Add cheatsheets section (Proxmox CLI, zsh config reference)

Lower-bar reference material, distinct from docs/'s engineering write-ups: recovered Proxmox cheat sheets (live-verified against PVE 9.2.21, new remote-migrate/importovf/pvesm subcommands added, acmedomain0 flag typo fixed) plus the real zsh aliases/functions/keybindings from the actual ZDOTDIR-based config.
2026-10-04 13:45:32 +03:00
1 parent c8c56add40
commit a683feaa9f
@@ -135,6 +135,12 @@ A self-hosted WireGuard mesh gives every fleet host and personal device its own
 ---
 ## Cheatsheets
 Quick-reference material for tools I use day-to-day — command references and config notes, not full write-ups. See [`cheatsheets/`](cheatsheets/).
 ---
 ## Scripts & Tooling
 A few standalone scripts live in [`projects/`](projects/) alongside the Docker stacks — real tooling, not demo code:
@@ -0,0 +1,13 @@
 # Cheatsheets
 Quick-reference material, not deep dives. The [`docs/`](../docs/) directory is
 where the real engineering write-ups live — verified claims, real evidence,
 the actual design decisions behind each system. This directory is lower-key:
 command references and config notes for tools I use day-to-day, kept here so
 they're easy to find and easy to add to.
 - **[proxmox/](proxmox/)** — CLI cheat sheet for the hypervisor cluster this
  fleet runs on (`qm`/`pct`/`pvesm`/`pveam`), plus API token auth and
  certificate management notes.
 - **[zsh/](zsh/)** — the aliases, functions, and keybindings from my actual
  zsh config, not a generic zsh tutorial.
@@ -0,0 +1,18 @@
 ## Create an API Token on Proxmox
 To create a new API Token for your `user` in Proxmox, follow these steps:
 1. Open the Proxmox Web UI and navigate to the **'Datacenter'** in the **'Server View'** menu.
 2. Select **'API Token'** in the **'Permissions'** menu.
 3. Click on **'Add'**.
 4. Select the `user`, and add a **'Token ID'**.
 5. (Optional) Disable `Privilege Separation`, and set an `Expire` date.
 6. Click on **'Add'**.
 ## Check the API Token
 To test the API Token, you can use the following command:
 ```sh
 curl -H "Authorization: PVEAPIToken=root@pam!monitoring=aaaaaaaaa-bbb-cccc-dddd-ef0123456789" https://your-proxmox-url:8006/api2/json/
 ```
@@ -0,0 +1,324 @@
 ## Certificates for Intra-Cluster Communication
 Each Proxmox VE cluster creates by default its own (self-signed) Certificate
 Authority (CA) and generates a certificate for each node which gets signed by
 the aforementioned CA. These certificates are used for encrypted communication
 with the cluster's pveproxy service and the Shell/Console feature if SPICE is used.
 The CA certificate and key are stored in the Proxmox Cluster File System (pmxcfs).
 ## Certificates for API and Web GUI
 The REST API and web GUI are provided by the pveproxy service, which runs on each node.
 You have the following options for the certificate used by pveproxy:
 * By default the node-specific certificate in `/etc/pve/nodes/NODENAME/pve-ssl.pem` is used. This certificate is signed by the cluster CA and therefore not automatically trusted by browsers and operating systems.
 * Use an externally provided certificate (e.g. signed by a commercial CA).
 * Use ACME (Let's Encrypt) to get a trusted certificate with automatic renewal, this is also integrated in the Proxmox VE API and web interface.
 For options 2 and 3 the file `/etc/pve/local/pveproxy-ssl.pem` (and
 `/etc/pve/local/pveproxy-ssl.key`, which needs to be without password) is used.
 Keep in mind that `/etc/pve/local` is a node specific symlink to
 `/etc/pve/nodes/NODENAME`.
 Certificates are managed with the Proxmox VE Node management command
 (see the `pvenode(1)` manpage). The current node certificate's details can
 be checked directly from the CLI too:
 ```shell
 pvenode cert info [FORMAT_OPTIONS]
 ```
 Do not replace or manually modify the automatically generated node
 certificate files in `/etc/pve/local/pve-ssl.pem` and
 `/etc/pve/local/pve-ssl.key` or the cluster CA files in
 `/etc/pve/pve-root-ca.pem` and `/etc/pve/priv/pve-root-ca.key`.
 ## Upload Custom Certificate
 If you already have a certificate which you want to use for a Proxmox VE node
 you can upload that certificate simply over the web interface. Note that the
 certificates key file, if provided, mustn't be password protected.
