@nightsquawktech/proxmox-mcp-server 0.1.0

package/dist/catalog-pve/enrichment/put_cluster_sdn_vnets_vnet_firewall_options.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "put_cluster_sdn_vnets_vnet_firewall_options",
+  "usageNotes": "Use this to enable or configure firewall enforcement on a specific SDN vnet, including setting the default forward policy (ACCEPT or DROP) and log verbosity for forwarded traffic. The caller must hold SDN.Allocate on the vnet's zone path ('/sdn/zones/<zone>/<vnet>'); changes take effect after the cluster SDN config is applied via 'put_cluster_sdn_reload'. Pass 'digest' from a prior GET to guard against concurrent edits overwriting each other.",
+  "examples": [
+    {
+      "summary": "Enable firewall with DROP forward policy and info-level logging on vnet 'prod01'",
+      "path_params": {
+        "vnet": "prod01"
+      },
+      "params": {
+        "enable": true,
+        "policy_forward": "DROP",
+        "log_level_forward": "info"
+      }
+    }
+  ],
+  "tips": [
+    "Firewall changes on a vnet are not live until SDN is reloaded cluster-wide; call put_cluster_sdn_reload after this.",
+    "The default 'enable' value is 0 (disabled); traffic is not filtered until explicitly enabled.",
+    "Use the 'delete' param to reset specific options (e.g., 'log_level_forward') back to defaults rather than sending an empty string.",
+    "Retrieve the current digest with get_cluster_sdn_vnets_vnet_firewall_options before writing to prevent race conditions in automated workflows."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_vnets_vnet_firewall_options",
+    "put_cluster_sdn_reload",
+    "get_cluster_sdn_vnets_vnet_firewall_rules",
+    "post_cluster_sdn_vnets_vnet_firewall_rules"
+  ]
+}

package/dist/catalog-pve/enrichment/put_cluster_sdn_vnets_vnet_firewall_rules_pos.json

@@ -0,0 +1,35 @@
+{
+  "operationId": "put_cluster_sdn_vnets_vnet_firewall_rules_pos",
+  "usageNotes": "Use this to modify an existing SDN vnet firewall rule in-place — change its action, source/destination, ports, enable state, or reorder it via `moveto`. Requires `SDN.Allocate` on the target vnet's zone path (`/sdn/zones/<zone>/<vnet>`); SDN firewall must be enabled on the vnet. Use the `digest` parameter when making programmatic updates to guard against concurrent modifications overwriting each other.",
+  "examples": [
+    {
+      "summary": "Tighten an existing ACCEPT rule to only allow TCP/443 from a trusted subnet",
+      "path_params": {
+        "vnet": "vnet01",
+        "pos": 2
+      },
+      "params": {
+        "type": "in",
+        "action": "ACCEPT",
+        "proto": "tcp",
+        "source": "10.10.0.0/24",
+        "dport": "443",
+        "comment": "Allow HTTPS from management subnet only",
+        "enable": 1
+      }
+    }
+  ],
+  "tips": [
+    "Pass `moveto` alone to reorder a rule without changing any other fields — all other body params are ignored when `moveto` is present.",
+    "Use the `delete` param (comma-separated field names, pve-configid-list format) to unset optional fields like `dest` or `sport` rather than overwriting them with empty strings.",
+    "Rule positions are zero-indexed; fetch the current list first with the GET sibling to confirm the target `pos` before modifying.",
+    "Changes take effect immediately after the API call — no reload step is required for SDN vnet firewall rules.",
+    "Do not mix IPv4 and IPv6 addresses in the same `source` or `dest` field."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_vnets_vnet_firewall_rules",
+    "get_cluster_sdn_vnets_vnet_firewall_rules_pos",
+    "post_cluster_sdn_vnets_vnet_firewall_rules",
+    "delete_cluster_sdn_vnets_vnet_firewall_rules_pos"
+  ]
+}

