fix: stop the NVIDIA install under Secure Boot and keep the 2FA field visible to Bitwarden

AppImage/components/login.tsx

@@ -256,21 +256,24 @@ export function Login({ onLogin }: LoginProps) {
                 </div>
 
                 <div className="space-y-2">
-                  <Label htmlFor="totp-code" className="text-sm">
+                  {/* Password managers read the field's siblings and skip it when they mention a backup code. */}
-                    {t("login.authenticationCode")}
+                  <div className="space-y-2">
-                  </Label>
+                    <Label htmlFor="totp-code" className="text-sm">
-                  <Input
+                      {t("login.authenticationCode")}
-                    id="totp-code"
+                    </Label>
-                    type="text"
+                    <Input
-                    placeholder="000000"
+                      id="totp-code"
-                    value={totpCode}
+                      type="text"
-                    onChange={(e) => setTotpCode(e.target.value.toUpperCase().replace(/[^A-Z0-9-]/g, "").slice(0, 9))}
+                      placeholder="000000"
-                    className="text-center text-lg tracking-widest font-mono text-base"
+                      value={totpCode}
-                    maxLength={9}
+                      onChange={(e) => setTotpCode(e.target.value.toUpperCase().replace(/[^A-Z0-9-]/g, "").slice(0, 9))}
-                    disabled={loading}
+                      className="text-center text-lg tracking-widest font-mono text-base"
-                    autoComplete="one-time-code"
+                      maxLength={9}
-                    autoFocus
+                      disabled={loading}
-                  />
+                      autoComplete="one-time-code"
+                      autoFocus
+                    />
+                  </div>
                   <p className="text-xs text-muted-foreground text-center">
                     {t("login.backupCodeHint")}
                   </p>

CHANGELOG.md

@@ -55,6 +55,8 @@ A special thank you goes to [@Vaso73](https://github.com/Vaso73), [@f3rs3n](http
 - **VM disk usage counts every filesystem of the guest** ([#559](https://github.com/MacRimi/ProxMenux/issues/559), with the fix proposed by [@TheFoxCraft](https://github.com/TheFoxCraft)), also on guests whose agent reports no device name, such as Alpine.
 - **The LVM check keeps the Proxmox filter for zvols and RBD images** on hosts whose only volume groups belong to their VMs ([#552](https://github.com/MacRimi/ProxMenux/issues/552), reported by [@osipovdm-dot](https://github.com/osipovdm-dot)).
 - **A volume group with no active volumes counts as healthy**, such as a disk left over from another installation, stopped guests or shared LVM. A storage Proxmox cannot use is still reported by the storage check.
+- **The NVIDIA installer stops before touching the driver when Secure Boot is enabled** ([#571](https://github.com/MacRimi/ProxMenux/issues/571), reported by [@Balethorn](https://github.com/Balethorn)), because the kernel would refuse the unsigned module, and any installer failure stays on screen with its reason.
+- **Bitwarden recognizes the 2FA field on the Monitor login** ([#570](https://github.com/MacRimi/ProxMenux/issues/570), reported by [@shtefko](https://github.com/shtefko)): the backup code hint keeps its text and place, outside the group of the field.
 - **Secure Gateway installs on Proxmox hosts on BTRFS** ([#564](https://github.com/MacRimi/ProxMenux/issues/564), reported by [@78v5](https://github.com/78v5)): the Alpine template goes to an active storage that holds container templates.
 - **A disk I/O error from the kernel is recorded on its disk**, with its serial number, also when the error names a partition.
 - **The Monitor installs as an app (PWA) from the browser**: it serves its own web app manifest and service worker, with the 192 and 512 px icons Chrome requires.

