jhodgkin/homelab-monitor
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Provision read-only Proxmox API token #2

New Issue
Closed
opened 2026-07-12 20:11:02 -06:00 by jhodgkin · 2 comments
jhodgkin commented 2026-07-12 20:11:02 -06:00
Owner
Copy Link
Copy Source

Create a token scoped to a read-only (PVEAuditor) role on pve via pveum, for the ProxmoxCollector to use. Store in CT122's .env, never commit it.

Create a token scoped to a read-only (PVEAuditor) role on `pve` via `pveum`, for the ProxmoxCollector to use. Store in CT122's `.env`, never commit it.
jhodgkin added this to the v1-dashboard milestone 2026-07-12 20:11:02 -06:00
jhodgkin commented 2026-07-12 20:11:10 -06:00
Author
Owner
Copy Link
Copy Source

Starting: creating a dedicated monitor@pve PVE user with PVEAuditor (read-only) role and an API token, over the existing root SSH trust to pve.

Starting: creating a dedicated `monitor@pve` PVE user with PVEAuditor (read-only) role and an API token, over the existing root SSH trust to pve.
jhodgkin commented 2026-07-12 20:11:46 -06:00
Author
Owner
Copy Link
Copy Source

Done. Created dedicated monitor@pve PVE user + monitor@pve!dashboard API token, scoped only to the built-in PVEAuditor role (read-only: *.Audit perms) via ACL on /. Verified: GET /nodes and GET /nodes/pve/lxc both return full stats for the host and all 22 LXCs — including PSI pressure metrics (pressurecpusome, pressurememoryfull, etc.) natively, which covers the 'pressure' requirement without extra collector work. Token secret stored in CT122's .env only, never committed.

Done. Created dedicated `monitor@pve` PVE user + `monitor@pve!dashboard` API token, scoped only to the built-in `PVEAuditor` role (read-only: `*.Audit` perms) via ACL on `/`. Verified: `GET /nodes` and `GET /nodes/pve/lxc` both return full stats for the host and all 22 LXCs — including PSI pressure metrics (`pressurecpusome`, `pressurememoryfull`, etc.) natively, which covers the 'pressure' requirement without extra collector work. Token secret stored in CT122's `.env` only, never committed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone v1-dashboard
Projects
Clear projects
No project
Assignees
Clear assignees
jhodgkin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jhodgkin/homelab-monitor#2
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?