Back to blog
News

ProxCenter v1.4.13 Release

It introduces built-in HTTPS, an AI assistant that proposes actions you approve, an Availability & SLA page with an incident register, a capacity cockpit with a year of forecast and configuration backup and restore.

November 1, 2026·6 min read
ProxCenter v1.4.13 Release

ProxCenter v1.4.13 is a feature release focused on security, visibility and day-to-day operations. It introduces built-in HTTPS, an AI assistant that proposes actions you approve, an Availability & SLA page with an incident register, a capacity cockpit with a year of forecast, configuration backup and restore, and warm VMware migration on OpenVDDK.

🔒 Built-in HTTPS

ProxCenter now serves itself over HTTPS, with no reverse proxy required. Certificates are managed from Settings:

  • a self-signed certificate generated for the server address at first boot
  • an uploaded certificate and its chain
  • an ACME certificate (Let's Encrypt or any ACME directory), renewed automatically

A fresh install on a host where ports 80 and 443 are free starts directly in HTTPS on the standard ports. An existing install keeps its ports, and HTTPS stays off until it is enabled in Settings.

🤖 AI assistant

A floating assistant answers questions about your infrastructure with charts, through 25 scoped read-only tools that only see what the signed-in user is allowed to see.

It can now propose actions: action cards, guided plans and clickable choices. Nothing runs until you approve it. The assistant is an Enterprise capability.

📈 Availability & SLA

A new Availability & SLA page measures the uptime of your nodes and clusters:

  • Status-page timelines per node and per cluster, with uptime and coverage rates
  • SLA policies on guests, tags or pools, evaluated against a target
  • Maintenance windows excluded from the budget
  • SLA budget notifications, a new category your notification channels can subscribe to
  • An incident register and an SLA report

Nothing is measured until an administrator picks the connections to measure in the page settings.

📊 Capacity cockpit

The Resources page becomes a capacity cockpit: infrastructure health, what needs a decision first, and a forecast drawn from up to a year of history, with the time left before CPU, memory or storage reaches 90%.

⚙️ Configuration and audit

Backup and restore

The whole ProxCenter configuration can be backed up and restored from the settings page, which now uses a grouped side navigation.

Every action is audited

Every action that goes through ProxCenter is written to the audit log, the orchestrator's own actions included.

A readable change journal

  • Readable diffs, an activity timeline, day headers and bursts, with created and deleted guests
  • Who made each change, verified, inferred or unknown
  • Firewall, access, storage and node network changes and failed logins are tracked

The Events page also gains a task archive, and the taskbar a search. The task history of a node that is down is read from the copy ProxCenter keeps.

🚚 Migration

Warm migration on OpenVDDK

Warm VMware migration now runs on OpenVDDK, an open-source replacement for Broadcom's VDDK library that "Prepare this node" installs by itself. Copies also survive short network outages.

Checked before it starts

  • The vCenter is probed from the Proxmox node before a warm migration, and an unreadable certificate is explained
  • Every target node's warm runtime is checked before a bulk warm migration starts

Windows, Hyper-V and Nutanix

  • Windows Server 2025 converts on PVE 9 nodes through ProxCenter's virt-v2v build, with its data disks online at first boot
  • Conversions virt-v2v cannot do are explained, and the guest stays on hardware it has drivers for
  • Hyper-V migrates only the disks attached to the VM, and Hyper-V and Nutanix keep every network card and MAC address
  • The migration log follows its newest lines like a terminal

🖥️ DRS, nodes and HA

  • The drain planner migrates a hand-picked selection of guests spread over a cluster
  • The DRS page is easier to read, its reasons are translated, and evacuation and affinity recommendations are no longer auto-rejected
  • Node maintenance keeps Ceph OSDs in, shows every OSD flag, manages Ceph daemons and alerts on a noout flag left set
  • HA is offered on deploy and clone, works on container clones, and Windows templates deploy with their firmware and disk bus

🔐 Security and access

  • Local passwords are hashed with argon2id, rehashed at the next sign-in with no reset needed
  • Every published image carries a build provenance attestation, and the frontend image a CycloneDX SBOM
  • Tenant and RBAC scope are checked on the resource for infrastructure, migration and backup routes
  • A disabled tenant is cut off, and sign-out ends the session
  • A user can hold several RBAC roles in the same tenant
  • An OIDC identity cannot be bound to a protected or already bound local account, and SSO calls can go through an outbound HTTP proxy
  • PVE User Tag Access is enforced for ProxCenter users

⚡ Performance and Proxmox load

  • Protected Proxmox calls are capped per node, and guest snapshots are no longer re-read every minute
  • One inventory poll cycle at a time and one fan-out per tenant and vDC, with a sizing matrix for large estates
  • IP and snapshot details load for the displayed page only, and My vDC charts read in one batch, paused on a hidden tab
  • The firewall log is read from the end of the file, without stacking scans on a node

✨ Also in this release

Area What's new
🧙 VM creation Multiqueue, bridge MTU, machine version, CPU flags and sliders in the wizard
🏢 vDC Tenants create blank VMs and install them from their own ISO
📤 Export Guest OS, firmware, machine type, QEMU agent, creation and last boot in the inventory export
🔁 Replication Mounted ISOs flagged before replicating; a replica's CD drive left empty when its ISO is not on the DR node
💾 Backups PBS requests bounded by a timeout; Backup Explorer downloads .blob files
📋 Dashboards An import replaces an existing dashboard of the same name
📦 Dependencies Go 1.27 on Alpine 3.24, AI SDK v5, dompurify 3.4.17, noVNC 1.7.0 bundle rebuilt, GitHub actions pinned by SHA

⬆️ Upgrading

Twelve database migrations are included. They run automatically at first boot.

docker compose pull && docker compose up -d

Built-in HTTPS needs the new compose file: re-running the installer fetches it and pins the HTTPS port for you.

A few points deserve attention:

  • Passwords are rehashed at the next sign-in, after which an older version can no longer verify them. On an HA cluster, upgrade the three nodes back to back.
  • HA clusters converted before 1.4.13 keep their compose file: for HTTPS or an SSO proxy, add APP_URL, TLS_PORT, TLS_ENABLED, HTTP_PROXY, HTTPS_PROXY and NO_PROXY to the compose file on each node.
  • A node prepared with Broadcom's VDDK must be prepared once more to get OpenVDDK.
  • Audit entries past the retention are now deleted when Automatic cleanup is on in the compliance settings.

Air-gapped sites upgrade from the bundle: the proxcenter-community-1.4.13.tar.gz asset for Community, or the Air-gapped tab of your proxcenter.io account for Enterprise, as described in the air-gapped installation guide.

Full instructions are available in the ProxCenter update guide.

Thank you to everyone who contributed feedback, testing and issue reports for this release.