lang/de.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Verzeichnis:",
   "Directus administrator": "Directus-Administrator",
   "Disable NIC Offloading (Intel e1000e)": "NIC-Offloading deaktivieren (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Deaktivieren Sie Secure Boot in der UEFI-Firmware und führen Sie das Installationsprogramm erneut aus. Es wurde nichts geändert.",
   "Disable autostart on conflicting VM": "Deaktivieren Sie den Autostart auf in Konflikt stehenden VMs",
   "Disable autostart on one VM to avoid startup conflicts.": "Deaktivieren Sie den Autostart auf einer VM, um Startkonflikte zu vermeiden.",
   "Disable job": "Job deaktivieren",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "NVIDIA-Treiber",
   "NVIDIA driver installed successfully.": "NVIDIA-Treiber erfolgreich installiert.",
   "NVIDIA driver installed:": "NVIDIA-Treiber installiert:",
+  "NVIDIA driver not installed": "NVIDIA-Treiber nicht installiert",
   "NVIDIA driver verification in container:": "Überprüfung des NVIDIA-Treibers im Container:",
   "NVIDIA drivers are not installed or not loaded on this host.": "NVIDIA-Treiber sind auf diesem Host nicht installiert oder nicht geladen.",
   "NVIDIA host services disabled for VFIO mode": "NVIDIA-Hostdienste für VFIO-Modus deaktiviert",
@@ -6042,6 +6044,8 @@
   "Search/Filter Scripts": "Such-/Filterskripte",
   "Searchable document archive with OCR": "Durchsuchbares Dokumentenarchiv mit OCR",
   "Secondary upstream DNS server": "Sekundärer Upstream-DNS-Server",
+  "Secure Boot Enabled": "Secure Boot aktiviert",
+  "Secure Boot is enabled on this host.": "Secure Boot ist auf diesem Host aktiviert.",
   "Secure Disk Formatter": "Sicherer Festplattenformatierer",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (Tailscale VPN)",
   "Secure Gateway deployed successfully!": "Secure Gateway erfolgreich bereitgestellt!",
@@ -6856,6 +6860,7 @@
   "The NVIDIA hook or environment differs from the declared one": "Der NVIDIA-Hook oder die Umgebung unterscheidet sich von dem deklarierten",
   "The NVIDIA hook path does not belong to the installer": "Der NVIDIA-Hookpfad gehört nicht zum Installateur",
   "The NVIDIA installer needs at least": "Das NVIDIA-Installationsprogramm benötigt mindestens",
+  "The NVIDIA installer stopped with this error:": "Das NVIDIA-Installationsprogramm wurde mit diesem Fehler beendet:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "Die NVIDIA Laufzeit ist aktuell; der Container wird nicht geändert oder gestartet",
   "The Nextcloud volume needs at least 8 GB": "Das Nextcloud-Volume benötigt mindestens 8 GB",
   "The OCI archive contains no SHA-256 blobs": "Das OCI-Archiv enthält keine SHA-256 Blobs",
@@ -7148,6 +7153,7 @@
   "The journal has an incomplete recovery state": "Das Journal hat einen unvollständigen Wiederherstellungszustand",
   "The kernel module is not active:": "Das Kernelmodul ist nicht aktiv:",
   "The kernel module of version": "Das Kernelmodul der Version",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "Der Kernel lädt nur signierte Module, und dieses Installationsprogramm erstellt das NVIDIA-Modul unsigniert, daher würde die Installation fehlschlagen.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "Der lokale Umschlag wird gelöscht und zukünftige Sicherungen laden nichts hoch. Bereits auf PBS hochgeladene Umschläge bleiben intakt und können mit ihrer ursprünglichen Passphrase wiederhergestellt werden.",
   "The local storage does not accept snippets": "Der lokale Speicher akzeptiert keine Snippets",
   "The long test runs directly on the disk hardware.": "Der Langzeittest läuft direkt auf der Festplatten-Hardware.",

lang/es.json

@@ -1946,6 +1946,7 @@
   "Directory:": "Directorio:",
   "Directus administrator": "Administrador de Directus",
   "Disable NIC Offloading (Intel e1000e)": "Desactivar offloading de NIC (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Desactiva Secure Boot en el firmware UEFI y vuelve a ejecutar el instalador. No se ha cambiado nada.",
   "Disable autostart on conflicting VM": "Deshabilitar el inicio automático en VM en conflicto",
   "Disable autostart on one VM to avoid startup conflicts.": "Desactiva el inicio automático en una VM para evitar conflictos de inicio.",
   "Disable job": "Desactivar trabajo",
@@ -4313,6 +4314,7 @@
   "NVIDIA driver": "Controlador NVIDIA",
   "NVIDIA driver installed successfully.": "El controlador NVIDIA se instaló correctamente.",
   "NVIDIA driver installed:": "Controlador NVIDIA instalado:",
+  "NVIDIA driver not installed": "Driver de NVIDIA no instalado",
   "NVIDIA driver verification in container:": "Verificación del controlador NVIDIA en contenedor:",
   "NVIDIA drivers are not installed or not loaded on this host.": "Los controladores NVIDIA no están instalados o no están cargados en este host.",
   "NVIDIA host services disabled for VFIO mode": "Servicios de host NVIDIA deshabilitados para el modo VFIO",
@@ -6025,6 +6027,8 @@
   "Search/Filter Scripts": "Buscar/filtrar scripts",
   "Searchable document archive with OCR": "Archivo de documentos con búsqueda y OCR",
   "Secondary upstream DNS server": "Servidor DNS secundario de reenvío",
+  "Secure Boot Enabled": "Secure Boot activado",
+  "Secure Boot is enabled on this host.": "Secure Boot está activado en este host.",
   "Secure Disk Formatter": "Formateador de disco seguro",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (VPN Tailscale)",
   "Secure Gateway deployed successfully!": "¡Secure Gateway se implementó con éxito!",
@@ -6840,6 +6844,7 @@
   "The NVIDIA hook or environment differs from the declared one": "El hook o entorno NVIDIA difiere del declarado",
   "The NVIDIA hook path does not belong to the installer": "La ruta del hook NVIDIA no pertenece al instalador",
   "The NVIDIA installer needs at least": "El instalador de NVIDIA necesita al menos",
+  "The NVIDIA installer stopped with this error:": "El instalador de NVIDIA se detuvo con este error:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "El tiempo de funcionamiento de NVIDIA está actualizado; el contenedor no se modifica o se inicia",
   "The Nextcloud volume needs at least 8 GB": "El volumen de Nextcloud necesita al menos 8 GB",
   "The OCI archive contains no SHA-256 blobs": "El archivo OCI no contiene bloques SHA-256",
@@ -7128,6 +7133,7 @@
   "The journal has an incomplete recovery state": "El diario de la operación tiene un estado de recuperación incompleto",
   "The kernel module is not active:": "El módulo del kernel no está activo:",
   "The kernel module of version": "El módulo del kernel de la versión",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "El kernel solo carga módulos firmados y este instalador compila el módulo de NVIDIA sin firmar, por lo que la instalación fallaría.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "El sobre local se descarta y los backups futuros no suben nada. Los sobres ya subidos a PBS permanecen intactos y recuperables con su frase de contraseña original.",
   "The local storage does not accept snippets": "El almacenamiento local no admite snippets",
   "The long test runs directly on the disk hardware.": "La prueba larga se ejecuta directamente en el hardware del disco.",