package/dist/catalog-pve/enrichment/put_cluster_sdn_vnets_vnet_ips.json

@@ -0,0 +1,31 @@
+{
+  "operationId": "put_cluster_sdn_vnets_vnet_ips",
+  "usageNotes": "Use this to create or update a static IP-to-MAC or IP-to-VMID mapping within a VNet's IPAM table — required when a VM needs a predictable address in an SDN zone that uses IPAM (e.g. PVE IPAM or Netbox). The caller must hold SDN.Allocate on the specific zone/vnet path; supply either mac or vmid (or both) to anchor the mapping to a specific guest. Changes take effect immediately without a cluster-wide SDN apply, but the VNet and zone must already exist.",
+  "examples": [
+    {
+      "summary": "Pin 10.10.20.50 to a VM's MAC address inside vnet 'vl20' in zone 'sdnz01'",
+      "path_params": {
+        "vnet": "vl20"
+      },
+      "params": {
+        "zone": "sdnz01",
+        "ip": "10.10.20.50",
+        "mac": "BC:24:11:AA:BB:CC",
+        "vmid": 112
+      }
+    }
+  ],
+  "tips": [
+    "Either mac or vmid is sufficient to anchor the mapping, but providing both avoids ambiguity when the same MAC could appear on multiple VMs (e.g. after a clone).",
+    "This endpoint returns null on success — check HTTP 200 as your confirmation; no UPID is issued.",
+    "The vnet identifier is 2–8 alphanumeric characters starting with a letter — the same constraint applies to zone.",
+    "If the IP is already mapped to a different MAC/VMID, this call overwrites the existing entry silently; verify the current mapping first with the corresponding GET if idempotency matters."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_vnets_vnet_ips",
+    "post_cluster_sdn_vnets_vnet_ips",
+    "delete_cluster_sdn_vnets_vnet_ips",
+    "get_cluster_sdn_vnets_vnet",
+    "put_cluster_sdn_apply"
+  ]
+}

package/dist/catalog-pve/enrichment/put_cluster_sdn_vnets_vnet_subnets_subnet.json

@@ -0,0 +1,30 @@
+{
+  "operationId": "put_cluster_sdn_vnets_vnet_subnets_subnet",
+  "usageNotes": "Use this to modify an existing SDN subnet's configuration — such as changing its gateway, DHCP ranges, DNS server, or SNAT setting — without recreating it. Requires 'SDN.Allocate' on the parent zone/vnet path; changes take effect after applying the pending SDN config via the reload endpoint. Use the 'digest' param to guard against concurrent modifications when running automation.",
+  "examples": [
+    {
+      "summary": "Update subnet to add a DHCP DNS server and enable SNAT masquerade",
+      "path_params": {
+        "vnet": "vnet-prod",
+        "subnet": "10.10.20.0-24"
+      },
+      "params": {
+        "gateway": "10.10.20.1",
+        "dhcp-dns-server": "10.10.20.5",
+        "snat": true
+      }
+    }
+  ],
+  "tips": [
+    "Changes are staged — run the SDN apply/reload endpoint after updating to push config to all nodes.",
+    "The 'delete' param accepts a comma-separated list of field names (e.g. 'dnszoneprefix,dhcp-dns-server') to unset optional fields without a full rewrite.",
+    "The gateway is only meaningful for layer3 (routed) zones; it will be assigned as the vnet interface IP on the controlling node.",
+    "SNAT (masquerade) only applies when pve-firewall is active on the node; enabling it without the firewall has no effect."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_vnets_vnet_subnets_subnet",
+    "post_cluster_sdn_vnets_vnet_subnets",
+    "delete_cluster_sdn_vnets_vnet_subnets_subnet",
+    "put_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/put_cluster_sdn_zones_zone.json

