the discovery being broken in the latest RC releases.
Added detailed VM disk monitoring checks to the diagnostics page:
- Tests actual guest agent connectivity for each node
- Shows how many VMs have agents configured vs working
- Performs a detailed test on one VM and reports the result
- Provides specific recommendations based on the error encountered
- Shows SUCCESS when disk monitoring is working properly
This helps users quickly identify why VM disk monitoring might not be working:
- Guest agent not installed/running
- Permission issues with API tokens
- VM configuration problems
The diagnostics clearly show when everything is working (like the delly.lan cluster showing 19.3% disk usage) vs when there are issues to resolve.
TESTED AND CONFIRMED: API tokens CAN access guest agent data on PVE 9!
- Created test tokens and verified they work
- Guest agent API returns proper disk usage data
- The cluster/resources endpoint shows disk=0 but that's not what Pulse uses
- Pulse correctly fetches data via /nodes/{node}/qemu/{vmid}/agent/get-fsinfo
The misinformation about PVE 9 not working was completely wrong. It does work when properly configured with PVEAuditor role which includes VM.GuestAgent.Audit permission.
Stop making definitive claims about what works or doesn't work. The reality:
- Some users (like you) have it working fine in cluster configs
- Others report 0% disk usage
- The exact conditions that make it work are unclear
- Results vary between different setups
Updated all docs and messages to reflect this uncertainty rather than making false claims about non-existent workarounds or absolute limitations.
Previous advice was completely wrong. The facts:
- VM.Monitor permission doesn't exist in PVE 9 (was removed)
- It was replaced with VM.GuestAgent.Audit
- But even with correct permissions, API tokens CANNOT access guest agent data on PVE 9
- This is Proxmox bug #1373 with NO working workaround for API tokens
- Users must accept 0% VM disk usage on PVE 9 until Proxmox fixes it upstream
Updated all documentation and error messages to reflect this reality instead of giving false hope about non-existent workarounds.
The root@pam suggestion doesn't actually work since it requires the Linux system root password, not a Proxmox-specific password. Most users don't know or have disabled their Linux root password for security.
Updated all documentation and error messages to correctly advise users to grant VM.Monitor permission to their API token user instead.
The setup code section in the modal is no longer shown when the auth token
is already embedded in the setup script URL. Since the token is included
as auth_token parameter, there's no need for users to see or enter it.
The real issue for PVE 8 users seeing 0% disk usage:
- Users who added nodes BEFORE v4.7 don't have VM.Monitor permission
- The setup script always created tokens with privsep=0, so that wasn't the issue
- Solution: Re-run the setup script or manually add VM.Monitor permission
Updated error messages and documentation to reflect the actual cause
and provide the correct fix for users experiencing this issue.
- Add detailed logging when VM disk monitoring fails due to permissions
- Explain Proxmox 9 limitation: API tokens cannot access guest agent data (PVE bug #1373)
- Explain Proxmox 8 requirements: VM.Monitor permission and privsep=0 for tokens
- Update setup script to show appropriate warnings for each PVE version
- Update FAQ with troubleshooting steps for 0% disk usage on VMs
- Log messages now clearly indicate workarounds for each scenario
The core issue: Proxmox 9 removed VM.Monitor permission and the replacement
permissions don't allow API tokens to access guest agent filesystem info.
This is a Proxmox upstream bug that affects their own web UI as well.
For users experiencing this issue:
- PVE 9: Use root@pam credentials or wait for Proxmox to fix upstream
- PVE 8: Ensure token has VM.Monitor and privsep=0
- All versions: QEMU guest agent must be installed in VMs
Pulse Monitor