lang/fr.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Annuaire:",
   "Directus administrator": "Administrateur Directus",
   "Disable NIC Offloading (Intel e1000e)": "Désactiver le déchargement de la carte réseau (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Désactivez Secure Boot dans le firmware UEFI et relancez le programme d'installation. Rien n'a été modifié.",
   "Disable autostart on conflicting VM": "Désactiver le démarrage automatique sur la VM en conflit",
   "Disable autostart on one VM to avoid startup conflicts.": "Désactivez le démarrage automatique sur une VM pour éviter les conflits de démarrage.",
   "Disable job": "Désactiver le travail",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "Pilote NVIDIA",
   "NVIDIA driver installed successfully.": "Pilote NVIDIA installé avec succès.",
   "NVIDIA driver installed:": "Pilote NVIDIA installé :",
+  "NVIDIA driver not installed": "Pilote NVIDIA non installé",
   "NVIDIA driver verification in container:": "Vérification du pilote NVIDIA dans le conteneur :",
   "NVIDIA drivers are not installed or not loaded on this host.": "Les pilotes NVIDIA ne sont pas installés ou ne sont pas chargés sur cet hôte.",
   "NVIDIA host services disabled for VFIO mode": "Services hôte NVIDIA désactivés pour le mode VFIO",
@@ -6042,6 +6044,8 @@
   "Search/Filter Scripts": "Scripts de recherche/filtrage",
   "Searchable document archive with OCR": "Archive documentaire consultable avec OCR",
   "Secondary upstream DNS server": "Serveur DNS amont secondaire",
+  "Secure Boot Enabled": "Secure Boot activé",
+  "Secure Boot is enabled on this host.": "Secure Boot est activé sur cet hôte.",
   "Secure Disk Formatter": "Formateur de disque sécurisé",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (VPN Tailscale)",
   "Secure Gateway deployed successfully!": "Secure Gateway déployé avec succès !",
@@ -6855,6 +6859,7 @@
   "The NVIDIA hook or environment differs from the declared one": "Le crochet ou l'environnement NVIDIA diffère de celui déclaré",
   "The NVIDIA hook path does not belong to the installer": "Le chemin de crochet NVIDIA n'appartient pas à l'installateur",
   "The NVIDIA installer needs at least": "Le programme d'installation de NVIDIA a besoin d'au moins",
+  "The NVIDIA installer stopped with this error:": "Le programme d'installation de NVIDIA s'est arrêté avec cette erreur :",
   "The NVIDIA runtime is up to date; the container is not modified or started": "L'exécution NVIDIA est à jour; le conteneur n'est ni modifié ni démarré.",
   "The Nextcloud volume needs at least 8 GB": "Le volume Nextcloud nécessite au moins 8 Go",
   "The OCI archive contains no SHA-256 blobs": "L'archive OCI ne contient pas de blobs SHA-256",
@@ -7147,6 +7152,7 @@
   "The journal has an incomplete recovery state": "La revue a un état de récupération incomplet",
   "The kernel module is not active:": "Le module noyau n'est pas actif:",
   "The kernel module of version": "Le module noyau de la version",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "Le noyau ne charge que des modules signés et ce programme d'installation compile le module NVIDIA sans signature, l'installation échouerait donc.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "L'enveloppe locale est supprimée et les futures sauvegardes ne téléchargent rien. Les enveloppes téléchargées déjà sur PBS restent intactes et restent récupérables avec leur phrase secrète d'origine.",
   "The local storage does not accept snippets": "Le stockage local n'accepte pas les snippets",
   "The long test runs directly on the disk hardware.": "Le test long s'exécute directement sur le matériel du disque.",