@@ -0,0 +1,31 @@
+{
+  "operationId": "put_cluster_sdn_zones_zone",
+  "usageNotes": "Use this to modify an existing SDN zone's configuration — for example changing exitnodes, MTU, peers list, or IPAM settings. The zone must already exist (use post_cluster_sdn_zones to create it). Changes take effect cluster-wide only after applying the pending SDN configuration via put_cluster_sdn (apply); until then the zone runs on its prior config. Pass the `digest` field (read from get_cluster_sdn_zones_zone) to guard against concurrent edits.",
+  "examples": [
+    {
+      "summary": "Update an EVPN zone to add a second exitnode and set MTU to 1450",
+      "path_params": {
+        "zone": "evpnz1"
+      },
+      "params": {
+        "exitnodes": "pve1,pve2",
+        "exitnodes-primary": "pve1",
+        "mtu": 1450
+      }
+    }
+  ],
+  "tips": [
+    "Changes are staged — always call put_cluster_sdn (apply) after this call or your changes will not be active.",
+    "Use the `delete` param (comma-separated config key names) to unset optional fields rather than setting them to empty strings.",
+    "For VXLAN zones, reducing MTU by at least 50 bytes from the physical NIC MTU avoids fragmentation across the tunnel.",
+    "The `digest` field is returned by get_cluster_sdn_zones_zone; supplying it prevents overwriting a concurrent change.",
+    "Requires SDN.Allocate on /sdn/zones/{zone} — not the broader Sys.Modify privilege."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_zones_zone",
+    "post_cluster_sdn_zones",
+    "delete_cluster_sdn_zones_zone",
+    "get_cluster_sdn_zones",
+    "put_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_apt_repositories.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "put_nodes_node_apt_repositories",
+  "usageNotes": "Adds a named standard repository (identified by its handle) to the APT sources configuration on the target node. The target node must be online and reachable. Pass the digest returned by get_nodes_node_apt_repositories to guard against concurrent modifications — Proxmox will reject the write if the configuration has changed since you last read it.",
+  "examples": [
+    {
+      "summary": "Enable the no-subscription Proxmox VE repository on node 'pve1'",
+      "path_params": {
+        "node": "pve1"
+      },
+      "params": {
+        "handle": "pve-no-subscription",
+        "digest": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3"
+      }
+    }
+  ],
+  "tips": [
+    "Valid handle values are predefined by Proxmox and discoverable via the GET /nodes/{node}/apt/repositories response (look for 'standardRepos' entries with an 'handle' field).",
+    "This endpoint returns null on success — check HTTP 200 as your success indicator.",
+    "Adding a repository does not run 'apt-get update' automatically; call post_nodes_node_apt_update afterwards to refresh the package index.",
+    "The digest parameter is optional but strongly recommended in automation to prevent race conditions on shared clusters."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_apt_repositories",
+    "post_nodes_node_apt_repositories",
+    "post_nodes_node_apt_update"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_ceph_pool_name.json

