# ProxMate Roadmap A living, prioritized list. ProxMate is a mature, production-ready multi-tenant Proxmox dashboard running in production β€” this roadmap is about **closing cloud-provider parity gaps and hardening for scale**, not fixing breakage. Tiers are rough priority bands, not commitments. Have an idea? Open a [discussion](https://github.com/r0073d-l053r/ProxMate/discussions/categories/ideas). The detailed notes for every release live in [`RELEASE_NOTES.md`](RELEASE_NOTES.md). This file leads with **what's still open**, then **new ideas**, then a condensed **shipped** index. --- ## πŸ”œ Open β€” up next (pulled to the top) ### Live-cluster checks (lab session) - **Verify the least-privilege role on Proxmox VE 8.** `deploy/proxmox-token.sh` was run end to end on a Proxmox VE 9.2 cluster with every feature passing. The PVE 8 variant (`VM.Monitor` instead of the `VM.GuestAgent.*` privileges) has not been run on real hardware yet. - **Restore of an archive that names another guest's disk.** Restores refuse any disk that isn't the guest's own; covered by tests, not yet exercised against a real archive on a live cluster. - **Guest owner check on delete.** Delete confirms the guest carries the machine's own ownership tag; covered by tests, not yet exercised on a live cluster. Both checks refuse when in doubt. - **Pool-scoped token end to end.** `deploy/proxmox-token.sh --pool` on PVE 8.0, 8.1 and 8.2+ and PVE 9: confirm Proxmox refuses the token on a guest outside the pool while every feature works inside it, and that the restart reconciler can read every node's task list with that token. - **v1.3.0 features on real hardware.** Android consoles over a pinned self-signed certificate, view-only consoles (no input reaches the guest), file push on Debian and Alpine guests, upload restore in pool mode, backend restarts mid-create and mid-restore, and automatic snapshots on LVM-thin and ZFS. ### Placement & reliability - **First-class Postgres support.** The Prisma schema is portable but the shipped migration history is SQLite-locked (`migration_lock.toml`), and the built-in app-DB backup uses SQLite's `VACUUM INTO`. Postgres today means `db push` + `pg_dump`; proper support wants a migration history and a backup path of its own. SQLite stays the default. - **Duplicate VM in the background.** Since v1.3.3, creating from an ISO, a template, an OS template or an uploaded backup answers as soon as the machine is recorded and finishes in the background. Duplicating a VM still runs inside the request, so a slow copy behind a reverse proxy or tunnel can time out in the browser while it carries on. - **IDE firewall rule follows the ingress setting.** The rule that lets ProxMate reach a VM's IDE is added once, from the IDE ingress CIDR at the time of the first install. Changing the setting later doesn't update existing VMs; a reinstall should bring the rule up to date, and an install with no ingress CIDR on a firewalled VM should say so up front instead of waiting for the install timeout. ### Production hardening & ops - **Pool mode: recovering a machine whose guest is gone.** With a pool-scoped token, a guest's backups leave the pool when the guest is destroyed, so a rebuild that fails after destroying the old guest leaves backups the token cannot list or restore (root can). Keep the old guest until the new one exists, or give rebuild a restore path that works before the VMID is back in the pool. - **Production validation passes.** The shipped OIDC SSO flow and the full 2FA/passkey matrix (TOTP, recovery codes, passkeys, invite-enforced 2FA) each need a documented end-to-end QA pass on a live deployment. ### IDE follow-ups - **Wire the gateway as a provider for code-server's built-in Chat view** (inert today; OpenCode runs as a terminal TUI instead). Needs a decision first: the IDE settings deliberately turn the built-in chat off so OpenCode is the focus. ### Mobile - **Android release signing and store listing.** The app ships in v1.3.0 as a debug build from CI; a signed release APK is built on version tags once the four `ANDROID_*` signing secrets are set. Still open: set those secrets, and decide on a Play Store or F-Droid listing. ### Deferred pending hardware - **ARM guest builds (Phase 2).