lang/it.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Directory:",
   "Directus administrator": "Amministratore Directus",
   "Disable NIC Offloading (Intel e1000e)": "Disabilita offload NIC (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Disattiva Secure Boot nel firmware UEFI ed esegui di nuovo il programma di installazione. Non è stato modificato nulla.",
   "Disable autostart on conflicting VM": "Disabilita l'avvio automatico sulla VM in conflitto",
   "Disable autostart on one VM to avoid startup conflicts.": "Disabilita l'avvio automatico su una VM per evitare conflitti di avvio.",
   "Disable job": "Disabilita job",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "Driver NVIDIA",
   "NVIDIA driver installed successfully.": "Driver NVIDIA installato correttamente.",
   "NVIDIA driver installed:": "Driver NVIDIA installato:",
+  "NVIDIA driver not installed": "Driver NVIDIA non installato",
   "NVIDIA driver verification in container:": "Verifica driver NVIDIA nel container:",
   "NVIDIA drivers are not installed or not loaded on this host.": "I driver NVIDIA non sono installati o non caricati su questo host.",
   "NVIDIA host services disabled for VFIO mode": "Servizi host NVIDIA disabilitati per la modalità VFIO",
@@ -6042,6 +6044,8 @@
   "Search/Filter Scripts": "Cerca/filtra script",
   "Searchable document archive with OCR": "Archivio documenti ricercabile con OCR",
   "Secondary upstream DNS server": "Server DNS upstream secondario",
+  "Secure Boot Enabled": "Secure Boot attivo",
+  "Secure Boot is enabled on this host.": "Secure Boot è attivo su questo host.",
   "Secure Disk Formatter": "Formattatore di dischi sicuro",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (VPN Tailscale)",
   "Secure Gateway deployed successfully!": "Secure Gateway distribuito con successo!",
@@ -6856,6 +6860,7 @@
   "The NVIDIA hook or environment differs from the declared one": "L'hook NVIDIA o l'ambiente differisce da quanto dichiarato",
   "The NVIDIA hook path does not belong to the installer": "Il percorso dell'hook NVIDIA non appartiene al programma di installazione",
   "The NVIDIA installer needs at least": "Il programma di installazione NVIDIA ha bisogno di almeno",
+  "The NVIDIA installer stopped with this error:": "Il programma di installazione NVIDIA si è interrotto con questo errore:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "Il runtime NVIDIA è aggiornato; il container non viene modificato né avviato",
   "The Nextcloud volume needs at least 8 GB": "Il volume Nextcloud richiede almeno 8 GB",
   "The OCI archive contains no SHA-256 blobs": "L’archivio OCI non contiene blob SHA-256",
@@ -7148,6 +7153,7 @@
   "The journal has an incomplete recovery state": "Il registro dell'operazione indica uno stato di ripristino incompleto",
   "The kernel module is not active:": "Il modulo del kernel non è attivo:",
   "The kernel module of version": "Il modulo del kernel della versione",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "Il kernel carica solo moduli firmati e questo programma di installazione compila il modulo NVIDIA senza firma, quindi l'installazione non riuscirebbe.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "La busta locale viene eliminata e i backup futuri non caricano nulla. Le buste già caricate su PBS restano intatte e recuperabili con la passphrase originale.",
   "The local storage does not accept snippets": "Lo storage locale non accetta snippet",
   "The long test runs directly on the disk hardware.": "Il test lungo si esegue direttamente sull’hardware del disco.",

