Re: [PATCH manager 2/3] fix #7803: api: nodes: resolve 'localhost' alias in node-specific endpoints

["Shannon Sterz" <s.sterz@proxmox.com>]

On Tue Jul 14, 2026 at 4:50 PM CEST, Elias Huhsovitz wrote:
> When 'localhost' is used as the node parameter, the API proxy correctly
> routes the request to the local node. However, several endpoint handlers
> used the literal string 'localhost' to construct file paths or validate
> cluster nodes, resulting in empty data or validation errors.
>
> Use the new PVE::INotify::resolve_nodename() helper to correctly resolve
> the alias before accessing the cluster filesystem or checking node
> existence. This fixes the following endpoints:
> - NodeConfig (get_config, set_options)
> - Certificates (info, upload_custom_cert, remove_custom_cert)
> - Nodes (rrd, rrddata, migrateall)
>
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>  PVE/API2/Certificates.pm |  8 +++++---
>  PVE/API2/NodeConfig.pm   |  6 ++++--
>  PVE/API2/Nodes.pm        | 13 ++++++-------
>  3 files changed, 15 insertions(+), 12 deletions(-)
>
> diff --git a/PVE/API2/Certificates.pm b/PVE/API2/Certificates.pm
> index de8762c5..d567939c 100644
> --- a/PVE/API2/Certificates.pm
> +++ b/PVE/API2/Certificates.pm
> @@ -7,6 +7,7 @@ use PVE::API2::ACME;
>  use PVE::Certificate;
>  use PVE::CertHelpers;
>  use PVE::Exception qw(raise_param_exc);
> +use PVE::INotify;
>  use PVE::JSONSchema qw(get_standard_option);
>  use PVE::Tools qw(extract_param file_get_contents file_set_contents);
>
> @@ -66,7 +67,8 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>
> -        my $node_path = "/etc/pve/nodes/$param->{node}";
> +        my $node = PVE::INotify::resolve_nodename($param->{node});
> +        my $node_path = "/etc/pve/nodes/$node";

this hunk overlaps with my commit in the tls rotation series [1]. since
your series tackles this problem in a more complete fashion, the commit
in my series can simply be dropped if your patches make it in first.

just thought i'd mention it here :)

[1]: https://lore.proxmox.com/pdm-devel/20260611120327.257523-4-s.sterz@proxmox.com/

>
>          my $res = [];
>          my $cert_paths = [
> @@ -125,7 +127,7 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>
> -        my $node = extract_param($param, 'node');
> +        my $node = PVE::INotify::resolve_nodename(extract_param($param, 'node'));
>          my $cert_prefix = PVE::CertHelpers::cert_path_prefix($node);
>
>          my $certs = extract_param($param, 'certificates');
> @@ -188,7 +190,7 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>
> -        my $node = extract_param($param, 'node');
> +        my $node = PVE::INotify::resolve_nodename(extract_param($param, 'node'));
>          my $cert_prefix = PVE::CertHelpers::cert_path_prefix($node);
>
>          my $code = sub {
> diff --git a/PVE/API2/NodeConfig.pm b/PVE/API2/NodeConfig.pm
> index cc726dac..cad81c3e 100644
> --- a/PVE/API2/NodeConfig.pm
> +++ b/PVE/API2/NodeConfig.pm
> @@ -3,6 +3,7 @@ package PVE::API2::NodeConfig;
>  use strict;
>  use warnings;
>
> +use PVE::INotify;
>  use PVE::JSONSchema qw(get_standard_option);
>  use PVE::NodeConfig;
>  use PVE::Tools qw(extract_param);
> @@ -61,7 +62,8 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>
> -        my $config = PVE::NodeConfig::load_config($param->{node});
> +        my $node = PVE::INotify::resolve_nodename($param->{node});
> +        my $config = PVE::NodeConfig::load_config($node);
>
>          if (defined(my $prop = $param->{property})) {
>              return {} if !exists $config->{$prop};
> @@ -91,7 +93,7 @@ __PACKAGE__->register_method({
>          my ($param) = @_;
>
>          my $delete = extract_param($param, 'delete');
> -        my $node = extract_param($param, 'node');
> +        my $node = PVE::INotify::resolve_nodename(extract_param($param, 'node'));
>          my $digest = extract_param($param, 'digest');
>
>          my $code = sub {
> diff --git a/PVE/API2/Nodes.pm b/PVE/API2/Nodes.pm
> index dfe3b4cf..90ce3c10 100644
> --- a/PVE/API2/Nodes.pm
> +++ b/PVE/API2/Nodes.pm
> @@ -830,9 +830,9 @@ __PACKAGE__->register_method({
>      },
>      code => sub {
>          my ($param) = @_;
> -
> +        my $node = PVE::INotify::resolve_nodename($param->{node});
>          return PVE::RRD::create_rrd_graph(
> -            "pve-node-9.0/$param->{node}", $param->{timeframe}, $param->{ds}, $param->{cf},
> +            "pve-node-9.0/$node", $param->{timeframe}, $param->{ds}, $param->{cf},
>          );
>
>      },
> @@ -873,9 +873,9 @@ __PACKAGE__->register_method({
>      },
>      code => sub {
>          my ($param) = @_;
> -
> +        my $node = PVE::INotify::resolve_nodename($param->{node});
>          return PVE::RRD::create_rrd_data(
> -            "pve-node-9.0/$param->{node}", $param->{timeframe}, $param->{cf},
> +            "pve-node-9.0/$node", $param->{timeframe}, $param->{cf},
>          );
>      },
>  });
> @@ -2718,10 +2718,9 @@ __PACKAGE__->register_method({
>              }
>          }
>
> -        my $nodename = $param->{node};
> -        $nodename = PVE::INotify::nodename() if $nodename eq 'localhost';
> +        my $nodename = PVE::INotify::resolve_nodename($param->{node});
>
> -        my $target = $param->{target};
> +        my $target = PVE::INotify::resolve_nodename($param->{target});
>          my $with_local_disks = $param->{'with-local-disks'};
>          raise_param_exc({ target => "target is local node." }) if $target eq $nodename;
>