@@ -0,0 +1,33 @@
+{
+  "operationId": "put_nodes_node_ceph_pool_name",
+  "usageNotes": "Use this to change settings on an existing Ceph pool — such as replica counts, PG autoscaling mode, CRUSH rule, or application type — without recreating it. Requires the Sys.Modify privilege at the root path and the pool must already exist on the cluster. The call returns a task UPID string; poll the task to confirm completion before making further changes to the pool.",
+  "examples": [
+    {
+      "summary": "Enable PG autoscaling and set a target size on an RBD pool",
+      "path_params": {
+        "node": "pve1",
+        "name": "vm-storage"
+      },
+      "params": {
+        "application": "rbd",
+        "pg_autoscale_mode": "on",
+        "target_size": "500G",
+        "size": 3,
+        "min_size": 2
+      }
+    }
+  ],
+  "tips": [
+    "Reducing size or min_size below the current replica count can trigger a rebalance — watch cluster health after the change.",
+    "Setting pg_autoscale_mode to 'warn' is a safe intermediate step: the autoscaler calculates recommendations without automatically applying them.",
+    "target_size and target_size_ratio are mutually exclusive hints to the PG autoscaler; setting both can produce unexpected PG counts.",
+    "CRUSH rule changes cause immediate data migration; only change crush_rule during a maintenance window with enough cluster headroom.",
+    "The node path parameter must be any online node in the cluster — it does not have to be the primary MON node."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_ceph_pool_name",
+    "post_nodes_node_ceph_pool",
+    "delete_nodes_node_ceph_pool_name",
+    "get_nodes_node_ceph_pool"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_certificates_acme_certificate.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "put_nodes_node_certificates_acme_certificate",
+  "usageNotes": "Renews the ACME (Let's Encrypt) TLS certificate on the specified node by re-running the ACME challenge against the already-configured CA and domain account. An ACME account and at least one domain must be configured on the node before calling this endpoint. By default Proxmox will refuse renewal if the certificate is more than 30 days from expiry; pass force=true to override that guard.",
+  "examples": [
+    {
+      "summary": "Force-renew the ACME certificate on node pve1 regardless of expiry window",
+      "path_params": {
+        "node": "pve1"
+      },
+      "params": {
+        "force": true
+      }
+    }
+  ],
+  "tips": [
+    "The return value is a task UPID string — poll GET /nodes/{node}/tasks/{upid}/status to track completion.",
+    "Normal (non-forced) renewal is blocked when the certificate still has more than 30 days remaining; use force=true for testing or emergency re-issuance.",
+    "ACME renewal triggers an outbound HTTP/DNS challenge; ensure the node's configured challenge plugin (HTTP or DNS) is reachable before calling this endpoint.",
+    "After a successful renewal the new certificate is live immediately — the Proxmox web UI and API will use it without a service restart."
+  ],
+  "relatedOperations": [
+    "post_nodes_node_certificates_acme_certificate",
+    "delete_nodes_node_certificates_acme_certificate",
+    "get_nodes_node_certificates_acme_account",
+    "get_nodes_node_certificates_info"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_config.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "put_nodes_node_config",
+  "usageNotes": "Use this to update node-level settings such as ACME certificate domains, wake-on-LAN configuration, boot delay for VMs/CTs, or the node's descriptive notes. Requires the Sys.Modify privilege at the root path (/), so a dedicated API token must be granted that role. Changes take effect immediately and the call returns null on success — use the digest parameter when making concurrent updates to prevent race conditions.",
+  "examples": [
+    {
+      "summary": "Set a node description and add a 30-second boot delay before guests start on reboot",
+      "path_params": {
+        "node": "pve1"
+      },
+      "params": {
+        "description": "Primary Proxmox hypervisor — Hetzner AX102, 64 GB RAM, NVMe pool.",
+        "startall-onboot-delay": 30
+      }
+    }
+  ],
+  "tips": [
+    "Send only the fields you want to change; omit all others — unset fields are not cleared.",
+    "To remove an optional setting (e.g. location or wakeonlan), pass its key name in the 'delete' parameter as a comma-separated string rather than sending an empty value.",
+    "The 'acmedomain[n]' parameter is indexed (acmedomain0, acmedomain1, …); each index maps to one SAN entry on the node's ACME-issued certificate.",
+    "ballooning-target is a node-level hint for the memory ballooning driver; tuning it does not restart running VMs.",
+    "Use get_nodes_node_config (GET /nodes/{node}/config) first to retrieve the current digest, then pass it here to guard against concurrent edits."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_config",
+    "post_nodes_node_certificates_acme_certificate",
+    "delete_nodes_node_certificates_acme_certificate",
+    "get_nodes_node_status"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_disks_wipedisk.json