lang/pt.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Diretório:",
   "Directus administrator": "Administrador do Directus",
   "Disable NIC Offloading (Intel e1000e)": "Desativar descarregamento de NIC (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Desative o Secure Boot no firmware UEFI e execute o instalador novamente. Nada foi alterado.",
   "Disable autostart on conflicting VM": "Desative a inicialização automática em VM conflitante",
   "Disable autostart on one VM to avoid startup conflicts.": "Desative a inicialização automática em uma VM para evitar conflitos de inicialização.",
   "Disable job": "Desativar trabalho",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "Controlador NVIDIA",
   "NVIDIA driver installed successfully.": "Driver NVIDIA instalado com sucesso.",
   "NVIDIA driver installed:": "Driver NVIDIA instalado:",
+  "NVIDIA driver not installed": "Driver NVIDIA não instalado",
   "NVIDIA driver verification in container:": "Verificação do driver NVIDIA no contêiner:",
   "NVIDIA drivers are not installed or not loaded on this host.": "Os drivers NVIDIA não estão instalados ou não carregados neste host.",
   "NVIDIA host services disabled for VFIO mode": "Serviços de host NVIDIA desativados para modo VFIO",
@@ -6042,6 +6044,8 @@
   "Search/Filter Scripts": "Scripts de pesquisa/filtro",
   "Searchable document archive with OCR": "Arquivo de documentos pesquisável com OCR",
   "Secondary upstream DNS server": "Servidor DNS a montante secundário",
+  "Secure Boot Enabled": "Secure Boot ativado",
+  "Secure Boot is enabled on this host.": "O Secure Boot está ativado neste host.",
   "Secure Disk Formatter": "Formatador de disco seguro",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (VPN Tailscale)",
   "Secure Gateway deployed successfully!": "Secure Gateway implantado com sucesso!",
@@ -6856,6 +6860,7 @@
   "The NVIDIA hook or environment differs from the declared one": "O gancho ou ambiente NVIDIA difere do declarado",
   "The NVIDIA hook path does not belong to the installer": "O caminho do gancho NVIDIA não pertence ao instalador",
   "The NVIDIA installer needs at least": "O instalador NVIDIA precisa de pelo menos",
+  "The NVIDIA installer stopped with this error:": "O instalador NVIDIA parou com este erro:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "O tempo de execução NVIDIA está atualizado; o recipiente não é modificado ou iniciado",
   "The Nextcloud volume needs at least 8 GB": "O volume Nextcloud precisa de pelo menos 8 GB",
   "The OCI archive contains no SHA-256 blobs": "O arquivo OCI não contém bolhas SHA-256",
@@ -7148,6 +7153,7 @@
   "The journal has an incomplete recovery state": "A revista tem um estado de recuperação incompleto",
   "The kernel module is not active:": "O módulo do kernel não está ativo:",
   "The kernel module of version": "O módulo do kernel da versão",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "O kernel carrega apenas módulos assinados e este instalador compila o módulo NVIDIA sem assinatura, portanto a instalação falharia.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "O envelope local é eliminado e os backups futuros não carregam nada. Os envelopes carregados já no PBS permanecem intactos e podem ser recuperados com sua senha original.",
   "The local storage does not accept snippets": "O armazenamento local não aceita snippets",
   "The long test runs directly on the disk hardware.": "O teste longo é executado diretamente no hardware do disco.",

lang/sk.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Priečinok:",
   "Directus administrator": "Správca Directus",
   "Disable NIC Offloading (Intel e1000e)": "Vypnúť NIC offloading (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Vypnite Secure Boot vo firmvéri UEFI a spustite inštalátor znova. Nič sa nezmenilo.",
   "Disable autostart on conflicting VM": "Vypnúť automatický štart na konfliktnej VM",
   "Disable autostart on one VM to avoid startup conflicts.": "Na jednej VM vypnite automatický štart, aby nevznikol konflikt pri spúšťaní.",
   "Disable job": "Zakázať úlohu",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "Ovládač NVIDIA",
   "NVIDIA driver installed successfully.": "Ovládač NVIDIA bol úspešne nainštalovaný.",
   "NVIDIA driver installed:": "Ovládač NVIDIA nainštalovaný:",
+  "NVIDIA driver not installed": "Ovládač NVIDIA nie je nainštalovaný",
   "NVIDIA driver verification in container:": "Overenie NVIDIA ovládača v kontajneri:",
   "NVIDIA drivers are not installed or not loaded on this host.": "NVIDIA ovládače nie sú na tomto hostovi nainštalované alebo načítané.",
   "NVIDIA host services disabled for VFIO mode": "NVIDIA služby hosta vypnuté pre VFIO režim",
@@ -6044,6 +6046,8 @@
   "Search/Filter Scripts": "Hľadať/filtrovať skripty",
   "Searchable document archive with OCR": "Vyhľadávateľný archív dokumentov s OCR",
   "Secondary upstream DNS server": "Sekundárny nadradený server DNS",
+  "Secure Boot Enabled": "Secure Boot je zapnutý",
+  "Secure Boot is enabled on this host.": "Secure Boot je na tomto hostovi zapnutý.",
   "Secure Disk Formatter": "Bezpečné formátovanie disku",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (Tailscale VPN)",
   "Secure Gateway deployed successfully!": "Secure Gateway úspešne nasadené!",
@@ -6857,6 +6861,7 @@
   "The NVIDIA hook or environment differs from the declared one": "Spúšťací skript alebo prostredie NVIDIA sa líši od deklarovaného",
   "The NVIDIA hook path does not belong to the installer": "Cesta k háku NVIDIA nepatrí inštalátorovi",
   "The NVIDIA installer needs at least": "NVIDIA inštalátor potrebuje aspoň",
+  "The NVIDIA installer stopped with this error:": "NVIDIA inštalátor sa zastavil s touto chybou:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "Runtime NVIDIA je aktuálny; kontajner nie je upravený ani spustený",
   "The Nextcloud volume needs at least 8 GB": "Dátový zväzok Nextcloud musí mať najmenej 8 GB",
   "The OCI archive contains no SHA-256 blobs": "Archív OCI neobsahuje žiadne SHA-256 blobs",
@@ -7149,6 +7154,7 @@
   "The journal has an incomplete recovery state": "Záznam operácie obsahuje neúplný stav obnovy",
   "The kernel module is not active:": "Modul jadra nie je aktívny:",
   "The kernel module of version": "Modul jadra verzie",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "Jadro načítava iba podpísané moduly a tento inštalátor zostavuje modul NVIDIA bez podpisu, takže inštalácia by zlyhala.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "Lokálna obálka sa zahodí a budúce zálohy už nič nenahrajú. Obálky, ktoré už sú v PBS, zostanú zachované a budú obnoviteľné pôvodnou frázou.",
   "The local storage does not accept snippets": "Úložisko local nepodporuje obsah typu snippets",
   "The long test runs directly on the disk hardware.": "Dlhý test beží priamo na hardvéri disku.",

