- Add verification steps for qemu-guest-agent service status
- Clarify that the service is socket-activated (not systemctl enable)
- Add diagnostic commands users can run to verify agent is working
- Update FAQ with correct troubleshooting steps for agent issues
This helps users like @RLSinRFV who were trying to enable the service
when it's actually socket-activated and should start automatically.
The real issue for PVE 8 users seeing 0% disk usage:
- Users who added nodes BEFORE v4.7 don't have VM.Monitor permission
- The setup script always created tokens with privsep=0, so that wasn't the issue
- Solution: Re-run the setup script or manually add VM.Monitor permission
Updated error messages and documentation to reflect the actual cause
and provide the correct fix for users experiencing this issue.
- Add detailed logging when VM disk monitoring fails due to permissions
- Explain Proxmox 9 limitation: API tokens cannot access guest agent data (PVE bug #1373)
- Explain Proxmox 8 requirements: VM.Monitor permission and privsep=0 for tokens
- Update setup script to show appropriate warnings for each PVE version
- Update FAQ with troubleshooting steps for 0% disk usage on VMs
- Log messages now clearly indicate workarounds for each scenario
The core issue: Proxmox 9 removed VM.Monitor permission and the replacement
permissions don't allow API tokens to access guest agent filesystem info.
This is a Proxmox upstream bug that affects their own web UI as well.
For users experiencing this issue:
- PVE 9: Use root@pam credentials or wait for Proxmox to fix upstream
- PVE 8: Ensure token has VM.Monitor and privsep=0
- All versions: QEMU guest agent must be installed in VMs
addresses #348
After extensive testing and research:
CONFIRMED: This is a Proxmox 9 API limitation, not a configuration issue
- Guest agent get-fsinfo works when called as root (qm agent <vmid> get-fsinfo)
- API tokens CANNOT access this data even with VM.GuestAgent.Audit permission
- Proxmox's own web UI also shows 0% for VM disk usage (bug #1373)
Updated:
- Setup script now clearly explains this is a known Proxmox limitation
- Changed log level from Warn to Debug for permission errors (expected on PVE 9)
- Added references to Proxmox bug #1373
Workarounds for users:
1. Use root@pam credentials instead of API tokens for full VM disk monitoring
2. Container (LXC) disk usage works correctly with tokens
3. Wait for Proxmox to fix this upstream
The guest agent returns the data (total-bytes, used-bytes) but Proxmox's
API doesn't allow token access to it. This is not something we can fix
in Pulse - it needs to be addressed in Proxmox itself.
addresses #348
After testing on actual PVE 9.0.5 nodes:
- Confirmed VM.Monitor privilege was removed in PVE 9
- PVEAuditor role includes VM.GuestAgent.Audit permission
- Added Sys.Audit permission (replacement for VM.Monitor)
- Added clear warning about known PVE 9 guest agent limitations
The issue appears to be a Proxmox 9 limitation where even with correct
permissions (VM.GuestAgent.Audit + Sys.Audit), the guest agent API may
not return disk usage data for non-root tokens. This is likely a bug or
intentional security restriction in Proxmox 9 that needs to be addressed
upstream.
Updated setup script to:
1. Properly detect PVE 9 and add appropriate permissions
2. Warn users about the known limitation
3. Suggest workarounds (using root credentials if needed)
addresses #348
- Updated setup script to properly detect and handle Proxmox 9 where VM.Monitor was removed
- For PVE 9+, now creates custom role with Sys.Audit permissions (replaces VM.Monitor)
- Attempts to add VM.Agent or Sys.Modify permissions for better guest agent access
- Added better error logging to identify permission issues with guest agent API
- Warns users about PVE 9 permission requirements if disk usage shows 0%
The setup script now:
1. Properly detects PVE version using pveversion command
2. Creates appropriate roles based on PVE version (VM.Monitor for PVE 8, Sys.Audit for PVE 9)
3. Provides clear instructions if guest agent access still doesn't work
The SecurityHeaders middleware was not being applied to the router,
causing the "Allow iframe embedding" setting to not take effect.
This fix properly applies the middleware with the saved settings,
allowing iframe embedding to work when enabled.
addresses #351
Addresses #222 - Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
- Add AllowEmbedding and AllowedEmbedOrigins settings to SystemSettings
- Update security headers to respect embedding configuration
- When disabled: X-Frame-Options: DENY, frame-ancestors 'none'
- When enabled (same-origin): X-Frame-Options: SAMEORIGIN, frame-ancestors 'self'
- When enabled with origins: Adds specified origins to frame-ancestors
- Add UI controls in Settings → System → Network Settings
- Properly handle CSP frame-ancestors directive for cross-origin embedding
Users can now enable iframe embedding and specify allowed origins for embedding Pulse in Homepage or other dashboard applications.
