Add audit and reports page, and a change journal

ProxMenux modifies the host: it rewrites configuration files, installs packages, enables services. Until now nobody could say afterwards what had changed, and showing the script does not answer that question — a four-hundred-line function may alter two values, and the reader has no way to know which two. This adds the two halves of an answer.

The change journal records what ProxMenux does as it does it. Eleven bash primitives capture the previous state, apply the change and record it in the same step, writing to a spool that the Monitor reads back. One hundred and thirteen functions across twenty-five scripts are instrumented, covering post-install, shared storage, security tooling, container conversions, disk operations and the PVE 8 to 9 upgrade path. The page shows the difference — rotate 7 becoming rotate 14 — and never the script. Restore and backup scripts are deliberately left out: a restore puts the host back to a state some other script already recorded.

The Audit and reports page answers the other half: what state is this host in, regardless of who put it there. Forty-three checks across seven areas read the host and classify each result as critical, warning, observation, conformant, unverified or not applicable, with the evidence they read attached to each one. A declared policy lets the reader say what this particular host is expected to do — which guests must have a backup, which storages are essential — so the report judges the host against its own intent rather than a generic template. An inventory records the hardware, network and guest topology behind those readings, a comparison shows what moved between two runs, and six report profiles produce a printable document scoped to what the reader needs. Everything is available in the eight supported languages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/menus/config_menu.sh

@@ -61,6 +61,9 @@ MONITOR_PORT=8008
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
 fi
+if [[ -f "$LOCAL_SCRIPTS/global/pmx_journal.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/pmx_journal.sh"
+fi
 
 load_language
 initialize_cache
@@ -749,6 +752,8 @@ show_version_info() {
 
 # ==========================================================
 uninstall_proxmenu() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "uninstall_proxmenu" "$FUNC_VERSION"
     if ! dialog --clear --backtitle "$BACKTITLE" \
                 --title "Uninstall ProxMenux" \
                 --yesno "\n$(translate "Are you sure you want to uninstall ProxMenux?")" 8 60; then
@@ -773,11 +778,13 @@ uninstall_proxmenu() {
         # a pre-static-translations install. Cheap idempotent check.
         if [ -d "/opt/googletrans-env" ]; then
             echo "30" ; echo "Removing legacy googletrans virtualenv..."
+            pmx_record_execution "Remove legacy googletrans virtual environment" "rm -rf /opt/googletrans-env"
             rm -rf "/opt/googletrans-env"
         fi
 
         echo "50" ; echo "Removing ProxMenu files..."
-        rm -f "$INSTALL_DIR/$MENU_SCRIPT"
+        pmx_remove_file "$INSTALL_DIR/$MENU_SCRIPT"
+        pmx_record_execution "Remove ProxMenux application directory" "rm -rf $BASE_DIR"
         rm -rf "$BASE_DIR"
         
         # Remove selected dependencies
@@ -785,22 +792,30 @@ uninstall_proxmenu() {
             echo "70" ; echo "Removing selected dependencies..."
             read -r -a DEPS_ARRAY <<< "$(echo "$deps_to_remove" | tr -d '"')"
             for dep in "${DEPS_ARRAY[@]}"; do
+                pmx_record_execution "Mark ProxMenux dependency as automatic" "apt-mark auto $dep"
                 apt-mark auto "$dep" >/dev/null 2>&1
+                pmx_record_execution "Remove selected ProxMenux dependency" "apt-get -y --purge autoremove $dep"
                 apt-get -y --purge autoremove "$dep" >/dev/null 2>&1
             done
+            pmx_record_execution "Remove unused ProxMenux dependencies" "apt-get autoremove -y --purge"
             apt-get autoremove -y --purge >/dev/null 2>&1
         fi
 
         echo "80" ; echo "Removing ProxMenux Monitor..."
+        pmx_record_execution "Uninstall ProxMenux Monitor" "uninstall_proxmenux_monitor"
         uninstall_proxmenux_monitor
         
         echo "90" ; echo "Restoring system files..."
         # Restore .bashrc and motd
-        [ -f /root/.bashrc.bak ] && mv /root/.bashrc.bak /root/.bashrc
+        if [ -f /root/.bashrc.bak ]; then
+            pmx_write_file /root/.bashrc < /root/.bashrc.bak
+            pmx_remove_file /root/.bashrc.bak
+        fi
         if [ -f /etc/motd.bak ]; then
-            mv /etc/motd.bak /etc/motd
+            pmx_write_file /etc/motd < /etc/motd.bak
+            pmx_remove_file /etc/motd.bak
         else
-            sed -i '/This system is optimised by: ProxMenux/d' /etc/motd
+            pmx_edit_file /etc/motd '/This system is optimised by: ProxMenux/d'
         fi
         
         echo "100" ; echo "Uninstallation complete!"

scripts/menus/network_menu.sh

@@ -41,6 +41,9 @@ TOOLS_JSON="/usr/local/share/proxmenux/installed_tools.json"
 if [[ -f "$UTILS_FILE" ]]; then
     source "$UTILS_FILE"
 fi
+if [[ -f "$LOCAL_SCRIPTS/global/pmx_journal.sh" ]]; then
+    source "$LOCAL_SCRIPTS/global/pmx_journal.sh"
+fi
 
 load_language
 initialize_cache
@@ -389,6 +392,8 @@ analyze_bridge_configuration() {
 
 
 guided_bridge_repair() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "guided_bridge_repair" "$FUNC_VERSION"
     local step=1
     local total_steps=5
 
@@ -482,7 +487,7 @@ guided_bridge_repair() {
             
             # Apply the change
             if [ "$new_ports" != "$current_ports" ]; then
-                sed -i "/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/" /etc/network/interfaces
+                pmx_edit_file /etc/network/interfaces "/iface $bridge/,/bridge-ports/ s/bridge-ports.*/bridge-ports $new_ports/"
             fi
         fi
     done
@@ -520,6 +525,7 @@ guided_bridge_repair() {
         clear
         msg_info "$(translate "Restarting network service...")"
         
+        pmx_record_execution "Restart networking service" "systemctl restart networking"
         if systemctl restart networking; then
             msg_ok "$(translate "Network service restarted successfully")"
         else
@@ -635,6 +641,8 @@ analyze_network_configuration() {
 }
 
 guided_configuration_cleanup() {
+    local FUNC_VERSION="1.0"
+    pmx_journal_context "guided_configuration_cleanup" "$FUNC_VERSION"
     local step=1
     local total_steps=5
 
@@ -714,7 +722,7 @@ guided_configuration_cleanup() {
            --infobox "$(translate "Removing invalid configurations...")\n\n$(translate "This may take a few seconds...")" 8 50
     
     for iface in $interfaces_to_remove; do
-        sed -i "/^iface $iface/,/^$/d" /etc/network/interfaces
+        pmx_edit_file /etc/network/interfaces "/^iface $iface/,/^$/d"
     done
     ((step++))