 ## Trusted certificates via Let's Encrypt (ACME)
 Proxmox VE includes an implementation of the Automatic Certificate
 Management Environment ACME protocol, allowing Proxmox VE admins to
 use an ACME provider like Let's Encrypt for easy setup of TLS certificates
 which are accepted and trusted on modern operating systems and web browsers
 out of the box.
 Currently, the two ACME endpoints implemented are the
 Let's Encrypt (LE) production and its staging
 environment. Our ACME client supports validation of http-01 challenges using
 a built-in web server and validation of dns-01 challenges using a DNS plugin
 supporting all the DNS API endpoints `acme.sh` does.
 ### ACME Account
 You need to register an ACME account per cluster with the endpoint you want to
 use. The email address used for that account will serve as contact point for
 renewal-due or similar notifications from the ACME endpoint.
 You can register and deactivate ACME accounts over the web interface
 `Datacenter -> ACME` or using the `pvenode` command line tool.
 ```shell
 pvenode acme account register account-name [email protected]
 ```
 Because of rate-limits you should use LE staging for experiments or if you use
 ACME for the first time.
 ### ACME Plugins
 The ACME plugins task is to provide automatic verification that you, and thus
 the Proxmox VE cluster under your operation, are the real owner of a domain. This is
 the basis building block for automatic certificate management.
 The ACME protocol specifies different types of challenges, for example the
 http-01 where a web server provides a file with a certain content to prove
 that it controls a domain. Sometimes this isn't possible, either because of
 technical limitations or if the address of a record to is not reachable from
 the public internet. The dns-01 challenge can be used in these cases. This
 challenge is fulfilled by creating a certain DNS record in the domain's zone.
 Proxmox VE supports both of those challenge types out of the box, you can configure
 plugins either over the web interface under `Datacenter -> ACME`, or using the
 `pvenode acme plugin add` command.
 ACME Plugin configurations are stored in `/etc/pve/priv/acme/plugins.cfg`.
 A plugin is available for all nodes in the cluster.
 ### Node Domains
 Each domain is node specific. You can add new or manage existing domain entries
 under Node -> Certificates, or using the `pvenode config` command.
 After configuring the desired domain(s) for a node and ensuring that the
 desired ACME account is selected, you can order your new certificate over the
 web-interface. On success the interface will reload after 10 seconds.
 Renewal will happen automatically.
 ## ACME HTTP Challenge Plugin
 There is always an implicitly configured standalone plugin for validating
 http-01 challenges via the built-in webserver spawned on port 80.
 The name `standalone` means that it can provide the validation on it's
 own, without any third party service. So, this plugin works also for cluster
 nodes.
 There are a few prerequisites to use it for certificate management with Let's
 Encrypts ACME.
 * You have to accept the ToS of Let's Encrypt to register an account.
 * Port 80 of the node needs to be reachable from the internet.
 * There must be no other listener on port 80.
 * The requested (sub)domain needs to resolve to a public IP of the Node.
 ## ACME DNS API Challenge Plugin
 On systems where external access for validation via the http-01 method is
 not possible or desired, it is possible to use the dns-01 validation method.
 This validation method requires a DNS server that allows provisioning of TXT
 records via an API.
 ### Configuring ACME DNS APIs for validation
 Proxmox VE re-uses the DNS plugins developed for the
 [acme.sh project](https://github.com/acmesh-official/acme.sh). Please
 refer to its documentation for details on configuration of specific APIs.
 The easiest way to configure a new plugin with the DNS API is using the web
 interface (`Datacenter -> ACME`).
 Choose DNS as challenge type. Then you can select your API provider, enter
 the credential data to access your account over their API.
 See the `acme.sh`
 [How to use DNS API](https://github.com/acmesh-official/acme.sh/wiki/dnsapi#how-to-use-dns-api)
 wiki for more detailed information about getting API credentials for your
 provider.
 As there are many DNS providers and API endpoints Proxmox VE automatically generates
 the form for the credentials for some providers. For the others you will see a
 bigger text area, simply copy all the credentials KEY=VALUE pairs in there.
 ## DNS Validation through CNAME Alias
 A special alias mode can be used to handle the validation on a different
 domain/DNS server, in case your primary/real DNS does not support provisioning
 via an API. Manually set up a permanent CNAME record for
 `_acme-challenge.domain1.example` pointing to `_acme-challenge.domain2.example`
 and set the alias property in the Proxmox VE node configuration file to
 `domain2.example` to allow the DNS server of `domain2.example` to validate all
 challenges for `domain1.example`.
