public_git/freenas-proxmox
1
0
Fork 0
mirror of https://github.com/TheGrandWazoo/freenas-proxmox.git synced 2026-10-21 03:07:14 +02:00
Code Issues Projects Releases Wiki Activity

feat: read API token from /etc/pve/priv/truenas-<storeid>.key (#261)

Browse Source 
The API token was previously stored only in storage.cfg, which is
replicated in plaintext across all cluster nodes via pmxcfs. This adds
a keyfile mechanism: at startup each public entry point calls
_resolve_token(), which checks /etc/pve/priv/truenas-<storeid>.key
before falling back to truenas_api_key in storage.cfg. The resolved
token is cached in the per-host $state so the file is read at most once
per daemon session. truenas_api_key is now optional in storage.cfg;
either the keyfile or the config key must be present.

Docs updated in getting-started.md (section 4.1) and the in-app help
HTML with setup commands and the cluster-copy reminder.

Closes #261

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Kevin Adams
2026-05-25 22:36:21 -04:00
co-authored by Claude Sonnet 4.6
parent 2e0b5acb9a
commit f30862f3c0
3 changed files with 85 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started.md
+23
View File
@@ -140,6 +140,29 @@ Fill in the form using the table below. Fields not listed can be left at their d
Click **Add**. Proxmox contacts TrueNAS and confirms the pool is reachable. If it fails, check the error message — see [section 6](#6-common-first-run-problems) for common causes.
### 4.1 Securing the API Token (Recommended for Production)
By default the API token is stored in `/etc/pve/storage.cfg`, which is replicated in plaintext across all cluster nodes via the PVE cluster filesystem. For production deployments, move the token into a private keyfile that only root can read and that is not replicated.
Run these commands **on each Proxmox node** after adding the storage:
```bash
# Replace 'truenas-vms' with your actual storage ID
STORAGEID="truenas-vms"
KEYFILE="/etc/pve/priv/truenas-${STORAGEID}.key"
# Write the token to the keyfile (replace the value with your actual token)
echo -n "your-api-token-here" > "$KEYFILE"
chmod 600 "$KEYFILE"
# Remove the token from storage.cfg now that the keyfile is in place
pvesm set "$STORAGEID" --truenas_api_key ""
```
The plugin automatically checks `/etc/pve/priv/truenas-<storeid>.key` at startup. If the file exists, it is used and `truenas_api_key` in storage.cfg is ignored.
> **Note:** The keyfile must exist on **every Proxmox node** in your cluster. The `/etc/pve/priv/` directory is not replicated via pmxcfs — copy the file to each node manually (use `scp` or your configuration management tool).
---
## 5. Creating Your First VM Disk on TrueNAS Storage