@@ -0,0 +1,30 @@
+{
+  "operationId": "put_nodes_node_disks_wipedisk",
+  "usageNotes": "Use this to zero-wipe a disk or partition on a Proxmox node before repurposing it for a new storage pool, directory, or ZFS dataset — wipe is a prerequisite for most disk initialization operations. The target device must not be in use (not mounted, not part of an active pool) and the node must be online. The operation returns a task UPID string; poll the task status endpoint to confirm completion before proceeding.",
+  "examples": [
+    {
+      "summary": "Wipe /dev/sdb on node pve1 before adding it to a new ZFS pool",
+      "path_params": {
+        "node": "pve1"
+      },
+      "params": {
+        "disk": "/dev/sdb"
+      }
+    }
+  ],
+  "destructiveReason": "All partition table data, filesystem signatures, and contents on the target block device are permanently zeroed and irrecoverable.",
+  "tips": [
+    "Verify the disk is not in use with get_nodes_node_disks_list before wiping — Proxmox will reject the request if the device is busy, but double-checking avoids accidental device selection.",
+    "The returned UPID can be passed to the task status endpoint (get_nodes_node_tasks_upid_status) to confirm the wipe completed successfully before initializing a new storage backend.",
+    "Wiping a partition path (e.g. /dev/sdb3) is allowed by the pattern — useful for clearing a single partition rather than the whole disk.",
+    "After wiping, a node reboot or udevadm trigger may be needed for Proxmox to reflect the cleared device in the disk list."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_disks_list",
+    "post_nodes_node_disks_zfs",
+    "post_nodes_node_disks_directory",
+    "post_nodes_node_disks_lvm",
+    "post_nodes_node_disks_lvmthin",
+    "get_nodes_node_tasks_upid_status"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_dns.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "put_nodes_node_dns",
+  "usageNotes": "Use this to update the DNS resolver configuration on a specific Proxmox node, including the search domain and up to three nameserver IPs. The `search` field is required; omitting any `dns` field leaves that slot cleared in `/etc/resolv.conf`. The caller must hold `Sys.Modify` on `/nodes/{node}`, and the node must be online — there is no async task; the change takes effect immediately.",
+  "examples": [
+    {
+      "summary": "Set search domain and two nameservers on node pve01",
+      "path_params": {
+        "node": "pve01"
+      },
+      "params": {
+        "search": "lab.nightsquawk.tech",
+        "dns1": "192.168.1.1",
+        "dns2": "1.1.1.1"
+      }
+    }
+  ],
+  "tips": [
+    "Omitting dns1/dns2/dns3 clears those slots — always pass all resolvers you want to keep, not just the one you're changing.",
+    "This writes directly to the node's /etc/resolv.conf; in a clustered setup each node must be updated independently.",
+    "Returns null on success — a 2xx with empty body is the expected response, not an error."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_dns",
+    "put_nodes_node_hosts",
+    "get_nodes_node_network"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_firewall_options.json

@@ -0,0 +1,35 @@
+{
+  "operationId": "put_nodes_node_firewall_options",
+  "usageNotes": "Use this to configure the host-level firewall behavior on a specific PVE node — enabling or disabling the firewall, tuning conntrack limits, and adjusting log verbosity. Requires Sys.Modify on /nodes/{node}; settings take effect immediately without a reboot. Pass the digest from get_nodes_node_firewall_options to guard against concurrent modifications, and use the delete param to reset individual settings back to their defaults instead of re-specifying every value.",
+  "examples": [
+    {
+      "summary": "Enable the node firewall with synflood protection and info-level logging for inbound traffic",
+      "path_params": {
+        "node": "pve1"
+      },
+      "params": {
+        "enable": true,
+        "protection_synflood": true,
+        "protection_synflood_rate": 200,
+        "protection_synflood_burst": 1000,
+        "log_level_in": "info",
+        "log_level_out": "nolog",
+        "nosmurfs": true,
+        "tcpflags": true
+      }
+    }
+  ],
+  "tips": [
+    "To disable the firewall without touching other settings, send only enable=false — all other options are preserved.",
+    "nftables is a tech preview; leave it at the default (false) on production nodes.",
+    "nf_conntrack_max default is 262144; increase it on high-traffic nodes running many VMs/containers to avoid 'table full' drops.",
+    "To reset a specific option (e.g. log_level_in) to its default, pass its name in the delete field rather than guessing the default value.",
+    "NDP should remain enabled (default true) on any node using IPv6; disabling it breaks IPv6 neighbor discovery for hosted VMs."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_firewall_options",
+    "get_nodes_node_firewall_rules",
+    "post_nodes_node_firewall_rules",
+    "get_cluster_firewall_options"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_firewall_rules_pos.json