 ### Combination of Plugins
 Combining http-01 and dns-01 validation is possible in case your node is
 reachable via multiple domains with different requirements / DNS provisioning
 capabilities. Mixing DNS APIs from multiple providers or instances is also
 possible by specifying different plugin instances per domain.
 Accessing the same service over multiple domains increases complexity and
 should be avoided if possible.
 ## Automatic renewal of ACME certificates
 If a node has been successfully configured with an ACME-provided certificate
 (either via `pvenode` or via the GUI), the certificate will be automatically
 renewed by the `pve-daily-update.service`. Currently, renewal will be attempted
 if the certificate has expired already, or will expire in the next 30 days.
 A certificate can also be renewed directly, on demand:
 ```shell
 pvenode acme cert renew [OPTIONS]
 ```
 ## ACME Examples with pvenode
 *Example*: Sample `pvenode` invocation for using Let's Encrypt certificates
 ```sh
 root@proxmox:~# pvenode acme account register default [email protected]
 Directory endpoints:
 0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
 1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
 2) Custom
 Enter selection: 1
 Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
 Do you agree to the above terms? [y|N]y
 ...
 Task OK
 root@proxmox:~# pvenode config set --acme domains=example.invalid
 root@proxmox:~# pvenode acme cert order
 Loading ACME account details
 Placing ACME order
 ...
 Status is 'valid'!
 All domains validated!
 ...
 Downloading certificate
 Setting pveproxy certificate and key
 Restarting pveproxy
 Task OK
 ```
 *Example*: Setting up the OVH API for validating a domain
 The account registration steps are the same no matter which plugins are
 used, and are not repeated here.
 OVH_AK and OVH_AS need to be obtained from OVH according to the OVH
 API documentation
 First you need to get all information so you and Proxmox VE can access the API.
 ```sh
 root@proxmox:~# cat /path/to/api-token
 OVH_AK=XXXXXXXXXXXXXXXX
 OVH_AS=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
 root@proxmox:~# source /path/to/api-token
 root@proxmox:~# curl -XPOST -H"X-Ovh-Application: $OVH_AK" -H "Content-type: application/json" \
 https://eu.api.ovh.com/1.0/auth/credential  -d '{
  "accessRules": [
    {"method": "GET","path": "/auth/time"},
    {"method": "GET","path": "/domain"},
    {"method": "GET","path": "/domain/zone/*"},
    {"method": "GET","path": "/domain/zone/*/record"},
    {"method": "POST","path": "/domain/zone/*/record"},
    {"method": "POST","path": "/domain/zone/*/refresh"},
    {"method": "PUT","path": "/domain/zone/*/record/"},
    {"method": "DELETE","path": "/domain/zone/*/record/*"}
 ]
 }'
 {"consumerKey":"ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ","state":"pendingValidation","validationUrl":"https://eu.api.ovh.com/auth/?credentialToken=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
 (open validation URL and follow instructions to link Application Key with account/Consumer Key)
 root@proxmox:~# echo "OVH_CK=ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ" >> /path/to/api-token
 ```
 Now you can setup the ACME plugin:
 ```sh
 root@proxmox:~# pvenode acme plugin add dns example_plugin --api ovh --data /path/to/api_token
 root@proxmox:~# pvenode acme plugin config example_plugin
 ```
 ```
 ┌────────┬──────────────────────────────────────────┐
 │ key    │ value                                    │
 ╞════════╪══════════════════════════════════════════╡
 │ api    │ ovh                                      │
 ├────────┼──────────────────────────────────────────┤
 │ data   │ OVH_AK=XXXXXXXXXXXXXXXX                  │
 │        │ OVH_AS=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY  │
 │        │ OVH_CK=ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ  │
 ├────────┼──────────────────────────────────────────┤
 │ digest │ 867fcf556363ca1bea866863093fcab83edf47a1 │
 ├────────┼──────────────────────────────────────────┤
 │ plugin │ example_plugin                           │
 ├────────┼──────────────────────────────────────────┤
 │ type   │ dns                                      │
 └────────┴──────────────────────────────────────────┘
 ```
 At last you can configure the domain you want to get certificates for and
 place the certificate order for it:
 ```sh
 root@proxmox:~# pvenode config set --acmedomain0 example.proxmox.com,plugin=example_plugin
 root@proxmox:~# pvenode acme cert order
 Loading ACME account details
 Placing ACME order
 Order URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/11111111/22222222
 Getting authorization details from 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/33333333'
 The validation for example.proxmox.com is pending!