** The arch-aware *placement* guardrail shipped; building an ARM VM doesn't yet set the ARM-specific Proxmox settings. The aarch64 VM-build path (`arch=aarch64`, `machine=virt`, OVMF + EFI disk) and an arch selector need a real ARM (Pimox) node to validate. - **The GPU on pve-4 (host project)** β€” the host is vfio/IOMMU-ready and the card is bound; running it needs a fresh **q35 + OVMF + EFI-disk** VM (108 was installed under SeaBIOS). Owner's call when wanted. ### EDU / commercial layer (post-CE) - **Usage-based billing & showback** β€” turn the `ResourceSample` history into per-tenant monthly cost/showback reports (configurable $/vCPU-hr, $/GB-RAM, $/GB-disk) with CSV/PDF export. - **Ephemeral / TTL VMs (auto-expiry)** β€” a VM (or an invite's VMs) gets a lifetime: auto-stop, then auto-delete at expiry, with warning emails first. Builds on invites + power schedules + notifications. - **IDE institutional layer** β€” instructor dashboards (visibility into student IDE sessions/activity), per-class + per-student LLM-gateway quotas + token budgets, **assignment templates** (pre-provisioned VMs with IDE + starter repos), bulk provisioning, LMS/roster + SCIM, support + SLAs. --- ## πŸ’‘ New ideas β€” proposed 2026-07-11 Fresh proposals; none built yet. Each stays inside the API-only + tenant-isolation model. 1. **Two-person approval for destructive admin actions.** Optional policy: a second admin must confirm a bulk-delete / node-drain / firewall-disable before it runs. Rides the existing audit log. _EDU._ 2. **Status page / scheduled reports.** A lightweight public/authed status page (node health, capacity, incidents) and optional scheduled admin reports (capacity trend, top consumers) off the existing `ResourceSample` + cluster-health data. _EDU._ --- ## βœ… Shipped β€” condensed index Full detail for each release in [`RELEASE_NOTES.md`](RELEASE_NOTES.md). ### Unreleased _Nothing yet._ ### Released - **v1.3.5 β€” deleted users' invites stay used.** Deleting a user also deletes the invite they signed up with, so its link can't be redeemed again. - **v1.3.4 β€” Tailscale subnet-router guard.** Guests on a Proxmox node that is also a Tailscale subnet router get their own firewall for tailnet traffic again (`deploy/proxmox-tailscale-guard.sh`), and an IDE that installed but can't be reached says so; the text console connects again. - **v1.3.3 β€” creates behind a proxy, setup banners.** Creating a machine answers once it is recorded and finishes in the background; the cloud-init and IDE banners clear without a reload. - **v1.3.2 β€” edition split.** Bulk deploys from a template moved to ProxMate Pro / EDU. - **v1.3.1 β€” version fix.** Same as v1.3.0, with the version numbers the v1.3.0 tag missed. - **v1.3.0 β€” projects, Android, notifications and reliability.** Projects with per-project usage and power actions; a native Android app; view-only consoles for Viewer shares; the IDE install log and file push through the guest agent; tenant emails, ntfy/Telegram and a weekly usage digest; importing existing Proxmox guests; restored backups checked before use; interrupted operations settled after a restart; automatic snapshots before risky changes; an `ENCRYPTION_KEY` backup reminder; and an optional pool-scoped Proxmox token (not yet verified on a live cluster). - **v1.2.0 β€” sharing, placement and least privilege.** Share a VM with someone before they sign up (pending shares, claimed only by a confirmed address); template deploys on shared storage spread across nodes, respecting the cloud-init snippet storage; `deploy/proxmox-token.sh` for a least-privilege Proxmox token, verified on a 7-node PVE 9.2 cluster, and a connection test that checks every privilege ProxMate uses; start and restart wait for Proxmox like stop. - **v1.1.1 β€” follow-up.** Personal API tokens of an account whose access window has ended answer `403 access_expired`; Compose forwards `ALERT_COOLDOWN_MIN` and the public-token rate-limit settings; non-numeric `PORT` / `RESTORE_UPLOAD_MAX_GB` fall back to defaults; the access-expiry sweep is covered by tests. - **v1.1.0 (2026-10-19) β€” security and reliability release.** A full code review, every finding closed: **guest ownership tags** gate every guest action (existing guests tagged on upgrade, admin **Unconfirmed machines** card for the rest); **owner-only IDE** with per-machine guest proof; hardened sign-in (concurrent-safe lockout, per-account 2FA limits, server-side passkey challenges, single-use links and codes); session-only account-security routes; verified-email SSO linking; allowlisted upload restores with disk-ownership checks; quota-safe concurrent changes; **SDN VNet and OVS bridge discovery** (#126); stop waits for Proxmox's verdict; delta resize; a safer host updater with compose overrides; Node 22 images. - **v1.0.0 (2026-08-11) β€” isolation milestone.** Per-tenant **VLAN placement** (network-layer isolation beyond the per-VM firewall) + rogue-DHCP and IPv6-RA egress drops + firewall rule reconciliation; **cloud-init passwords applied in-guest** via the QEMU guest agent (never written to the seed drive); compute-access windows enforced on **passkey and SSO** login, not only password; template deploys honour the admin default bridge/storage; built cloud-image templates ship `qemu-guest-agent` (agentless builds recorded and flagged); the connection test rejects a privilege-separated token that can authenticate but do nothing; axios client error objects are sanitized before logging; a minimal **module seam** (`PROXMATE_MODULES`) for mounting optional API routers; `deploy.agent_missing` notification; an admin storage-pinning/migratability report. - **v0.9.0 / v0.9.1 (2026-08-01/02) β€” the installer arc.