This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+3 more
Summary
AI summaryUpdates 🛠️ What's included, ✨ Highlights, and qemu/lxc across a mixed release.
Full changelog
🚀 Beacon Release — Proxmox Overseer
Run Beacon on a Proxmox VE host and it becomes an overseer: it monitors the host and sees every VM and container the host runs — including the up/down state a crashed guest can't report for itself — through the host's own pvesh. One vantage point that survives a guest falling over. Also adds host-mode agent management (beacon service, beacon logs) and a single-instance guard.
✨ Highlights
🖥️ Proxmox overseer — see the whole host
Install Beacon on a Proxmox VE host and it reports the host and its full guest inventory to BeaconInfra. In the dashboard the host shows up with a Host badge and its guests nested underneath — live status for every VM/CT, on the Devices list and on the device detail Operate tab.
How it works:
- On its heartbeat, the host agent queries the host's own
pveshand reportsrole: hostplus the current VM/container inventory. - BeaconInfra promotes the device to a host and stores the guest inventory — a deliberate dashboard link is never overridden by a heartbeat.
- The dashboard renders the host card with its guests: name, type (qemu/lxc), and live running/stopped status, refreshed roughly once a minute.
beacon proxmox listproves the agent can readpvesh; the host appears in the dashboard once a heartbeat has carried the overseer inventory.
🎛️ Power controls for guests
Start / Reboot / Shutdown any guest straight from the dashboard. The action is queued to the host, which runs it on its next heartbeat — with an audit trail (received → executed) so you can see what happened.
📟 One-line Proxmox installer
On the Proxmox host, as root:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Bajusz15/beacon/main/scripts/proxmox-install.sh)"
Interactive whiptail setup (Default / Advanced), or fully unattended:
BEACON_API_KEY=bci_live_… BEACON_DEVICE_NAME="rack-pve-1" \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Bajusz15/beacon/main/scripts/proxmox-install.sh)"
It verifies it's a PVE host, downloads the latest binary, registers the host, installs the beacon-master systemd service, and verifies overseer access.
🧰 Host-mode agent: beacon service & beacon logs
beacon service install / status— run Beacon as a supervised systemd service (beacon-master), as root on a host or per-user elsewhere. Plumbing subcommands are hidden behind it.beacon logs [-f]— tail the agent's logs (journal or logfile) without hunting for the unit.
🛡️ Single-instance guard
A second beacon start against the same BEACON_HOME is refused with a clear "already running (pid …)" message instead of launching a duplicate master. The lock self-releases when the process exits.
🛠️ What's included
- Overseer CLI:
beacon proxmox list/beacon proxmox status(+beacon overseer …alias) — VMID, name, type, status, and an "N/M guests running" summary;--jsonoutput - Host agent reports
role: host+ guest inventory on the heartbeat; a deliberate dashboard link is never overridden by a heartbeat - Guest inventory in the dashboard on both the Devices list host card and the device detail Operate tab, with live status and Start / Reboot / Shutdown controls
- Guest power actions queued to the host and applied on the next heartbeat, with a
received→executedaudit trail - Single-instance guard (flock on
BEACON_HOME), self-releasing on exit beacon service(systemdbeacon-master) andbeacon logs- Accepts current
bci_live_…API keys;beacon restartfixed for host installs scripts/proxmox-install.sh: whiptail Default/Advanced flow, masked API-key prompt, spinners, and plain-prompt / env-var fallbacks for non-interactive use- Built with Go 1.26.5 (picks up the
crypto/tlsstandard-library security fix)
Full Changelog: https://github.com/Bajusz15/beacon/compare/v0.6.8-remote-access-pass...v0.7.0-proxmox-overseer
What's Changed
- ⭐ Passkey (WebAuthn) remote-access unlock — agent side + OOB + e2e by @Bajusz15 in https://github.com/Bajusz15/beacon/pull/160
- fix CI by @Bajusz15 in https://github.com/Bajusz15/beacon/pull/161
- feature: Proxmox overseer role + single-instance guard by @Bajusz15 in https://github.com/Bajusz15/beacon/pull/162
Full Changelog: https://github.com/Bajusz15/beacon/compare/v0.6.8-remote-access-pass...v0.7.1-proxmox-overseer
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Beacon
All releases →Related context
Related tools
Earlier breaking changes
- v0.6.8-remote-access-pass Renames command `beacon master` to `beacon start`; alias retained for compatibility.
- v0.6.6-remote-tty-ha-os-tunnel Renames command `beacon master` to `beacon start`; alias retained for compatibility.
Beta — feedback welcome: [email protected]