 [Wed Apr 22 09:25:30 CEST 2020] Using OVH endpoint: ovh-eu
 [Wed Apr 22 09:25:30 CEST 2020] Checking authentication
 [Wed Apr 22 09:25:30 CEST 2020] Consumer key is ok.
 [Wed Apr 22 09:25:31 CEST 2020] Adding record
 [Wed Apr 22 09:25:32 CEST 2020] Added, sleep 10 seconds.
 Add TXT record: _acme-challenge.example.proxmox.com
 Triggering validation
 Sleeping for 5 seconds
 Status is 'valid'!
 [Wed Apr 22 09:25:48 CEST 2020] Using OVH endpoint: ovh-eu
 [Wed Apr 22 09:25:48 CEST 2020] Checking authentication
 [Wed Apr 22 09:25:48 CEST 2020] Consumer key is ok.
 Remove TXT record: _acme-challenge.example.proxmox.com
 All domains validated!
 Creating CSR
 Checking order status
 Order is ready, finalizing order
 valid!
 Downloading certificate
 Setting pveproxy certificate and key
 Restarting pveproxy
 Task OK
 ```
 ### Example: Switching from the staging to the regular ACME directory
 Changing the ACME directory for an account is unsupported, but as Proxmox VE
 supports more than one account you can just create a new one with the
 production (trusted) ACME directory as endpoint. You can also deactivate the
 staging account and recreate it.
 *Example*: Changing the default ACME account from staging to directory using `pvenode`
 ```sh
 root@proxmox:~# pvenode acme account deactivate default
 Renaming account file from '/etc/pve/priv/acme/default' to '/etc/pve/priv/acme/_deactivated_default_4'
 Task OK
 root@proxmox:~# pvenode acme account register default [email protected]
 Directory endpoints:
 0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
 1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
 2) Custom
 Enter selection: 0
 Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
 Do you agree to the above terms? [y|N]y
 ...
 Task OK
 ```
@@ -0,0 +1,426 @@
 Proxmox Virtual Environment (Proxmox VE or PVE) is a hyper-converged infrastructure open-source software. It is a hosted hypervisor that can run operating systems including Linux and Windows on x64 hardware. It is a Debian-based Linux distribution with a modified Ubuntu LTS kernel and allows deployment and management of virtual machines and containers. Proxmox VE includes a web console and command-line tools, and provides a REST API for third-party tools. Two types of virtualization are supported: container-based with LXC (starting from version 4.0 replacing OpenVZ used in version up to 3.4, included), and full virtualization with KVM. It includes a web-based management interface.
 Proxmox VE is licensed under the GNU Affero General Public License, version 3.
 Repository: [https://git.proxmox.com](https://git.proxmox.com)
 Website: [https://pve.proxmox.com](https://pve.proxmox.com)
 ## VM Management
 ```shell
 # list VMs
 qm list
 # Create or restore a virtual machine.
 qm create your-vm-id
 # start a VM
 qm start your-vm-id
 # Suspend virtual machine.
 qm suspend your-vm-id
 # shutdown a VM
 qm shutdown your-vm-id
 # reboot a VM
 qm reboot your-vm-id
 # reset a VM
 qm reset your-vm-id
 # stop a VM
 qm stop your-vm-id
 # Destroy the VM and all used/owned volumes.
 # Removes any VM specific permissions and firewall rules
 qm destroy your-vm-id
 # Enter Qemu Monitor interface.
 qm monitor your-vm-id
 # Get the virtual machine configuration with both current and pending values.
 qm pending your-vm-id
 # Get the virtual machine configuration with pending changes applied.
 qm config your-vm-id [OPTIONS]
 # Send key event to virtual machine.
 qm sendkey your-vm-id your-key-event [OPTIONS]
 # Show command line which is used to start the VM (debug info).
 qm showcmd your-vm-id [OPTIONS]
 # Unlock the VM.
 qm unlock your-vm-id
 # Clone a VM
 qm clone your-vm-id new-vm-id
 # Migrate a VM
 qm migrate your-vm-id target-node
 # Migrate a VM to a remote cluster. EXPERIMENTAL.
 qm remote-migrate your-vm-id target-endpoint --target-bridge <string> --target-storage <string> [OPTIONS]
 # Create a new VM from an OVF manifest.
 qm importovf your-vm-id <manifest> <storage> [OPTIONS]
