Ideon #2364

Activity

1. MickLesk

   added

   task

   Ready For Testing

   and removed

   task

   on Oct 3, 2026
2. github-actions commented on Oct 4, 2026

   

   github-actionsBot

   on Oct 4, 2026 – with GitHub Actions

   Contributor

   More actions

   The Ideon script is ready for testing. Run it in the Proxmox VE shell (or on an Incus host) to create a container:

   bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/ideon.sh)"
   

   There is no default account. The first visit to http://:3000 opens the setup page that creates the super-admin; anyone who reaches the port can claim it until then, so finish the setup right after the install. Public registration is off afterwards, further users are invited from the Team page.
   Redirects, invitation and share links are built from APP_URL in /opt/ideon_data/.env, which points at the container IP. Change it when the IP changes or Ideon sits behind a reverse proxy or domain, then run systemctl restart ideon.
   Back up SECRET_KEY from /opt/ideon_data/.env together with the database and /opt/ideon_data/storage (uploads, avatars and the canvas documents). Sessions and encrypted values such as Git tokens depend on it.
   Ideon connects to PostgreSQL as a regular role that is subject to its row-level security, unlike the upstream Docker setup whose database user is a superuser. Canvases, blocks, files and collaboration work, but a few features expect to bypass it: Shell blocks are refused, MCP/API-key clients and access requests to other users' projects report the project as missing, and the admin audit log only lists the admin's own entries.
   Install and every update build Ideon from source (Next.js), which takes about 10 minutes on 2 cores and needs the 4 GB of RAM. The running app uses around 300 MB, so the RAM can be lowered after the install and raised again before an update.
   Email (invitations, password reset, magic links) needs the SMTP_* values in /opt/ideon_data/.env, followed by systemctl restart ideon.

   Note: This is not in the official repo yet—it's just a dev version! After merging into ProxmoxVE, it will need to be recreated.

   Discord testing thread: https://discord.com/channels/1302816934508630047/1556250518442090697
3. community-scripts-issue-bot commented on Oct 29, 2026

   

   community-scripts-issue-botBot

   on Oct 29, 2026

   More actions

   volfied via Discord · 2026-10-29 12:21 UTC

   Ran into the RLS limitation from the notes above with MCP: a valid API key sees no projects at all, even ones its user owns. The MCP tools query via getGlobalDb() without setting app.current_user_id, so the projects/projectCollaborators policies hide every row.

   Fix, inside the CT:

   su - postgres -c "psql -c 'ALTER ROLE ideon BYPASSRLS;'"
   systemctl restart ideon

   After that, list_projects/get_project work as expected, scoped to the key's user (MCP still runs its own checkProjectAccess). Same RLS behavior as upstream's superuser without the rest of superuser, and it survives updates since it's a role attribute. Haven't tested Shell blocks, access requests or the audit log.

   Might be worth doing in the install script, or as a documented option.

   _{Mirrored from the Discord thread.}