@@ -0,0 +1,31 @@
+{
+  "operationId": "put_nodes_node_firewall_rules_pos",
+  "usageNotes": "Use this endpoint to modify an existing node-level firewall rule at a specific position, or to reorder it using the `moveto` parameter (when `moveto` is supplied, all other field arguments are ignored). The caller must hold `Sys.Modify` on `/nodes/{node}`. Pass the `digest` from a prior GET to guard against concurrent edits overwriting each other.",
+  "examples": [
+    {
+      "summary": "Disable a rule at position 2 and add a comment",
+      "path_params": {
+        "node": "pve01",
+        "pos": 2
+      },
+      "params": {
+        "enable": 0,
+        "comment": "Temporarily disabled for maintenance window",
+        "digest": "a3f1c2e9b4d7..."
+      }
+    }
+  ],
+  "tips": [
+    "Use `moveto` alone to reorder a rule without changing its content — other body fields are silently ignored when `moveto` is present.",
+    "Use the `delete` field (comma-separated config key names) to unset individual rule properties like `dest` or `dport` without rewriting the whole rule.",
+    "The `enable` field is an integer: 1 = enabled, 0 = disabled. Omitting it leaves the current value unchanged.",
+    "Rule positions are zero-indexed; verify the current position with GET /nodes/{node}/firewall/rules before updating.",
+    "Changes take effect immediately in the running firewall — no reload command is needed, but verify with GET after PUT since the call returns null."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_firewall_rules_pos",
+    "get_nodes_node_firewall_rules",
+    "post_nodes_node_firewall_rules",
+    "delete_nodes_node_firewall_rules_pos"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_config.json

@@ -0,0 +1,33 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_config",
+  "usageNotes": "Use this to modify the configuration of an existing LXC container — CPU, memory, network interfaces, mount points, tags, hostname, and more — without recreating it. The call returns null synchronously (no UPID); most settings take effect on the next container start, but some (like description and tags) apply immediately. Requires at least one of VM.Config.Disk, VM.Config.CPU, VM.Config.Memory, VM.Config.Network, or VM.Config.Options on /vms/{vmid}; non-volume bind-mount points are restricted to root@pam.",
+  "examples": [
+    {
+      "summary": "Increase memory to 2 GB and add a tag for a running web container",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110
+      },
+      "params": {
+        "memory": 2048,
+        "swap": 512,
+        "tags": "web;production",
+        "description": "Nginx reverse proxy for client portal"
+      }
+    }
+  ],
+  "tips": [
+    "Pass the 'digest' field (from GET config) to guard against concurrent edits — the API rejects the update if the config has changed since you read it.",
+    "Use the 'delete' param to unset optional fields (e.g., delete='nameserver,searchdomain') rather than sending empty strings.",
+    "Changing 'unprivileged' after container creation is unsupported and can break filesystem permissions — treat it as read-only post-create.",
+    "Network interface changes (net[n]) take effect on the next container start; the running container keeps its current network state.",
+    "The 'revert' param discards a pending (unapplied) config change without requiring a full reconfigure cycle."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_config",
+    "post_nodes_node_lxc_vmid_start",
+    "post_nodes_node_lxc_vmid_stop",
+    "post_nodes_node_lxc_vmid_snapshot",
+    "get_nodes_node_lxc"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_firewall_aliases_name.json