 # Enroll updated UEFI certificates to the EFI disk.
 qm enroll-efi-keys your-vm-id
 # Show VM status
 qm status your-vm-id
 # Wait until the VM is stopped.
 qm wait your-vm-id [OPTIONS]
 # Clean up resources for a VM
 qm cleanup your-vm-id your-clean-shutdown your-guest-requested
 # Create a Template.
 qm template your-vm-id [OPTIONS]
 # Set virtual machine options (synchrounous API)
 qm set your-vm-id [OPTIONS]
 ```
 ### Cloudinit
 ```shell
 # Get automatically generated cloudinit config.
 qm cloudinit dump your-vm-id your-vm-type
 # Get the cloudinit configuration with both current and pending values.
 qm cloudinit pending your-vm-id
 # Regenerate and change cloudinit config drive.
 qm cloudinit update your-vm-id
 ```
 ### Disk
 ```shell
 # Import an external disk image as an unused disk in a VM.
 # The image format has to be supported by qemu-img(1).
 qm disk import your-vm-id your-target-source your-target-storage
 # Move volume to different storage or to a different VM.
 qm disk move your-vm-id your-vm-disk [<storage>] [OPTIONS]
 # Rescan all storages and update disk sizes and unused disk images.
 qm disk rescan [OPTIONS]
 # Extend volume size.
 qm disk resize your-vm-id your-vm-disk <size> [OPTIONS]
 # Unlink/delete disk images.
 qm disk unlink your-vm-id --idlist <string> [OPTIONS]
 # rescan volumes
 qm rescan
 ```
 ### Snapshot
 ```shell
 # List all snapshots.
 qm listsnapshot your-vm-id
 # Snapshot a VM
 qm snapshot your-vm-id <snapname>
 # Delete a snapshot.
 qm delsnapshot your-vm-id <snapname>
 # Rollback a snapshot
 qm rollback your-vm-id <snapname>
 # Open a terminal using a serial device
 # (The VM need to have a serial device configured, for example serial0: socket)
 qm terminal your-vm-id [OPTIONS]
 # Proxy VM VNC traffic to stdin/stdout
 qm vncproxy your-vm-id
 ```
 ### Misc
 ```shell
 # Execute Qemu Guest Agent commands.
 qm guest cmd your-vm-id <command>
 # Executes the given command via the guest agent
 qm guest exec your-vm-id [<extra-args>] [OPTIONS]
 # Gets the status of the given pid started by the guest-agent
 qm guest exec-status your-vm-id <pid>
 # Sets the password for the given user to the given password
 qm guest passwd your-vm-id <username> [OPTIONS]
 ```
 ### PV, VG, LV Management
 ```shell
 # Create a PV
 pvcreate <disk-device-name>
 # Remove a PV
 pvremove <disk-device-name>
 # List all PVs
 pvs
 # Create a VG
 vgcreate <vg-name> <disk-device-name>
 # Remove a VG
 vgremove <vg-name>
 # List all VGs
 vgs
 # Create a LV
 lvcreate -L <lv-size> -n <lv-name> <vg-name>
 # Remove a LV
 lvremove <vg-name>/<lv-name>
 # List all LVs
 lvs
 ```
 ### Storage Management
 ```shell
 # Create a new storage.
 pvesm add <type> <storage> [OPTIONS]
 # Allocate disk images.
 pvesm alloc <storage> your-vm-id <filename> <size> [OPTIONS]
 # Delete volume
 pvesm free <volume> [OPTIONS]
 # Delete storage configuration.
 pvesm remove <storage>
 # Update storage configuration.
 pvesm set <storage> [OPTIONS]
 # List storage content.
 pvesm list <storage> [OPTIONS]
 # Get the filesystem path for a specified volume.
 pvesm path <volume>
 # Prune backups on a storage (standard naming scheme only).
 pvesm prune-backups <storage> [OPTIONS]
 # Extract configuration from a vzdump backup archive.
 pvesm extractconfig <volume>
 # Returns the storage API version and age.
 pvesm apiinfo
 # An alias for pvesm scan lvm.
 pvesm lvmscan
 # An alias for pvesm scan lvmthin.
 pvesm lvmthinscan
 # List local LVM volume groups.
 pvesm scan lvm
 # List local LVM Thin Pools.
 pvesm scan lvmthin <vg>
 # Get status for all datastores.
 pvesm status [OPTIONS]
 ```
 ### Template Management
 ```shell
 # list all templates
 pveam available
 # list all templates
 pveam list <storage>
 # Download appliance templates
 pveam download <storage> <template>
 # Remove a template.
 pveam remove <template-path>
 # Update Container Template Database.
 pveam update
 ```
 ## Certificate Management
 See the [Proxmox Certificate Management](proxmox-certificate-management.md) cheat sheet.