Improved logging to help users diagnose why VM disk usage might not be showing:
- Clearly identify when agent is enabled in config but not running in guest OS
- Detect timeout issues with unresponsive agents
- Log when agent returns no filesystem info
- Show which filesystems are included/excluded from calculations
- Distinguish between no agent, agent not running, and agent working
This will help users understand exactly why their VM disk usage isn't showing
and what steps they need to take to fix it (install qemu-guest-agent, restart
the service, etc).
addresses discussion #344
The agent field in Proxmox can have values other than just 0 or 1 when features are enabled, causing the strict equality check (== 1) to fail. Changed to check for any value > 0 to properly detect when the agent is enabled.
addresses discussion #344
The temporary auth tokens generated by authenticated users are now properly
validated even when Pulse has authentication enabled. This fixes the issue
where fresh installs (which are secured by default) couldn't use the
auto-registration feature.
Replaced the two-step setup code process with a simpler token-in-URL approach:
- Auth token is now embedded directly in the setup URL
- No more prompting users for setup codes
- Same security level with better UX
- Backwards compatible with old setupCode field
The new flow generates a command like:
curl -sSL "http://pulse/api/setup-script?...&auth_token=TOKEN" | bash
This makes it much easier for users, especially in Proxmox shell where
interactive prompts can be problematic.
- The generated command now includes PULSE_SETUP_CODE environment variable
- Users can simply copy-paste the command in Proxmox shell without needing to type the code
- Makes the setup process more streamlined for the primary use case
- Add bulk acknowledge and clear operations for alerts
- Support selecting multiple alerts with checkboxes
- Add select all functionality for bulk operations
- Improve Proxmox permission setup to handle both PVE 8 and 9+
- Use PVEAuditor role which includes VM.GuestAgent.Audit for PVE 9+
- Add fallback VM.Monitor role for PVE 8 and below
- Bump version to 4.7.3
- Fixed parsing of pveversion output (uses colon separator not slash)
- Now correctly extracts version number from 'pve-manager: X.Y.Z' format
- addresses #348
- Detect Proxmox version in setup script
- Use VM.GuestAgent.Audit for PVE 9+ instead of VM.Monitor
- Update UI instructions to handle both PVE 8 and 9
- addresses #348
- Webhook test was showing success even when receiving 400/500 errors
- Now correctly reports HTTP status errors to the UI
- Added debug logging for Gotify webhooks to help troubleshooting
- Addresses #342 where Gotify webhooks appeared to work but didn't
- Setup script no longer requires authentication (uses setup codes instead)
- Fixed discovery service not starting when toggled via settings
- Addresses #347 and discussion #344
addresses #346
The issue was that the code was checking for specific ports (:8007 or :443) in the host string, which would incorrectly add the default port even when a custom port was already specified. Now it properly checks if any port exists after the protocol before adding the default.
Delete and recreate the PulseMonitor role each time instead of trying to modify it. This ensures a clean, predictable state with exactly the permissions needed.
Also fixes incorrect pveum command syntax - should be 'role add' not 'role create'.
Addresses issue reported by NameLessJedi in #340
- Theme changes now broadcast instantly via WebSocket to all connected browsers
- No page refresh needed - theme updates in real-time across all devices
- Theme preference is persisted server-side and loaded on new sessions
- Added WebSocket message type 'settingsUpdate' for broadcasting settings changes
- Updated SystemSettingsHandler to broadcast theme changes to all clients
- Added frontend event listener to handle incoming theme change messages
- Fixed API endpoint routing to use the new handler with broadcast support
- Added proper DISABLE_AUTH check in CheckAuth for auth-disabled environments
This creates a seamless experience where toggling dark/light mode on one device
instantly updates all other connected devices (phones, tablets, browsers).
When a webhook has an empty template string, don't try to use it - fall through to the service-specific template instead. This was causing Discord webhooks to send empty payloads resulting in errors.
PBS was incorrectly appending default port :8007 even when custom ports were specified, resulting in malformed URLs like domain:443:8007. Now properly detects existing ports after the protocol prefix.
Webhooks now stored encrypted (webhooks.enc) instead of plain text:
- Automatic migration from webhooks.json to webhooks.enc
- Uses same AES-256-GCM encryption as nodes and email configs
- Original file backed up as webhooks.json.backup
- Protects sensitive webhook URLs and authentication headers
This addresses the security concern where webhook URLs containing API tokens
(like Telegram bot tokens) were stored in plain text.
Implements header-based proxy authentication for SSO integration with
Authentik, Authelia, and other authentication proxies.
- Add CheckProxyAuth function to validate proxy headers
- Support for username and role-based access control
- Frontend integration with logout URL support
- Comprehensive documentation with examples
- Backwards compatible - no breaking changes
Addresses #327
Configuration via environment variables:
- PROXY_AUTH_SECRET: Shared secret for validation
- PROXY_AUTH_USER_HEADER: Header containing username
- PROXY_AUTH_ROLE_HEADER: Header containing roles/groups
- PROXY_AUTH_LOGOUT_URL: SSO logout endpoint
Storage devices with alerts disabled in the Thresholds tab were still
triggering alerts. Added proper checking of the disabled override flag
in CheckStorage() to match the behavior of guest alerts.
