What this matrix covers
This page covers the integration registry, not the direct protocol clients in the protocol matrix. Every registered panel uses persisted non-secret instance settings plus OS-vault references where applicable, and session-owned lifecycle handling reports the provider’s real connect, disconnect, reconnect, and cleanup result. A saved session does not persist plaintext credentials or opaque live backend handles.
The verification column names deterministic repository checks, principally focused frontend tests and Rust loopback/fixture contract tests. They validate request shapes, error mapping, timeouts, persistence, and lifecycle behavior; they are not proof that a particular vendor deployment is reachable. No live vendor, appliance, mail-stack, or KDBX environment is part of this automated matrix.
Registered integration panels (27)
| Integration | Lifecycle and persistence | Transport and authentication | Deterministic verification | Known boundary / live-provider status |
|---|---|---|---|---|
| LXD / Incus | Saved endpoints and vault-backed auth are per instance; one process-global native LXD client is owned by one active session. | HTTPS mutual TLS client certificate/key or OIDC token. | Frontend lifecycle test plus loopback HTTP contracts. | A different saved instance is blocked until the owning session disconnects or closes. Trust-password enrollment is explicitly unsupported; use an already-trusted certificate/key or OIDC. No live daemon fixture. |
| pfSense | Per-instance endpoint and vault API token; lifecycle-owned REST client. | HTTPS REST API with token authentication and explicit TLS policy. | Panel lifecycle and loopback HTTP contracts. | Requires the compatible pfSense REST API and reachable appliance; no live appliance in CI. |
| DrayTek Vigor | Per-instance host/port and vault username/password; lifecycle-owned HTTP client bound to one active session. | HTTP(S) web-UI login with optional TLS verification skip (acknowledged). | Frontend panel and tab vitest suites; Rust crate contract tests. | Reboot and status only; CLI verbs are wrapper-only. Pre-authenticated web-UI URL is best effort and unsupported on firmware 4.4+. No live device fixture. |
| NetBox | Per-instance URL and vault token; lifecycle-owned REST client. | HTTP(S) REST API token. | Loopback HTTP contracts cover auth/status/error paths. | Requires NetBox API compatibility and a live deployment for end-to-end validation. |
| VMware Workstation | Saved local/vmrest settings are per instance; one process-global native Workstation service is owned by one active session. | Local filesystem / VMware Workstation installation. | VMX/VMDK parsing and operation tests. | A different saved instance is blocked until the owner disconnects or closes. This is a local Workstation manager, not a vSphere host controller; no installed-Workstation CI fixture. |
| VMware vSphere | Saved URLs and vault credentials are per instance; one process-global native REST client is owned by one active session. | vSphere Automation REST API over HTTP(S). | Frontend capability test and typed backend error tests. | A different saved instance is blocked until the owner disconnects or closes. Host maintenance enter/exit is unsupported by this REST surface and remains disabled; use SOAP or PowerCLI. No live vCenter/ESXi fixture. |
| Proxmox VE | Saved endpoint and vault-backed secrets (password or API-token secret, optional TOTP secret) are per instance; one process-global native PVE client is owned by one active session. | HTTPS REST /api2/json with ticket+CSRF (password, TFA challenge, ticket renewal) or PVEAPIToken API token; TLS strict by default, pinned SHA-256 fingerprint required to skip verification. |
Rust TLS-mock PVE contract tests plus panel vitest suites. | A different saved instance is blocked while one session owns the client. No live PVE fixture; contract behaviour is verified against the mock only. |
| Portainer | Per-instance base URL, auth mode and username are persisted; the password or API access token is a vault reference; lifecycle-owned API client with JWT expiry tracking and transparent re-login. | HTTPS/HTTP Portainer API v2: POST /api/auth JWT (username + password) or X-API-Key access token; TLS through the Trust-Center TOFU layer with an explicit, acknowledged self-signed override. “Open web UI (auto-login)” launches Portainer’s own UI as an ephemeral HTTP web session using proxy-side auto-login (password mode only). |
Panel and web-UI launch vitest suites; Rust loopback HTTP contracts plus a nightly Portainer CE container e2e test. | API-key mode opens the web UI without auto-login. The in-app session-open hand-off is event-based (open-runtime-connection) pending an app-shell listener. |