lang/sv.json

@@ -1948,6 +1948,7 @@
   "Directory:": "Katalog:",
   "Directus administrator": "Directus-administratör",
   "Disable NIC Offloading (Intel e1000e)": "Inaktivera NIC-avlastning (Intel e1000e)",
+  "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.": "Inaktivera Secure Boot i UEFI-firmware och kör installationsprogrammet igen. Inget har ändrats.",
   "Disable autostart on conflicting VM": "Inaktivera autostart på VM i konflikt",
   "Disable autostart on one VM to avoid startup conflicts.": "Inaktivera autostart på en virtuell dator för att undvika startkonflikter.",
   "Disable job": "Inaktivera jobbet",
@@ -4318,6 +4319,7 @@
   "NVIDIA driver": "NVIDIA-drivrutinen",
   "NVIDIA driver installed successfully.": "NVIDIA-drivrutinen har installerats.",
   "NVIDIA driver installed:": "NVIDIA-drivrutin installerad:",
+  "NVIDIA driver not installed": "NVIDIA-drivrutinen är inte installerad",
   "NVIDIA driver verification in container:": "NVIDIA-drivrutinsverifiering i behållare:",
   "NVIDIA drivers are not installed or not loaded on this host.": "NVIDIA-drivrutiner är inte installerade eller laddade inte på denna värd.",
   "NVIDIA host services disabled for VFIO mode": "NVIDIA-värdtjänster inaktiverade för VFIO-läge",
@@ -6042,6 +6044,8 @@
   "Search/Filter Scripts": "Sök/filtrera skript",
   "Searchable document archive with OCR": "Sökbart dokumentarkiv med OCR",
   "Secondary upstream DNS server": "Sekundär uppströms DNS-server",
+  "Secure Boot Enabled": "Secure Boot är aktiverat",
+  "Secure Boot is enabled on this host.": "Secure Boot är aktiverat på denna värd.",
   "Secure Disk Formatter": "Säker diskformaterare",
   "Secure Gateway (Tailscale VPN)": "Secure Gateway (Tailscale VPN)",
   "Secure Gateway deployed successfully!": "Secure Gateway har implementerats framgångsrikt!",
@@ -6856,6 +6860,7 @@
   "The NVIDIA hook or environment differs from the declared one": "NVIDIA-kroken eller miljön skiljer sig från den deklarerade",
   "The NVIDIA hook path does not belong to the installer": "NVIDIA-hookbanan hör inte till installatören",
   "The NVIDIA installer needs at least": "NVIDIA-installationsprogrammet behöver minst",
+  "The NVIDIA installer stopped with this error:": "NVIDIA-installationsprogrammet stoppades med det här felet:",
   "The NVIDIA runtime is up to date; the container is not modified or started": "NVIDIA runtime är uppdaterad; behållaren är inte modifierad eller startad",
   "The Nextcloud volume needs at least 8 GB": "Nextcloud-volymen behöver minst 8 GB",
   "The OCI archive contains no SHA-256 blobs": "OCI-arkivet innehåller inga SHA-256 blobs",
@@ -7148,6 +7153,7 @@
   "The journal has an incomplete recovery state": "Tidskriften har en ofullständig återhämtning stat",
   "The kernel module is not active:": "Kernelmodulen är inte aktiv:",
   "The kernel module of version": "Kärnmodulen i versionen",
+  "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.": "Kärnan läser bara in signerade moduler och det här installationsprogrammet bygger NVIDIA-modulen utan signatur, så installationen skulle misslyckas.",
   "The local envelope is dropped and future backups do not upload anything. Uploaded envelopes already on PBS stay intact and remain recoverable with their original passphrase.": "Det lokala kuvertet tappas och framtida säkerhetskopior laddar inte upp någonting. Uppladdade kuvert som redan finns på PBS förblir intakta och kan återställas med sin ursprungliga lösenfras.",
   "The local storage does not accept snippets": "Den lokala lagringen accepterar inte snippets",
   "The long test runs directly on the disk hardware.": "Det långa testet körs direkt på hårdvaran på hårddisken.",