 ## Container Management
 ```shell
 # List containers
 pct list
 # Create or restore a container.
 pct create your-vm-id <ostemplate> [OPTIONS]
 # Start the container.
 pct start your-vm-id [OPTIONS]
 # Create a container clone/copy
 pct clone your-vm-id new-vm-id [OPTIONS]
 # Suspend the container. This is experimental.
 pct suspend your-vm-id
 # Resume the container.
 pct resume your-vm-id
 # Stop the container.
 # This will abruptly stop all processes running in the container.
 pct stop your-vm-id [OPTIONS]
 # Shutdown the container.
 # This will trigger a clean shutdown of the container, see lxc-stop(1) for details.
 pct shutdown your-vm-id [OPTIONS]
 # Destroy the container (also delete all uses files).
 pct destroy your-vm-id [OPTIONS]
 # Show CT status.
 pct status your-vm-id [OPTIONS]
 # Migrate the container to another node. Creates a new migration task.
 pct migrate your-vm-id <target> [OPTIONS]
 # Migrate the container to a remote cluster. Creates a new migration task. EXPERIMENTAL.
 pct remote-migrate your-vm-id target-endpoint --target-bridge <string> --target-storage <string> [OPTIONS]
 # Get container configuration.
 pct config your-vm-id [OPTIONS]
 # Print the list of assigned CPU sets.
 pct cpusets
 # Get container configuration, including pending changes.
 pct pending your-vm-id
 # Reboot the container by shutting it down, and starting it again. Applies pending changes.
 pct reboot your-vm-id [OPTIONS]
 # Create or restore a container.
 pct restore your-vm-id <ostemplate> [OPTIONS]
 # Set container options.
 pct set your-vm-id [OPTIONS]
 # Create a Template.
 pct template your-vm-id
 # Unlock the VM.
 pct unlock your-vm-id
 ```
 ### Container Disks
 ```shell
 # Get the container's current disk usage.
 pct df your-vm-id
 # Run a filesystem check (fsck) on a container volume.
 pct fsck your-vm-id [OPTIONS]
 # Run fstrim on a chosen CT and its mountpoints.
 pct fstrim your-vm-id [OPTIONS]
 # Mount the container's filesystem on the host.
 # This will hold a lock on the container and is meant for emergency maintenance only
 # as it will prevent further operations on the container other than start and stop.
 pct mount your-vm-id
 # Move a rootfs-/mp-volume to a different storage or to a different container.
 pct move-volume your-vm-id <volume> [<storage>] [<target-vmid>] [<target-volume>] [OPTIONS]
 # Unmount the container's filesystem.
 pct unmount your-vm-id
 # Resize a container mount point.
 pct resize your-vm-id your-vm-disk <size> [OPTIONS]
 # Rescan all storages and update disk sizes and unused disk images.
 pct rescan [OPTIONS]
 # Connect to container
 pct enter your-vm-id
 # Launch a console for the specified container.
 pct console your-vm-id [OPTIONS]
 # Launch a shell for the specified container.
 pct enter your-vm-id
 # Launch a command inside the specified container.
 pct exec your-vm-id [<extra-args>]
 # Copy a file from the container to the local system.
 pct pull your-vm-id <path> <destination> [OPTIONS]
 # Copy a local file to the container.
 pct push your-vm-id <file> <destination> [OPTIONS]
 ```
 ### Container Snapshot
 ```shell
 # Snapshot a container.
 pct snapshot your-vm-id <snapname> [OPTIONS]
 # List all snapshots.
 pct listsnapshot your-vm-id
 # Rollback LXC state to specified snapshot.
 pct rollback your-vm-id <snapname> [OPTIONS]
 # Delete a LXC snapshot.
 pct delsnapshot your-vm-id <snapname> [OPTIONS]
 ```
 ## Web GUI
 ```shell
 # Restart web GUI
 service pveproxy restart
 ```
 ## Resize Disk
 ### Increase disk size
 Increase disk size in the GUI or with the following command
 ```shell
 qm resize 100 virtio0 +5G
 ```
 ### Decrease disk size
 > Before decreasing disk sizes in Proxmox, you should take a backup!