| cPanel/WHM | Per-instance endpoint and vault token/credential references; lifecycle-owned API client. | HTTP(S) cPanel/WHM API authentication. | Loopback HTTP contract tests. | Requires a compatible API-enabled cPanel/WHM server; no live control panel in CI. |
| Ansible | Per-instance executable, inventory, and vault references; lifecycle-owned local process. | Local ansible executable and inventory; non-interactive execution with configured timeout. |
Fixture command success, non-zero exit, prompt rejection, and timeout tests. | Interactive prompts are rejected rather than falsely succeeding; requires a local Ansible installation and real inventory for live work. |
| Nginx | Per-instance SSH configuration and vault secret/reference; retained SSH actor lifecycle. | SSH with password or key path, host trust, and keepalive/reconnect semantics. | Native SSH actor and focused panel tests. | Requires command access to the target host and compatible Nginx layout; no live host in CI. |
| HAProxy | Per-instance SSH configuration and vault secret/reference; retained SSH actor lifecycle. | SSH with password or key path. | Native SSH actor and focused panel tests. | Requires target command access and expected HAProxy configuration layout; no live host in CI. |
| Caddy | Per-instance endpoint and vault reference; lifecycle-owned API client. | HTTP(S) Admin API with configured TLS policy. | Loopback HTTP contracts including mandatory availability check. | Requires an exposed compatible Admin API; no live server fixture. |
| Traefik | Per-instance endpoint and vault reference; lifecycle-owned API client. | HTTP(S) Traefik API with configured TLS policy. | Loopback HTTP contracts including mandatory availability check. | Requires a compatible authenticated API endpoint; no live server fixture. |
| PHP | Per-instance SSH configuration and vault secret/reference; retained SSH actor lifecycle. | SSH with password or key path. | Native SSH actor and focused panel tests. | Requires target command access and available PHP tooling; no live host in CI. |
| Nginx Proxy Manager | Per-instance API URL and vault-backed email/password or bearer token; lifecycle-owned REST client with JWT expiry tracking, pre-emptive refresh and one transparent re-login on 401. | HTTP(S) NPM REST API (POST /api/tokens) with Trust-Center TOFU TLS and the explicit accept-self-signed acknowledgement; optional “Open web UI (auto-login)” web session driving NPM’s login form. |
Frontend hook/panel tests plus Rust loopback HTTP contracts; nightly Docker jc21/nginx-proxy-manager golden path. |
Requires NPM v2.9+ reachable on its admin port (default 81). Web-UI auto-login is only armed in email/password mode; token mode opens the UI without signing in. |
| SQL Server | Per-instance host/options and vault SQL password; lifecycle-owned TDS client. | Encrypted TDS with SQL authentication only. | Capability UI test and backend timeout/fail-before-insertion tests. | Windows and Azure AD auth are rejected, and SSH tunnelling is unsupported. No live SQL Server fixture. |
| Exchange | Saved server metadata and vault references are per instance; one process-global native Exchange client is owned by one active session. | Online/Graph and on-prem PowerShell over strict HTTPS; Basic/NTLM on-prem. | PowerShell/PSRP and Exchange focused tests. | A different saved instance is blocked until the owner disconnects or closes. Kerberos and Negotiate are explicitly rejected. skipCertCheck is rejected: trust or pin the server certificate. Hybrid validates both configured sides. |
| Prometheus | Per-instance endpoint and vault reference; lifecycle-owned API client. | HTTP(S) Prometheus HTTP API. | Loopback HTTP contracts including mandatory ping. | Requires a compatible reachable API; no live Prometheus server. |
| Google Drive | Saved OAuth client and refresh material use vault references; one process-global native token client is owned by one active account session. No hostname, URL, IP address, or port is configured. | Google OAuth 2.0 against built-in Google endpoints. | Hook and panel tests cover OAuth lifecycle; explicit revoke is separately tested. | Revoke access destroys the grant; ordinary disconnect/close does not revoke it. A different saved account is blocked until the owning Drive session disconnects or closes. No live Google OAuth environment. |
| Grafana | Per-instance endpoint and vault token/reference; lifecycle-owned API client. | HTTP(S) Grafana API token authentication. | Loopback HTTP contracts including mandatory ping. | Requires a compatible API/token and reachable Grafana instance; no live server. |
| Budibase | Per-instance endpoint and vault reference; lifecycle-owned API client. | HTTP(S) Budibase API authentication. | Loopback HTTP contracts. | Requires a compatible enabled API; no live Budibase environment. |