scripts/gpu_tpu/nvidia_installer.sh

@@ -32,6 +32,7 @@ BASE_DIR="/usr/local/share/proxmenux"
 UTILS_FILE="$BASE_DIR/utils.sh"
 COMPONENTS_STATUS_FILE="$BASE_DIR/components_status.json"
 LOG_FILE="/tmp/nvidia_install.log"
+SECURE_BOOT_EFIVAR="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c"
 screen_capture="/tmp/proxmenux_nvidia_screen_capture_$$.txt"
 
 NVIDIA_BASE_URL="https://download.nvidia.com/XFree86/Linux-x86_64"
@@ -136,6 +137,29 @@ check_gpu_not_in_vm_passthrough() {
   exit 0
 }
 
+# The variable holds 4 attribute bytes followed by the state.
+secure_boot_enabled() {
+  local state
+  state=$(od -An -t u1 -j4 -N1 "$SECURE_BOOT_EFIVAR" 2>/dev/null)
+  [[ "${state//[[:space:]]/}" == "1" ]]
+}
+
+# The installer builds an unsigned module, which the kernel refuses under
+# Secure Boot. Asked before anything is removed, so the driver stays in place.
+check_secure_boot_for_install() {
+  secure_boot_enabled || return 0
+
+  local msg
+  msg="\n$(translate "Secure Boot is enabled on this host.")\n\n"
+  msg+="$(translate "The kernel only loads signed modules and this installer builds the NVIDIA module unsigned, so the installation would fail.")\n\n"
+  msg+="$(translate "Disable Secure Boot in the UEFI firmware and run the installer again. Nothing has been changed.")"
+
+  dialog --backtitle "ProxMenux" \
+    --title "$(translate "Secure Boot Enabled")" \
+    --msgbox "$msg" 14 78
+  exit 0
+}
+
 check_stale_vfio_config_for_nvidia() {
   pmx_journal_context "check_stale_vfio_config_for_nvidia" "1.3" "nvidia_installer.sh"
   local vfio_conf="/etc/modprobe.d/vfio.conf"
@@ -1634,6 +1658,16 @@ run_nvidia_installer() {
   return 0
 }
 
+# Keeps the failure on screen: the menu redraws as soon as the script exits.
+show_nvidia_install_failure() {
+  local reason
+  reason=$(grep -a -m1 '^ERROR:' /var/log/nvidia-installer.log 2>/dev/null | sed 's/^ERROR: *//' | cut -c1-300)
+  [[ -n "$reason" ]] || reason=$(grep -a -m1 '^ERROR:' "$LOG_FILE" 2>/dev/null | sed 's/^ERROR: *//' | cut -c1-300)
+
+  hybrid_msgbox "$(translate 'NVIDIA driver not installed')" \
+    "\n$(translate 'The NVIDIA installer stopped with this error:')\n\n${reason}\n\n$(translate 'Log file'): ${LOG_FILE}\n$(translate 'Log file'): /var/log/nvidia-installer.log" 18 78
+}
+
 remove_nvidia_driver() {
   complete_nvidia_uninstall
 }
@@ -2156,6 +2190,8 @@ main() {
 
   case "$ACTION" in
     install)
+      check_secure_boot_for_install
+
       if ! show_install_overview; then
         exit 0
       fi
@@ -2257,6 +2293,7 @@ main() {
 
       if ! run_nvidia_installer "$installer"; then
         rm -f "$screen_capture"
+        show_nvidia_install_failure
         exit 1
       fi
       
@@ -2448,6 +2485,12 @@ auto_reinstall_from_state() {
     return 0
   fi
 
+  if secure_boot_enabled; then
+    echo "Secure Boot is enabled: the kernel would refuse the unsigned module — skipping host driver reinstall" \
+      | tee -a "$LOG_FILE"
+    return 2
+  fi
+
   DRIVER_VERSION="$recorded_version"
 
   # Same install path as the interactive main() flow, minus all

tests/test_login_totp_field.py

@@ -0,0 +1,16 @@
+"""Bitwarden skips a 2FA field whose siblings mention a backup code (issue #570)."""
+from pathlib import Path
+import unittest
+
+SOURCE = (Path(__file__).resolve().parents[1] / "AppImage/components/login.tsx").read_text()
+
+
+class LoginTotpFieldTests(unittest.TestCase):
+    def test_the_backup_code_hint_is_not_a_sibling_of_the_field(self):
+        field = SOURCE.index('id="totp-code"')
+        hint = SOURCE.index('t("login.backupCodeHint")')
+        self.assertIn("</div>", SOURCE[field:hint])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_nvidia_secure_boot.py