- Add GetVMFSInfo method to fetch filesystem data from guest agent
- Integrate guest agent disk stats for VMs in both polling modes
- Aggregate real disk usage from all filesystems (skip special mounts)
- Fall back gracefully to allocated size when agent unavailable
- Add VM.Monitor permission to auto-negotiation script via PulseMonitor role
- Update frontend NodeModal with new permission instructions
VMs with QEMU guest agent now show actual disk usage like LXCs do.
Addresses #344
Addresses #342 - Gotify webhooks now include the required 'message' field
that was missing when using generic webhook payloads. The template also
includes proper priority mapping and markdown support.
Addresses #343 - users can now disable Proxmox/PBS server discovery through:
- UI toggle in Settings > System > Network Settings
- Environment variable DISCOVERY_ENABLED=false
- system.json configuration
Discovery runs by default but can be completely disabled for environments where automatic scanning causes issues (e.g., shared hosting networks).
- Auto-detects Proxmox VE hosts and creates LXC containers
- Quick mode with sensible defaults (1GB RAM, 4GB disk)
- Advanced mode for full customization
- Automatic cleanup on failure
- Simple 'update' command in containers
- Improved error handling and network detection
- Professional, clean output without verbose noise
- Docker detection to prevent container-in-container
- Removed all references to community scripts
This is now the primary recommended installation method.
addresses #340 - more secure authentication for Quick Token Setup
Major security improvement:
- Replaced URL-embedded tokens with 6-character one-time setup codes
- Setup codes are entered interactively, never transmitted in URLs
- Codes are hashed for storage and expire after 5 minutes
- Each code can only be used once
How it works:
1. User clicks "copy command" in Pulse UI
2. A unique setup code is generated and shown to the user
3. User runs the curl command on their Proxmox server
4. Script prompts for the setup code
5. Code is validated and node is auto-registered
This approach is much more secure as no authentication tokens travel over the network in URLs, and the codes are short-lived and single-use.
addresses #340 - Quick Token Setup improvements
Changed:
- Auto-registration now uses temporary setup tokens instead of API tokens (API tokens are hashed and can't be passed directly)
- Setup script shows token value for manual configuration when auto-registration fails
- Improved error messages to explain why auto-registration might fail
- Auto-register endpoint now accepts either API tokens or temporary setup tokens
This ensures the Quick Token Setup feature works as intended - automatically registering nodes without manual token copying when possible, while providing clear fallback instructions when authentication is required.
Discord and other webhook notifications were failing with template parse
errors due to backslashes incorrectly escaping quotes in Go raw string
literals. Raw strings preserve backslashes literally, causing the Go
template parser to fail.
Fixes#341
- Allow WebSocket connections from private networks when no origins configured
- Fixes "connection lost" errors for Docker users accessing from LAN IPs
- Maintains security by only allowing RFC1918 private IPs and local domains
- Users can still explicitly set ALLOWED_ORIGINS for stricter control
- Addresses issue #214 where Docker users couldn't connect via WebSocket
- API tokens now work even when DISABLE_AUTH is set
- Added API token section back to Security tab in settings
- API tokens can protect API access for automation while keeping UI open
- Invalid tokens are rejected even with auth disabled
- Export/import endpoints still require valid API token
- Added migration logic to set I/O thresholds to 0 when loading saved configs
- Only migrates if values match old defaults (150 MB/s disk, 200 MB/s network)
- Ensures existing users get the new "Off by default" behavior
- Prevents saved configs from overriding the new defaults
- Changed default thresholds for diskRead/diskWrite/networkIn/networkOut to 0 (Off)
- UI now shows "Off" instead of "0 MB/s" for disabled I/O metrics
- Reduces alert noise for users who don't need I/O monitoring
- Advanced users can still enable them by setting custom thresholds
- Prevents common false positives like hourly pihole database writes
This makes Pulse focus on the core metrics (CPU, memory, disk space) by default
while keeping I/O monitoring available for those who need it.
- Fixed alert units display (MB/s vs %) in notifications and UI
- Added missing threshold controls for disk I/O and network metrics
- Redesigned threshold table with active alert indicators
- Added ability to disable node connectivity alerts
- Improved visual distinction between defaults and overrides
- Added keyboard shortcuts for search (type to search, ESC to clear)
- Better threshold management with automatic cleanup of empty overrides
- Enhanced UI with proper units display for all metrics
addresses #336
- redesigned global defaults section with compact table layout
- fixed bug where editing without changes created unnecessary overrides
- improved visual consistency across the alerts interface
Pulse Monitor