@@ -0,0 +1,31 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_firewall_aliases_name",
+  "usageNotes": "Use this to update the CIDR value, comment, or name of an existing firewall alias on a specific LXC container. Requires VM.Config.Network on the container's vmid path; the alias must already exist (create with the POST variant first). Pass the current configuration digest to guard against concurrent edits overwriting each other.",
+  "examples": [
+    {
+      "summary": "Update an alias CIDR and rename it on an LXC container",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110,
+        "name": "mgmt-net"
+      },
+      "params": {
+        "cidr": "10.10.20.0/24",
+        "rename": "mgmt-net-v2",
+        "comment": "Updated management network after subnet expansion"
+      }
+    }
+  ],
+  "tips": [
+    "The alias name must start with a letter and match [A-Za-z][A-Za-z0-9\\-\\_]+; purely numeric names are rejected.",
+    "Renaming an alias via the 'rename' param updates any firewall rules that reference it by name automatically within the same container scope.",
+    "This endpoint returns null on success — treat any non-error HTTP 200 response as confirmation.",
+    "Fetch the current digest from the GET alias endpoint and include it to prevent a lost-update race condition in automated workflows."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_firewall_aliases_name",
+    "post_nodes_node_lxc_vmid_firewall_aliases",
+    "delete_nodes_node_lxc_vmid_firewall_aliases_name",
+    "get_nodes_node_lxc_vmid_firewall_aliases"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_firewall_ipset_name_cidr.json

@@ -0,0 +1,32 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_firewall_ipset_name_cidr",
+  "usageNotes": "Use this to modify metadata on an existing CIDR entry within a named IPSet on an LXC container's firewall — specifically to update its comment or toggle the 'nomatch' (exclusion) flag. The CIDR itself is immutable by this endpoint; to change the address, delete the old entry and add a new one. Requires VM.Config.Network on the target container.",
+  "examples": [
+    {
+      "summary": "Mark a CIDR entry as an exclusion (nomatch) and add an explanatory comment",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110,
+        "name": "trusted-mgmt",
+        "cidr": "10.10.5.0/24"
+      },
+      "params": {
+        "nomatch": true,
+        "comment": "Exclude legacy subnet from trusted management range"
+      }
+    }
+  ],
+  "tips": [
+    "Pass 'digest' to guard against concurrent edits — read the IPSet entry first (GET the same path) to retrieve the current digest, then include it here.",
+    "Setting 'nomatch: true' turns the CIDR into an explicit exclusion within the IPSet, useful for carving out sub-ranges from a broader allowed block.",
+    "The IPSet must already exist and the CIDR entry must already be present; this endpoint updates in-place and does not create.",
+    "Changes take effect immediately in the firewall rules engine — no container restart required."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_firewall_ipset_name_cidr",
+    "delete_nodes_node_lxc_vmid_firewall_ipset_name_cidr",
+    "post_nodes_node_lxc_vmid_firewall_ipset_name",
+    "get_nodes_node_lxc_vmid_firewall_ipset_name",
+    "get_nodes_node_lxc_vmid_firewall_ipset"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_firewall_options.json

@@ -0,0 +1,38 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_firewall_options",
+  "usageNotes": "Use this to enable, disable, or tune the per-container firewall (default policies, logging levels, DHCP/NDP/MAC filter toggles) for a specific LXC container. The firewall must also be enabled at the cluster and node level for per-container rules to take effect; setting 'enable: true' here alone is not sufficient. Returns null synchronously — no UPID is issued.",
+  "examples": [
+    {
+      "summary": "Enable the container firewall with DROP default policies and warning-level logging",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110
+      },
+      "params": {
+        "enable": true,
+        "policy_in": "DROP",
+        "policy_out": "ACCEPT",
+        "log_level_in": "warning",
+        "log_level_out": "nolog",
+        "dhcp": true,
+        "ndp": true,
+        "macfilter": true,
+        "ipfilter": true
+      }
+    }
+  ],
+  "tips": [
+    "Use 'digest' (from the GET options response) to prevent race conditions when multiple administrators may be editing firewall config simultaneously.",
+    "The 'delete' param accepts a comma-separated list of option names (e.g. 'log_level_in,radv') to revert specific fields to their defaults without touching others.",
+    "ipfilter is particularly useful for containers: it automatically restricts each interface to only its configured IP(s), blocking IP spoofing at the hypervisor level.",
+    "macfilter defaults to enabled (1); disabling it allows a container to send traffic from arbitrary MAC addresses, which is a security risk on shared networks.",
+    "radv (Router Advertisement) should only be enabled on containers acting as IPv6 routers/gateways — enabling it on a normal workload container can disrupt IPv6 on the segment."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_firewall_options",
+    "get_nodes_node_lxc_vmid_firewall_rules",
+    "post_nodes_node_lxc_vmid_firewall_rules",
+    "get_cluster_firewall_options",
+    "put_nodes_node_firewall_options"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_firewall_rules_pos.json