| Jira | Per-instance endpoint and vault token/reference; lifecycle-owned API client. | HTTP(S) Jira REST API authentication. | Loopback HTTP contracts reject malformed/failed ping and auth errors. | Requires a compatible Jira deployment and permissions; no live cloud/server environment. |
| osTicket | Per-instance endpoint and vault API key/reference; lifecycle-owned API client. | HTTP(S) osTicket API key authentication. | Loopback HTTP contracts reject failed health/auth responses. | Requires an API-enabled osTicket installation; no live environment. |
| mailcow | Per-instance endpoint and vault API key/reference; lifecycle-owned API client. | HTTP(S) mailcow API key authentication. | Loopback HTTP contracts require ping/summary and map application failures. | Requires a compatible mailcow API and permissions; no live environment. |
| Mail Server | Parent routes an exact saved mail.<service> instance to one active child; generic Mail instances are rejected. |
Per-child transport and auth below. | Mail routing, selected-instance hydration, lifecycle, and child contract tests. | The parent is a container, not a generic daemon connection. See the nine registered sub-tabs below. |
| KeePass | File path/key-file metadata plus vault master-password reference are persistable; open/close lifecycle is present. | Local .kdbx file and composite key inputs. |
Fail-closed lifecycle tests for invalid/unsupported KDBX paths and save operations. | KDBX read/write is unavailable in this build. The UI disables open/create rather than parsing or modifying a database without a real codec. |
Mail Server sub-tabs (9)
Each sub-tab is an independent service connection. Selecting one saved Mail instance binds only its corresponding mail.<service> record; the shell does not fall back to another daemon.
| Mail sub-tab | Lifecycle and persistence | Transport and authentication | Deterministic verification | Known boundary / live-provider status |
|---|---|---|---|---|
| OpenDKIM | Per-service mail.opendkim instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and selected-instance frontend coverage. | Target shell/config access required; no live mail host. |
| Procmail | Per-service mail.procmail instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and selected-instance frontend coverage. | Target shell/config access required; no live mail host. |
| Rspamd | Per-service endpoint and vault reference; lifecycle-owned HTTP client. | HTTP(S) Rspamd controller API. | Loopback HTTP contracts cover status, application failures, and timeout. | Plugin enable/disable, controller reload, and worker inventory mutations are explicitly unsupported by the exposed API surface. No live controller. |
| ClamAV | Per-service mail.clamav instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and selected-instance frontend coverage. | Target shell/service access required; no live mail host. |
| Postfix | Per-service mail.postfix instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and exact selected-instance frontend test. | Target shell/config access required; no live mail host. |
| Dovecot | Per-service mail.dovecot instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and selected-instance frontend coverage. | Target shell/config access required; no live mail host. |
| Roundcube | Per-service mail.roundcube endpoint and vault credential/reference; lifecycle-owned HTTP client. |
Custom admin JSON API over HTTP(S), bearer token after login. | Loopback HTTP contracts and actionable unsupported-route frontend test. | This is not the stock Roundcube web UI/API: the deployment must expose the documented custom admin JSON routes. No live deployment. |
| Amavis | Per-service mail.amavis instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and exact selected-instance frontend test. | Target shell/config access required; no live mail host. |
| Cyrus SASL | Per-service mail.cyrusSasl instance and retained SSH actor. |
SSH password or key-path authentication. | Native SSH actor and selected-instance frontend coverage. | Target shell/config access required; no live mail host. |
Regression contract
tests/integrations/integrationSupportMatrix.test.ts imports the authoritative top-level and Mail registries and requires one marker for every registered key in this page. Adding or removing a descriptor/sub-tab therefore makes the documentation check fail until this matrix is reconciled. The test currently asserts 26 top-level integration descriptors and 9 Mail sub-tabs.
For implementation details and risk boundaries, consult the source named by the focused tests and the security overview. For direct remote-session support, return to Protocols.