[pdm-devel] [PATCH access-control/manager/proxmox{, -backup, -yew-comp, -datacenter-manager}/xtermjs 00/25] add remote node shell

[Stefan Hanreich]

Tested this on my local PDM with both PVE / PBS and also quickly checked
that the local shell there still works as well. Worked great, couldn't
find an issue so far. Error messages for non-supported remotes could be
improved.

W.r.t the code only very minor issues stood out (see the responses),
everything lgtm. Some API descriptions could be improved (casing,
periods at the end...).

Consider this:

Tested-by: Stefan Hanreich <s.hanreich at proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich at proxmox.com>


Has nothing to do with this patch series per-se, but PDM also has the
termproxy endpoint for its local shell which we could refactor in a
similar manner as the PBS one (e.g. return type changes, root_id, ...).


On 11/11/25 9:29 AM, Fabian Grünbichler wrote:
> there's a lot of inter-dependencies here, unfortunately.
> 
> proxmox-auth-api breaks (building) PBS and PDM, and PBS requires bumped
> proxmox-auth-api for this series to work.
> PBS and PVE require new termproxy
> pve-manager requires new pve-access-control (via termproxy)
> PBS requires new pbs-api-types
> PDM requires new pbs-api-types, pve-api-types, proxmox-yew-comp and pve-xtermjs
> 
> suggested build-order:
> - pve-xtermjs / proxmox-termproxy
> - pve-access-control
> - pve-manager
> - pve-api-types
> - pbs-api-types
> - proxmox-auth-api
> - PBS
> - proxmox-yew-comp
> - PDM
> 
> the remote shell only works if remotes have new enough PVE/PBS packages.
> 
> pve-xtermjs:
> 
> Fabian Grünbichler (2):
>   xtermjs: add support for remote node shells via PDM
>   termproxy: allow using new vncticket endpoint
> 
>  termproxy/src/cli.rs  |  5 +++++
>  termproxy/src/main.rs | 31 ++++++++++++++++++++++---------
>  xterm.js/src/main.js  | 13 +++++++++++--
>  3 files changed, 38 insertions(+), 11 deletions(-)
> 
> 
> pve-access-control:
> 
> Fabian Grünbichler (1):
>   api: ticket: allow token-owned VNC ticket verification
> 
>  src/PVE/API2/AccessControl.pm | 60 +++++++++++++++++++++++++++++++++++
>  1 file changed, 60 insertions(+)
> 
> 
> pve-manager:
> 
> Fabian Grünbichler (3):
>   api: termproxy/vncwebsocket: allow tokens
>   api: termproxy: add description to return schema
>   http server: allow unauthenticated access to /access/vncticket
> 
>  PVE/API2/Nodes.pm | 17 ++++++++++-------
>  PVE/HTTPServer.pm |  1 +
>  2 files changed, 11 insertions(+), 7 deletions(-)
> 
> 
> proxmox:
> 
> Fabian Grünbichler (3):
>   pbs-api-types: add NodeShellTicket
>   auth-api: use Authid for path ticket validation
>   auth-api: add vncticket verification endpoint and type
> 
>  pbs-api-types/src/node.rs          | 36 +++++++++++++++++++++++++++++-
>  proxmox-auth-api/src/api/access.rs | 34 ++++++++++++++++++++++++++--
>  proxmox-auth-api/src/api/mod.rs    |  8 +++----
>  proxmox-auth-api/src/types.rs      | 22 ++++++++++++++++++
>  4 files changed, 93 insertions(+), 7 deletions(-)
> 
> 
> proxmox-backup:
> 
> Fabian Grünbichler (4):
>   tree-wide: user Userid::root_user() instead of hard-coded root at pam
>   api: access: add vncticket verification endpoint
>   api: node shell: allow access for tokens
>   api: termproxy: use NodeShellTicket type from pbs-api-types
> 
>  pbs-config/src/acl.rs              |  2 +-
>  pbs-config/src/cached_user_info.rs |  4 +-
>  pbs-config/src/user.rs             |  5 ++-
>  src/api2/access/mod.rs             |  6 ++-
>  src/api2/node/mod.rs               | 66 +++++++++---------------------
>  src/auth.rs                        |  5 +--
>  src/tools/ticket.rs                |  6 +--
>  7 files changed, 36 insertions(+), 58 deletions(-)
> 
> 
> proxmox-yew-comp:
> 
> Fabian Grünbichler (3):
>   xtermjs: add remote PVE support
>   xtermjs: merge ConsoleType to parameters conversion
>   xtermjs: add remote PBS console type
> 
>  src/xtermjs.rs | 41 ++++++++++++++++++++++++++---------------
>  1 file changed, 26 insertions(+), 15 deletions(-)
> 
> 
> proxmox-datacenter-manager:
> 
> Fabian Grünbichler (9):
>   auth: allow tokens in term tickets
>   connection: add access to "raw" client
>   pbs client: add termproxy wrapper
>   api: add remote_shell module with termproxy endpoint
>   api: remote shell: add websocket endpoint
>   api: pve: wire up remote shell support
>   ui: pve: node: add shell tab
>   api: pbs: wire up node shell endpoints
>   ui: add PBS remote shell button
> 
>  Cargo.toml                                    |   2 +-
>  debian/control                                |  12 +-
>  server/src/api/mod.rs                         |   1 +
>  server/src/api/pbs/node.rs                    |  12 +-
>  server/src/api/pve/node.rs                    |   8 +
>  server/src/api/remote_shell.rs                | 261 ++++++++++++++++++
>  server/src/auth/mod.rs                        |   5 +-
>  server/src/connection.rs                      |  11 +
>  .../src/metric_collection/collection_task.rs  |   5 +
>  server/src/pbs_client.rs                      |   6 +
>  server/src/test_support/fake_remote.rs        |   5 +
>  ui/src/pbs/mod.rs                             |  18 +-
>  ui/src/pve/node/mod.rs                        |  18 +-
>  13 files changed, 351 insertions(+), 13 deletions(-)
>  create mode 100644 server/src/api/remote_shell.rs
> 
> 
> Summary over all repositories:
>   31 files changed, 615 insertions(+), 111 deletions(-)
>