** One-command `install.sh` (dependency bootstrap incl. Docker with explicit consent, LAN-IP autodetect, `--domain` mode, safe re-run over an existing install), verified end-to-end on clean hardware; plain-HTTP CSP fix (+ scheme detection behind proxies); **migration guardrails** in preflight (`cpu=host` across heterogeneous CPU models, missing `cicustom` snippet storage on the target); placement/migration diagnostics; app-DB backups fixed for `sudo` installs (backup dir ownership); `.gitattributes` pins LF so a CRLF commit can't ship a dead installer. - **v0.8.x (2026-07-16 β†’ 07-29) β€” tenant controls + admin management + kiosk.** Share **permission presets** (Viewer / Operator / Manager), **admin deploy-for-tenant** (node pin, optional quota-exempt), admin-managed VMs **resize/rebuild-locked** to admins, Manager-share resizes billed to the **owner's** quota, tenant activity feeds hide admin actions, IDE one-click **relocate** to an AVX-capable node, custom AI-key endpoints admin-only; **compute access windows** (invite-granted terms, suspend-never-delete, warning emails, enforcement across every auth path); tabbed admin Settings; kiosk mode locked to **monitoring-only** with exit-gate hardening; **scheduled app-DB backups** (nightly `VACUUM INTO`, rolling retention, host-directory support via `PROXMATE_BACKUP_DIR`); `ide_ingress_cidr` admin field + reachability test; pinned code-server/OpenCode installer versions. - **v0.7.0 β€” ProxMate IDE (beta).** In-browser code-server + OpenCode AI agent installed natively in each tenant VM; per-VM LLM gateway (allow-list, per-VM tokens, streaming, two-layer rate limiting); managed isolation-consistent `:8080` firewall pinhole; min-spec guardrails (RAM floor, `cpu:host`/AVX); install + cloud-init **deploy locks**; `DEPLOY_WITH_CLAUDE.md` agent-guided deploy runbook. Off by default. See `docs/proxmate-ide.md`. - **v0.6.x β€” GPU/PCI passthrough hardening + cluster ops.** Passthrough requestβ†’admin-attach workflow with auto-migration to the device's node, live migration progress bar, and a pre-flight host-readiness check (won't auto-start a GPU unless q35+OVMF β€” after two live node wedges); migratability-aware balancer planning + migrate picker; backend security-hardening pass (SSRF guards, fail-closed secrets, `/metrics` 404-in-prod, gateway rate limiting). - **v0.5.0 β€” tenant-experience arc.** Console power actions + pop-out/keep-on-top terminal, live Insights, reset guest password, rescue mode, per-VM resource alerts, duplicate VM, cloud-image freshness/auto-refresh, single-use backup download links. - **v0.4.x β€” LXC containers + passthrough requests.** Create/manage LXC alongside VMs (console, isolation, quota, resize, backups; balancer pins them); GPU/PCI passthrough request workflow. - **v0.3.x β€” sharing, scale & ops.** Share-a-VM (roles), public REST API + `pm_…` tokens + OpenAPI, Cluster Balancer (DRS-style, memory-based, recommendβ†’auto) + node-drain maintenance mode, VM migration between nodes, extra data disks, quota-increase requests, live SSE stats, per-tenant resource history, admin broadcast email, cloud-init "extras" + on-demand snippet writing. - **v0.2.x β€” core platform.** Template Store + auto-scaling deploy, MateStates backups + retention, secure external access (Cloudflare Tunnel / Tailscale, zero port-forwarding), admin monitor, unified new-VM wizard, tags + bulk actions, event notifications, branded transactional email + admin email invites, live resize/rebuild/per-VM backup policy. - **Cross-cutting (done).** Structured logging (pino) + request IDs, deep health checks, Prometheus `/metrics`, Proxmox retry/backoff on idempotent reads, write rate-limiting, Playwright E2E + Vitest/RTL, ESLint/Prettier, CI security scanning (CodeQL/Trivy/npm-audit/SBOM), append-only audit log, TOTP 2FA + passkeys + OIDC SSO, invite-enforced 2FA, AGPL open-core licensing (CE + CLA). ### Explicitly declined / not feasible (kept for the record) - **Tenant self-service firewall rules** β€” declined by the owner (curated presets could revisit it). - **Audit-log retention/export/SIEM streaming** β€” declined by the owner. - **Custom cloud-init user-data editor** β€” dropped (arbitrary user-data needs a host snippet file the API can't write). - **Automated public ingress** β€” left as documented manual setup (collides with API-only + isolation). - **S3/restic backup targets** β€” not feasible (Proxmox has no API to read vzdump bytes; NFS/CIFS/PBS remote storage covers off-cluster backups instead).