No RBAC/user auth realms, cloud-init, VM templates, console access, PCI passthrough (tracked in MISSING_FEATURES.md) #6

Open
opened 2026-09-30 16:12:25 -07:00 by CanuteTheGreat · 1 comment

Per the repo's own MISSING_FEATURES.md, several Proxmox-parity features remain unimplemented:

  • User management & RBAC (no auth realms beyond basic, no fine-grained permissions, no API tokens, no 2FA)
  • Cloud-init integration (no ISO generation/attachment, no user-data/network-config)
  • VM templates & linked clones
  • Console access (no noVNC/SPICE/serial console)
  • PCI/GPU passthrough

These are Priority 1-2 items in the existing doc. Filing as a tracked umbrella issue so it isn't lost - please break into separate issues/PRs as work starts on each, rather than one big PR.

Found during a real gap-analysis review, 2026-09-30 (re-confirmed against current code, not just the doc).

Per the repo's own `MISSING_FEATURES.md`, several Proxmox-parity features remain unimplemented: - User management & RBAC (no auth realms beyond basic, no fine-grained permissions, no API tokens, no 2FA) - Cloud-init integration (no ISO generation/attachment, no user-data/network-config) - VM templates & linked clones - Console access (no noVNC/SPICE/serial console) - PCI/GPU passthrough These are Priority 1-2 items in the existing doc. Filing as a tracked umbrella issue so it isn't lost - please break into separate issues/PRs as work starts on each, rather than one big PR. Found during a real gap-analysis review, 2026-09-30 (re-confirmed against current code, not just the doc).
Author
Owner

Correction on the "Console access" bullet: this was wrong even before this pass, and is now fully wrong.

VNC/SPICE/noVNC console access was already fully implemented and wired (horcrux-api/src/console/{vnc,spice,novnc}.rs, routed in main.rs at /api/console/:vm_id/{vnc,novnc}, /api/console/:vm_id/websocket, /api/console/ws/:ticket_id) - see ROADMAP.md's "Console Verification COMPLETE" section, dated 2025-10-12, predating this issue.

The real gap was narrower than the issue implied: the serial console backend (horcrux-api/src/console/serial.rs) existed and was unit-tested, but had no HTTP route, no WebSocket bridge wiring, and no CLI subcommand, despite USER_MANUAL.md documenting horcrux-cli console vm-100 --serial as if it worked. That gap is now closed:

  • POST /api/console/:vm_id/serial (ticket issuance, mirrors the VNC route)
  • GET /api/console/ws/serial/:ticket_id (WebSocket<->Unix-socket bridge, console/serial_ws.rs)
  • horcrux-cli console <vm_id> [--serial]
  • Real, passing integration test: horcrux-api/tests/serial_console_integration_test.rs (enable -> connect -> write/read -> proxy bridge, against a stub QEMU process)

MISSING_FEATURES.md and ROADMAP.md have been updated to reflect this. Leaving this umbrella issue open since RBAC/auth realms, cloud-init, VM templates, and PCI/GPU passthrough are still real gaps - only striking "Console access" off the list.

Correction on the "Console access" bullet: this was wrong even before this pass, and is now fully wrong. VNC/SPICE/noVNC console access was already fully implemented and wired (`horcrux-api/src/console/{vnc,spice,novnc}.rs`, routed in `main.rs` at `/api/console/:vm_id/{vnc,novnc}`, `/api/console/:vm_id/websocket`, `/api/console/ws/:ticket_id`) - see ROADMAP.md's "Console Verification COMPLETE" section, dated 2025-10-12, predating this issue. The real gap was narrower than the issue implied: the serial console *backend* (`horcrux-api/src/console/serial.rs`) existed and was unit-tested, but had no HTTP route, no WebSocket bridge wiring, and no CLI subcommand, despite `USER_MANUAL.md` documenting `horcrux-cli console vm-100 --serial` as if it worked. That gap is now closed: - `POST /api/console/:vm_id/serial` (ticket issuance, mirrors the VNC route) - `GET /api/console/ws/serial/:ticket_id` (WebSocket<->Unix-socket bridge, `console/serial_ws.rs`) - `horcrux-cli console <vm_id> [--serial]` - Real, passing integration test: `horcrux-api/tests/serial_console_integration_test.rs` (enable -> connect -> write/read -> proxy bridge, against a stub QEMU process) `MISSING_FEATURES.md` and `ROADMAP.md` have been updated to reflect this. Leaving this umbrella issue open since RBAC/auth realms, cloud-init, VM templates, and PCI/GPU passthrough are still real gaps - only striking "Console access" off the list.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
CanuteTheGreat/horcrux#6
No description provided.