@@ -0,0 +1,38 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_firewall_rules_pos",
+  "usageNotes": "Use this to modify an existing firewall rule on an LXC container by its zero-based position index; requires VM.Config.Network on the container. Supply `digest` (from the GET rules response) to guard against concurrent edits overwriting each other. To reorder a rule without changing its properties, set only `moveto`; all other body fields are ignored when `moveto` is present.",
+  "examples": [
+    {
+      "summary": "Change an existing inbound TCP rule at position 2 to DROP port 23 (Telnet) and add a comment",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110,
+        "pos": 2
+      },
+      "params": {
+        "type": "in",
+        "action": "DROP",
+        "proto": "tcp",
+        "dport": "23",
+        "comment": "Block inbound Telnet",
+        "enable": 1,
+        "log": "info"
+      }
+    }
+  ],
+  "tips": [
+    "Position (pos) is zero-based; use GET /nodes/{node}/lxc/{vmid}/firewall/rules to list current rules and their positions before editing.",
+    "Setting `moveto` to a new index repositions the rule atomically; combine with a separate PUT call if you also need to change rule properties.",
+    "Use the `delete` param (comma-separated field names) to unset optional fields like `source`, `dest`, or `comment` rather than sending an empty string.",
+    "The container firewall must be enabled at both the container level and the host/cluster level for rules to take effect.",
+    "LXC interface names in `iface` must follow the net\\d+ pattern (e.g., net0), not arbitrary names as allowed for host rules."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_firewall_rules",
+    "get_nodes_node_lxc_vmid_firewall_rules_pos",
+    "post_nodes_node_lxc_vmid_firewall_rules",
+    "delete_nodes_node_lxc_vmid_firewall_rules_pos",
+    "get_nodes_node_lxc_vmid_firewall_options",
+    "put_nodes_node_lxc_vmid_firewall_options"
+  ]
+}

package/dist/catalog-pve/enrichment/put_nodes_node_lxc_vmid_resize.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "put_nodes_node_lxc_vmid_resize",
+  "usageNotes": "Use this to grow a container's rootfs or any additional mount point (mp0–mp255); shrinking is not supported and will be rejected. The operation returns a task UPID — poll the task status endpoint to confirm completion before treating the resize as done. Pass the current config digest to guard against concurrent modifications.",
+  "examples": [
+    {
+      "summary": "Grow rootfs of CT 110 by 10 GB",
+      "path_params": {
+        "node": "pve01",
+        "vmid": 110
+      },
+      "params": {
+        "disk": "rootfs",
+        "size": "+10G"
+      }
+    }
+  ],
+  "tips": [
+    "Prefix size with '+' (e.g. '+10G') for a relative increase; omit '+' to set an absolute size — but absolute values smaller than the current disk size will fail.",
+    "The container does not need to be stopped for a resize, but the filesystem inside the container may need a manual resize (e.g. 'resize2fs') after the block device grows.",
+    "Retrieve the current config digest from get_nodes_node_lxc_vmid_config and pass it as 'digest' to prevent a race condition if another process modifies the CT simultaneously.",
+    "Supported size suffixes: K (kilobytes), M (megabytes), G (gigabytes), T (terabytes); omitting a suffix defaults to bytes."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_lxc_vmid_config",
+    "get_nodes_node_tasks_upid_status",
+    "put_nodes_node_lxc_vmid_config"
+  ]
+}