 1. Convert qcow2 to raw: `qemu-img convert vm-100.qcow2 vm-100.raw`
 2. Shrink the disk `qemu-img resize -f raw vm-100.raw 10G`
 3. Convert back to qcow2 `qemu-img convert -p -O qcow2 vm-100.raw vm-100.qcow2`
 ## Further information
 More examples and tutorials regarding Proxmox can be found in the link list below:
 - Ansible playbook that automates Linux VM updates running on Proxmox (including snapshots): [TheDatabaseMe - update_proxmox_vm](https://github.com/thedatabaseme/update_proxmox_vm)
 - Manage Proxmox VM templates with Packer: [Use Packer to build Proxmox images](https://thedatabaseme.de/2022/10/16/what-a-golden-boy-use-packer-to-build-proxmox-images/)
@@ -0,0 +1,169 @@
 # Zsh Cheatsheet
 Reference for the new ZDOTDIR-based zsh setup (oh-my-zsh removed,
 config lives in `~/.config/zsh/`).
 ## Aliases
 ### Docker Compose
 | Alias | Expands to | What it does |
 |---|---|---|
 | `dcu` | `docker compose up -d` | Start containers in detached mode |
 | `dcd` | `docker compose down` | Stop and remove containers |
 | `dcr` | `docker compose restart` | Restart containers |
 | `dcp` | `docker compose pull` | Pull latest images |
 ### Navigation
 | Alias | Expands to | What it does |
 |---|---|---|
 | `..` | `cd ..` | Up one directory |
 | `...` | `cd ../..` | Up two directories |
 | `....` | `cd ../../..` | Up three directories |
 ### File listing
 | Alias | Expands to | What it does |
 |---|---|---|
 | `ls` | `eza -lahF --group-directories-first --time-style="+%d/%m/%Y %H:%M" --git` (falls back to plain `ls -lahF ...` if eza isn't installed) | Long listing, all files, classify symbols (`/`, `*`, `@`), directories first, custom date format, git status column |
 | `tree` | `eza --tree` (only if eza is installed) | Tree view of directory structure |
 | `cat` | `bat` (only if bat is installed) | Syntax-highlighted file viewer |
 ### System
 | Alias | Expands to | What it does |
 |---|---|---|
 | `df` | `df -h` | Disk usage, human-readable sizes |
 | `free` | `free -h` | Memory usage, human-readable sizes |
 | `c` | `clear` | Clear the terminal |
 ## Functions
 | Function | Usage | What it does |
 |---|---|---|
 | `cd` (overridden) | `cd <dir>` | Changes directory, then automatically runs `ls` (so you always see the contents of where you land). `cd` with no argument goes to `$HOME`. |
 | `mkcd` | `mkcd <dir>` | Creates a directory and `cd`s into it in one step |
 | `extract` | `extract <file>` | Extracts an archive based on its extension. Supports `.tar.gz`/`.tgz`, `.tar.bz2`, `.tar.xz`, `.zip`, `.gz` |
 | `ports` | `ports` | Shows listening ports and the processes using them (`sudo ss -tulpen`) |
 | `psg` | `psg <name>` | Searches running processes by name (case-insensitive `ps aux | grep`) |
 | `killport` | `killport <port>` | Kills whatever process is listening on the given port |
 | `logtail` | `logtail <file> [lines]` | Tails a log file (`-f`), default 50 lines, or specify a custom number |
 | `reload` | `reload` | Reloads the zsh config (`source $ZDOTDIR/.zshrc`) without restarting the shell |
 ## Keybindings
 | Key | Action | Notes |
 |---|---|---|
 | `Ctrl + →` | Move cursor forward one word | |
 | `Ctrl + ←` | Move cursor backward one word | |
 | `Ctrl + \` | Toggle autosuggestions on/off | Echoes "Autosuggestions: on/off" so you know the current state |
 | `↑` (Up arrow) | Search history backward by prefix | Type a few characters first, then press Up to find matching previous commands |
 | `↓` (Down arrow) | Search history forward by prefix | Same as above, opposite direction |
 ## Line editing (built-in zsh defaults)
 These come from zsh's default "emacs" editing mode (the standard unless
 something switches it to vi mode — this setup doesn't). Most of these
 work in any emacs-style shell (bash, zsh) and are worth building into
 muscle memory since they work everywhere.
