new beta 1.2.4.1

scripts/backup_restore/backup_scheduler.sh

@@ -296,6 +296,10 @@ _create_job_attached() {
         "PBS_BACKUP_ID=${bid}"
         "PBS_KEYFILE=${pbs_kf_val}"
         "PBS_ENCRYPTION_PASSWORD=${HB_PBS_ENC_PASS:-}"
+        # Resolved by hb_select_pbs_repository. Persist it so the runner
+        # doesn't have to re-derive it — it can only do that for
+        # Datacenter-managed storages.
+        "PBS_FINGERPRINT=${HB_PBS_FINGERPRINT:-}"
       )
       ;;
     local)
@@ -463,6 +467,10 @@ _create_job() {
         "PBS_BACKUP_ID=${bid}"
         "PBS_KEYFILE=${pbs_kf_val}"
         "PBS_ENCRYPTION_PASSWORD=${HB_PBS_ENC_PASS:-}"
+        # Resolved by hb_select_pbs_repository. Persist it so the runner
+        # doesn't have to re-derive it — it can only do that for
+        # Datacenter-managed storages.
+        "PBS_FINGERPRINT=${HB_PBS_FINGERPRINT:-}"
       )
       ;;
   esac

scripts/backup_restore/lib_host_backup_common.sh

@@ -840,14 +840,44 @@ hb_configure_pbs_manual() {
 
     repo="${user}@${host}:${datastore}"
     mkdir -p "$HB_STATE_DIR"
+
+    # Capture the PBS certificate fingerprint. proxmox-backup-client
+    # refuses a self-signed PBS without one, and a scheduled job has no
+    # TTY to answer the interactive prompt — so a destination added here
+    # with no fingerprint would fail every timed run. openssl reads the
+    # cert without authenticating; show it for the operator to confirm
+    # (trust-on-first-use) before saving. Skipped silently if the host is
+    # unreachable or openssl is absent — a CA-signed PBS needs no pin.
+    local fingerprint="" fp_host fp_port
+    fp_host="${host%%:*}"
+    fp_port="${host##*:}"
+    [[ "$fp_port" == "$host" || -z "$fp_port" ]] && fp_port=8007
+    if command -v openssl >/dev/null 2>&1; then
+        fingerprint=$(echo | timeout 8 openssl s_client -connect "${fp_host}:${fp_port}" 2>/dev/null \
+            | openssl x509 -fingerprint -sha256 -noout 2>/dev/null \
+            | sed 's/.*=//' | tr 'A-Z' 'a-z')
+    fi
+    if [[ -n "$fingerprint" ]]; then
+        if ! dialog --backtitle "ProxMenux" --title "$(hb_translate "PBS certificate")" \
+            --yesno "$(hb_translate "Certificate fingerprint of the PBS server:")\n\n${fingerprint}\n\n$(hb_translate "Trust this certificate and save it for scheduled backups?")" \
+            14 76; then
+            fingerprint=""
+        fi
+    fi
+
     local cfg_line="${name}|${repo}"
     local manual_cfg="$HB_STATE_DIR/pbs-manual-configs.txt"
     touch "$manual_cfg"
     grep -Fxq "$cfg_line" "$manual_cfg" || echo "$cfg_line" >> "$manual_cfg"
     printf '%s' "$secret" > "$HB_STATE_DIR/pbs-pass-${name}.txt"
     chmod 600 "$HB_STATE_DIR/pbs-pass-${name}.txt"
+    if [[ -n "$fingerprint" ]]; then
+        printf '%s' "$fingerprint" > "$HB_STATE_DIR/pbs-fingerprint-${name}.txt"
+        chmod 600 "$HB_STATE_DIR/pbs-fingerprint-${name}.txt"
+    fi
 
     HB_PBS_NAME="$name"; HB_PBS_REPOSITORY="$repo"; HB_PBS_SECRET="$secret"
+    HB_PBS_FINGERPRINT="$fingerprint"
 }
 