@@ -0,0 +1,48 @@
+"""The NVIDIA installer stops under Secure Boot before removing the driver."""
+from pathlib import Path
+import re
+import subprocess
+import tempfile
+import unittest
+
+SOURCE = (Path(__file__).resolve().parents[1] / "scripts/gpu_tpu/nvidia_installer.sh").read_text()
+
+
+def function(name):
+    return re.search(rf"^{name}\(\) \{{\n.*?^\}}\n", SOURCE, re.M | re.S).group(0)
+
+
+class NvidiaSecureBootTests(unittest.TestCase):
+    def state(self, payload):
+        with tempfile.NamedTemporaryFile() as efivar:
+            efivar.write(payload)
+            efivar.flush()
+            script = f'SECURE_BOOT_EFIVAR="{efivar.name}"\n{function("secure_boot_enabled")}secure_boot_enabled'
+            return subprocess.run(["bash", "-c", script]).returncode
+
+    def test_the_firmware_variable_decides(self):
+        self.assertEqual(self.state(b"\x06\x00\x00\x00\x01"), 0)
+        self.assertEqual(self.state(b"\x06\x00\x00\x00\x00"), 1)
+
+    def test_a_host_without_the_variable_is_not_blocked(self):
+        script = f'SECURE_BOOT_EFIVAR="/nonexistent"\n{function("secure_boot_enabled")}secure_boot_enabled'
+        self.assertEqual(subprocess.run(["bash", "-c", script]).returncode, 1)
+
+    def test_the_interactive_install_checks_before_removing_the_driver(self):
+        main = function("main")
+        install = main[main.index("    install)\n"):main.index("    remove)\n")]
+        self.assertLess(install.index("check_secure_boot_for_install"), install.index("complete_nvidia_uninstall"))
+        self.assertNotIn("check_secure_boot_for_install", main[main.index("    remove)\n"):])
+
+    def test_the_automatic_reinstall_checks_before_removing_the_driver(self):
+        reinstall = function("auto_reinstall_from_state")
+        self.assertLess(reinstall.index("secure_boot_enabled"), reinstall.index("complete_nvidia_uninstall"))
+
+    def test_an_installer_failure_is_shown_before_leaving(self):
+        main = function("main")
+        failure = main[main.index('if ! run_nvidia_installer "$installer"; then'):]
+        self.assertLess(failure.index("show_nvidia_install_failure"), failure.index("exit 1"))
+
+
+if __name__ == "__main__":
+    unittest.main()

web/data/changelog/es.md

@@ -55,6 +55,8 @@ Un agradecimiento especial a [@Vaso73](https://github.com/Vaso73), [@f3rs3n](htt
 - **El uso de disco de una VM cuenta todos los sistemas de archivos del invitado** ([#559](https://github.com/MacRimi/ProxMenux/issues/559), con el arreglo propuesto por [@TheFoxCraft](https://github.com/TheFoxCraft)), también en invitados cuyo agente no indica el nombre del dispositivo, como Alpine.
 - **La comprobación de LVM mantiene el filtro de Proxmox para zvols e imágenes RBD** en hosts cuyos únicos grupos de volúmenes pertenecen a sus VM ([#552](https://github.com/MacRimi/ProxMenux/issues/552), reportado por [@osipovdm-dot](https://github.com/osipovdm-dot)).
 - **Un grupo de volúmenes sin volúmenes activos se considera correcto**, como un disco de otra instalación, VM o CT detenidos o un LVM compartido. Un almacenamiento que Proxmox no puede usar se sigue avisando desde la comprobación de almacenamiento.
+- **El instalador de NVIDIA se detiene antes de tocar el driver si Secure Boot está activado** ([#571](https://github.com/MacRimi/ProxMenux/issues/571), reportado por [@Balethorn](https://github.com/Balethorn)), porque el kernel rechazaría el módulo sin firmar, y cualquier fallo del instalador queda en pantalla con su motivo.
+- **Bitwarden reconoce el campo 2FA en el inicio de sesión del Monitor** ([#570](https://github.com/MacRimi/ProxMenux/issues/570), reportado por [@shtefko](https://github.com/shtefko)): la pista del código de backup mantiene su texto y su lugar, fuera del grupo del campo.
 - **Secure Gateway se instala en hosts Proxmox sobre BTRFS** ([#564](https://github.com/MacRimi/ProxMenux/issues/564), reportado por [@78v5](https://github.com/78v5)): la plantilla de Alpine va a un almacenamiento activo que admite plantillas de contenedor.
 - **Un error de E/S de disco del kernel se registra en su disco**, con su número de serie, también cuando el error nombra una partición.
 - **El Monitor se instala como aplicación (PWA) desde el navegador**: sirve su propio manifiesto de aplicación web y su service worker, con los iconos de 192 y 512 px que exige Chrome.