 ### Cursor movement
 | Key | Action |
 |---|---|
 | `←` / `→` | Move cursor one character left/right |
 | `Ctrl + ←` / `Ctrl + →` | Move cursor one **word** left/right (custom binding in this setup) |
 | `Ctrl + A` | Jump to the **start** of the line |
 | `Ctrl + E` | Jump to the **end** of the line |
 | `Alt + B` | Move backward one word (alternative to Ctrl+←) |
 | `Alt + F` | Move forward one word (alternative to Ctrl+→) |
 ### Deleting / cutting text
 | Key | Action |
 |---|---|
 | `Backspace` | Delete the character **before** the cursor |
 | `Ctrl + D` / `Delete` | Delete the character **under/after** the cursor (Ctrl+D on an empty line exits the shell — careful) |
 | `Ctrl + W` | Delete the **word before** the cursor (cuts to kill-ring) |
 | `Alt + D` | Delete the **word after** the cursor (cuts to kill-ring) |
 | `Alt + Backspace` | Same as Ctrl+W — delete word before cursor |
 | `Ctrl + U` | Delete **everything before** the cursor (whole line back to start) |
 | `Ctrl + K` | Delete **everything after** the cursor (to end of line) |
 ### Pasting (yanking) deleted text
 zsh doesn't have "select text" like a GUI — instead, anything you cut
 with `Ctrl+W`, `Alt+D`, `Ctrl+U`, or `Ctrl+K` goes into a clipboard-like
 buffer (the "kill ring"), which you can paste back with:
 | Key | Action |
 |---|---|
 | `Ctrl + Y` | Paste ("yank") the last cut text at the cursor |
 **Practical example:** to move a word from the end of a command to the
 start — put cursor at end of word, `Alt + Backspace` to cut it, `Ctrl + A`
 to jump to the start of the line, `Ctrl + Y` to paste it there.
 ### Undo / retype
 | Key | Action |
 |---|---|
 | `Ctrl + _` (Ctrl + Shift + -) | Undo the last edit |
 | `Ctrl + L` | Clear the screen (same as the `c` alias, but doesn't lose scrollback the same way) |
 ### Transposing / fixing typos
 | Key | Action |
 |---|---|
 | `Ctrl + T` | Swap the two characters around the cursor (fixes a typo like `hte` → `the`) — **note:** this is overridden by fzf's Ctrl+T in this setup if fzf is installed |
 | `Alt + T` | Swap the two **words** around the cursor |
 ### Case changes
 | Key | Action |
 |---|---|
 | `Alt + U` | Uppercase the word from the cursor onward |
 | `Alt + L` | Lowercase the word from the cursor onward |
 | `Alt + C` | Capitalize the word from the cursor onward |
 ### Re-running / editing previous commands
 | Key | Action |
 |---|---|
 | `!!` | Re-run the last command (e.g. `sudo !!` re-runs the last command with sudo) |
 | `!$` | The last **argument** of the previous command (e.g. `cat !$` opens whatever file you last referenced) |
 | `Ctrl + R` (no fzf) | Reverse incremental search through history (built-in, before fzf takes over — see fzf section below for the upgraded version) |
 | `fc` | Opens the last command in `$EDITOR` (nano) for editing, then runs it |
 ## Fuzzy search (fzf)
 Only active if `fzf` is installed.
 | Key | Action | Notes |
 |---|---|---|
 | `Ctrl + R` | Fuzzy search command history | Type to filter, select a command, it's inserted at the cursor. This overrides the built-in reverse search mentioned above |
 | `Ctrl + F` | Fuzzy file search (includes hidden files, excludes `.git`) | Selected file path is inserted at the cursor. Uses `fd` if installed, otherwise falls back to `find` |
 | `Ctrl + T` | Fuzzy file search (fzf's built-in, non-hidden files) | Only active if fzf's own shell integration is found on the system; uses `fd` for speed if installed. This overrides the built-in character-transpose shortcut mentioned above |
 ## Plugins (auto-loaded on shell startup)
 These are cloned automatically into `$ZDOTDIR/plugins/` the first time
 you start a shell after the role runs — no manual setup needed.
 | Plugin | What it does |
 |---|---|
 | `zsh-autosuggestions` | Shows a greyed-out suggestion as you type, based on history. Press `→` (right arrow) or `End` to accept it |
 | `fast-syntax-highlighting` | Colors commands as you type — valid commands, paths, strings, etc. get different colors so you can spot typos before pressing Enter |
 ## Environment / history
 - History file: `~/.local/state/zsh/history`
 - History size: 10,000 commands
 - History behavior: shared across sessions, duplicates ignored, commands
  starting with a space aren't recorded (`HIST_IGNORE_SPACE`)
 - Default editor: `nano` (`$EDITOR` / `$VISUAL`)
 - Config location: `$ZDOTDIR` = `~/.config/zsh/`
 - Per-host extra env vars (e.g. `VAULT_ADDR`) are set via `zsh_extra_env`
  in Ansible host_vars, appended to `env.zsh`
 ## Startup
 `fastfetch` runs automatically every time a new shell opens, showing
 system info (OS, kernel, uptime, packages, etc.) above the prompt.