 hb_select_pbs_repository() {
@@ -875,13 +905,12 @@ hb_select_pbs_repository() {
         HB_PBS_NAME="${HB_PBS_NAMES[$sel]}"
         export HB_PBS_REPOSITORY="${HB_PBS_REPOS[$sel]}"
         HB_PBS_SECRET="${HB_PBS_SECRETS[$sel]}"
-        # Export the fingerprint so _bk_pbs / _rs_extract_pbs can
-        # pass it to proxmox-backup-client via PBS_FINGERPRINT. The
-        # binary otherwise prompts "Are you sure you want to
-        # continue connecting? (y/n):" — twice in some flows
-        # (backup + catalog upload) — and silently auto-accepts on
-        # stdin closure, which is both noisy and an MITM risk on a
-        # cross-host restore.
+        # Export the fingerprint so _bk_pbs / _rs_extract_pbs can pass it
+        # to proxmox-backup-client via PBS_FINGERPRINT. Against a
+        # self-signed PBS the client only offers its "continue
+        # connecting? (y/n)" prompt on a real TTY; anywhere else it
+        # refuses the connection outright, so the fingerprint is what
+        # makes the transfer work at all.
         export HB_PBS_FINGERPRINT="${HB_PBS_FINGERPRINTS[$sel]:-}"
         if [[ -z "$HB_PBS_SECRET" ]]; then
             while true; do

scripts/backup_restore/run_scheduled_backup.sh

@@ -339,6 +339,35 @@ _sb_pbs_resolve_fingerprint() {
   printf '%s' "$found_fp"
 }
 
+# Same lookup for a PBS destination added through ProxMenux instead of
+# Datacenter → Storage. Those never reach storage.cfg, so the walkers
+# above find nothing and their credentials live only in our state dir:
+# `pbs-manual-configs.txt` holds `<name>|<user>@<server>:<datastore>`
+# lines, and the secret itself is in the `pbs-<kind>-<name>.txt` sidecar
+# written when the destination was added.
+_sb_pbs_state_lookup() {
+  local repo="$1" kind="$2"           # kind: fingerprint | pass
+  local state_dir="${HB_STATE_DIR:-/usr/local/share/proxmenux}"
+  local manual="$state_dir/pbs-manual-configs.txt"
+  [[ -f "$manual" && -n "$repo" ]] || return 1
+
+  local line name entry_repo
+  while IFS= read -r line; do
+    line="${line%%#*}"
+    line="${line#"${line%%[![:space:]]*}"}"
+    line="${line%"${line##*[![:space:]]}"}"
+    [[ -z "$line" || "$line" != *"|"* ]] && continue
+    name="${line%%|*}"
+    entry_repo="${line#*|}"
+    [[ "$entry_repo" == "$repo" ]] || continue
+    local f="$state_dir/pbs-${kind}-${name}.txt"
+    [[ -r "$f" ]] || return 1
+    tr -d '\r\n' < "$f"
+    return 0
+  done < "$manual"
+  return 1
+}
+
 _sb_run_pbs() {
   local stage_root="$1"
   local backup_id="$2"
@@ -363,17 +392,21 @@ _sb_run_pbs() {
   # this function can run unchanged.
   if [[ -z "${PBS_PASSWORD:-}" && -n "${PBS_REPOSITORY:-}" ]]; then
     PBS_PASSWORD=$(_sb_pbs_resolve_password "$PBS_REPOSITORY" 2>/dev/null || true)
+    # ProxMenux-managed destinations aren't in /etc/pve/priv/storage.
+    [[ -z "$PBS_PASSWORD" ]] && \
+      PBS_PASSWORD=$(_sb_pbs_state_lookup "$PBS_REPOSITORY" pass 2>/dev/null || true)
   fi
 
   # Same treatment for PBS_FINGERPRINT. Attached scheduled jobs are
   # created without one (the wizard delegates trust to PVE's storage
-  # config), and running proxmox-backup-client with an empty fingerprint
-  # against a self-signed PBS drops into an interactive `(y/n)` prompt —
-  # which under systemd never gets an answer and hangs the timer.
-  # Resolving on-demand from storage.cfg matches the runtime behavior
-  # PVE itself has for its own vzdump jobs.
+  # config), and against a self-signed PBS the client refuses to connect
+  # without it, so the job fails on every run. Two sources, in order:
+  # PVE's storage.cfg for Datacenter-managed storages, then our own
+  # state dir for destinations added from the ProxMenux UI.
   if [[ -z "${PBS_FINGERPRINT:-}" && -n "${PBS_REPOSITORY:-}" ]]; then
     PBS_FINGERPRINT=$(_sb_pbs_resolve_fingerprint "$PBS_REPOSITORY" 2>/dev/null || true)
+    [[ -z "$PBS_FINGERPRINT" ]] && \
+      PBS_FINGERPRINT=$(_sb_pbs_state_lookup "$PBS_REPOSITORY" fingerprint 2>/dev/null || true)
   fi
 
   # PBS_ENCRYPTION_PASSWORD: the passphrase that unlocks the keyfile