# netbox-proxbox v0.0.23.post2

v0.0.23.post2

| Field |Value |
| --- | --- |
| Canonical URL | https://emersonfelipesp.com/netbox-proxbox/releases/v0.0.23.post2 |
| GitHub URL | https://github.com/emersonfelipesp/netbox-proxbox/releases/tag/v0.0.23.post2 |
| Tag | v0.0.23.post2 |
| State | latest |
| Author | emersonfelipesp |
| Created | 2026-07-27 17:48 UTC |
| Published | 2026-07-27 17:49 UTC |
| Target | develop |
| Synced | 2026-07-27 19:24 UTC |
| Assets | 0 |

## Release notes

# Version 0.0.23.post2

netbox-proxbox `0.0.23.post2` adds bounded endpoint auto-configuration and
credential establishment for the Proxbox backend. It retains the existing
backend and SDK pairing and supports NetBox `4.5.8` through `4.6.99`
(validated against `4.5.8` through `4.5.10` and `4.6.0` through `4.6.5`).

Current pairing: netbox-proxbox 0.0.23.post2 <-> proxbox-api (guest-VM-interface writer build / next release) <-> proxmox-sdk 0.0.12 <-> netbox-sdk 0.0.10.

## Compatibility

| NetBox | netbox-proxbox | proxbox-api | netbox-sdk | proxmox-sdk |
|--------|----------------|-------------|------------|-------------|
| >=4.5.8 | v0.0.23.post2 | guest-VM-interface writer build / next release | v0.0.10 | v0.0.12 |

Migration `0075_fastapi_backend_key_target_fingerprint` adds the durable,
credential-free target binding for existing and new backend rows. Run the
normal NetBox migration step during upgrade. No companion-backend upgrade is
required.

## Endpoint auto-configuration

- Operators may create or enable a Proxbox backend without pasting an API key.
  After the row commits, the plugin probes only the exact URL or IP, port, and
  TLS policy saved in that row. A healthy empty backend can complete its
  one-time key bootstrap automatically; an initialized backend without a
  locally held key remains pending and requires explicit recovery.
- When no backend row exists, startup discovery is limited to plugin-configured
  targets and same-site names derived from NetBox's trusted public origin. It
  does not scan the network, accept arbitrary user-supplied discovery targets,
  or follow redirects.
- NetBox endpoint configuration can be derived from the trusted local public
  origin, and the corresponding token is established through the already
  authenticated backend boundary rather than exposed in the UI.

## Security behavior

- The persisted endpoint is the complete discovery allowlist. Any IP or domain
  that is not the configured target or an explicitly derived same-site target
  is rejected before credentials are sent.
- Backend ciphertext is bound to a credential-free fingerprint covering the
  canonical HTTP target, fallback IP, TLS flags, and WebSocket target. Target
  drift fails closed until the operator explicitly re-establishes trust.
- Disabled endpoints never perform discovery or network access. HTTP and
  WebSocket authentication reject redirects, and ambient proxy settings are
  disabled for the credential-bearing WebSocket client.

## Operations

On startup, a successfully configured installation logs backend key
verification and the NetBox endpoint push. A configuration that cannot be
proved safe logs a `pending` result and continues serving NetBox without
attempting an untrusted connection.

## Assets

No binary assets attached.

Source archives:

| Format |URL |
| --- | --- |
| zip | https://api.github.com/repos/emersonfelipesp/netbox-proxbox/zipball/v0.0.23.post2 |
| tar.gz | https://api.github.com/repos/emersonfelipesp/netbox-proxbox/tarball/v0.0.23.post2 |