Both batches seed the same block for their English-only additions. One
read and one write now cover the PBS key guidance and the Borg SSH keys
together.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.
Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.
Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources
Audit & Report:
- findings that moved in the wrong direction between runs are reported
alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
do next
Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes
The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
feat(host-backup): custom SSH port for Borg remote targets
Add Borg destinations no longer assume port 22. The Monitor form and
the shell TUI both take an optional port (default 22, range 1-65535)
and embed it in the persisted ssh://user@host:port/path URL. BORG_RSH,
the sshpass key installer and the capacity probe all honour it.
Reported by @songochain in #236 — NAS-style Borg hosts on non-standard
SSH ports are now first-class targets.
Existing borg-targets.txt entries without a port keep working; the
port is only serialised into the URL when it differs from 22.
Modal caches now refresh on events only — the periodic prewarmer runs one-shot at startup, mount points split into static/runtime endpoints, and backups get a client 6-hour gate. Updates tab shows post-apply feedback and the script terminal no longer closes the parent modal. Settings adds edit gating on 3 cards with the 3-level contrast rule applied consistently. ES translation batch (~25 fixes) and What's New for 1.2.4.1-beta refreshed.
Localize runtime labels for SMART/NVMe details, backup target badges, firewall interface types, settings units, and generated health status copy while keeping the English and Slovak catalogs in key parity.
Move Monitor dashboard UI copy into translation keys and expand the English source catalog across the main pages, modals, and shared AppImage components.
Three bugs against the PBS encryption flow:
1. Create-scheduled-job with encryption failed with "Recovery setup
failed: no PBS keyfile present" whenever the operator picked
"Generate a new keyfile" but had no keyfile installed yet. The
frontend called /pbs-recovery/setup before creating the job, but
the keyfile was only materialised later during job creation. The
endpoint now generates the keyfile atomically if missing before
building the escrow blob — same prompt-first order the CLI wizard
applies. Existing keyfiles are still trusted and never rotated.
2. Importing a valid PBS keyfile via the Web dialog returned a
generic "did not recognise this file as a valid PBS keyfile" that
hid the real reason (kdf mismatch, missing passphrase, corrupt
JSON, ...). The endpoint now attaches the stderr of
`proxmox-backup-client key info` as `tool_output` and the frontend
renders it verbatim inside the red banner. Also strips a leading
UTF-8 BOM before validating so an editor-inserted BOM stops being
silently classified as "invalid keyfile".
3. Downloading an encrypted PBS snapshot failed with "missing key —
manifest was created with key XX:XX:..." even when the correct
keyfile was installed at /usr/local/share/proxmenux/pbs-key.conf,
because the restore worker invoked `proxmox-backup-client restore`
without `--keyfile`. The flag is now passed whenever a local
keyfile exists (PBS ignores it for unencrypted archives). On a
fingerprint mismatch the error now appends the installed key's
fingerprint so it can be compared side-by-side with the manifest's
expected value — same fingerprint also exposed via
/pbs-recovery/status for the UI.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
MacRimiandClaude Opus 5
martino
Codex