What LexiVirt does

Fleet1.8.1

Every LexiVirt cluster this console manages, read live from each one: capacity added up, alerts in one feed, and a search that finds a virtual machine without opening each console in turn. A cluster is registered with its URL and an API key it issues itself, so its own roles decide what the fleet may do and its own audit log records it.

Limits: Reads and reports. No cross-cluster migration, no policy pushed into a peer, no capacity planning across clusters.

Clusters1.7.0

This console's own cluster: which nodes are in it, what they add up to, and where each virtual machine sits. Health is derived from what the nodes report, never asserted.

Nodes1.0

The machines that actually run virtual machines. Each runs a small agent the console talks to over an authenticated channel. A node that refuses the console says which of the three reasons it is — a wrong secret, a secret it generated itself, or one it cannot keep between restarts — because those have different fixes.

What it includes

• Maintenance mode: a node in maintenance receives no new VMs.
• Move every VM off this node: each VM goes to the node with the most room — live where its disks are shared, copied where they are not.

Virtual machines1.0

Create, start, stop, clone and resize KVM guests. Boot from an uploaded ISO or a cloud image, give them several network cards, set CPU topology, and open a console in the browser — including pasting text into guests that have no clipboard.

What it includes

• Create one VM or up to fifty in one pass: a batch is named web-01, web-02 … and placed by the scheduler on whichever nodes have room.
• Templates: save the whole Create VM configuration under a name — from the last step of the wizard, or from an existing VM's tools — and start the next VM from it in one click.
• Cloud-init for cloud images: a user, a password or SSH key, a host name and one command to run on first boot, delivered on a small seed disk the guest finds by itself.
• Several network cards per VM, each on its own network and optionally with a fixed address; CPU topology as sockets × cores.
• UEFI or BIOS chosen from the installer itself: an ISO that cannot boot under UEFI gets BIOS, so an arbitrary installer does not stop at a blank screen.
• Move to another node: live when every disk is on shared NFS storage, otherwise shut down, copied and started there — nothing is deleted until the copy runs.
• Export a VM to one .lexivirt.tar file in the image library and Import it from there; clone a VM; resize CPU, memory and disks while it is off.
• The image library downloads an image from a URL to every node (with an optional sha256 check) and converts VMware, Hyper-V and VirtualBox disks — VMDK, VHD, VHDX, VDI, OVA — to qcow2.

Containers1.7.4

OCI containers beside virtual machines, on whichever runtime a node already has — Podman first because it is daemonless, then Docker. A node with neither says which package to install rather than reporting an empty list.

Limits: A memory and CPU ceiling is required. An unbounded container can take the host, and on a hypervisor that takes every virtual machine on it too.

GPU1.7.2

Discovers the graphics and compute cards on each node and passes a whole card through to one virtual machine. The page states which cards are bound to a passthrough driver and which are still held by the host.

Limits: Whole-card passthrough only. No vGPU, no time-slicing, no sharing one card between guests.

Storage1.0

Where a virtual machine's disk lives on each node: the node's own disk, another mounted directory, an NFS export, or an LVM volume group. A VM picks its container when it is created.

Limits: No distributed storage. Shared storage is an NFS export you provide, and high availability and live migration both need one.

Volumes1.6

Disks that belong to no single machine: attach one to several at once for a cluster's quorum disk or shared data. On a shared container it is one disk every node sees.

Snapshots1.5

Point-in-time copies of a virtual machine's disks, taken while it is off, including its firmware variables. Roll one back or clone from it.

Limits: Offline only. A snapshot of a running guest is not taken, because a disk copied mid-write is not a copy you can trust.

Backups and recovery points1.5

A schedule that takes recovery points of a set of virtual machines and keeps the last N of them. Restores are done from the same page.

What it includes

• Recovery points are taken while the VM runs. With the QEMU guest agent answering they are application-consistent — the guest flushes and freezes its filesystems first; without it they are crash-consistent, and each one is labelled as such.
• Retention per policy: the newest N are kept and older ones are removed.
• Export (in the VM's tools) writes a whole VM to a single file you can copy off the node.

Limits: Recovery points live on the node they protect, so losing that node loses them. There is no off-node repository and no automatic restore verification.

Networks1.0

Bridged and NAT networks on each node, VLAN-tagged segments, and DHCP reservations that pin a guest to an address.

What it includes

• A fixed address can be given per network card right in the Create VM wizard; it is reserved on that network's own DHCP server, and in a batch it steps by one per VM.
• Four kinds of network: NAT (outbound only), isolated (guests only), LAN (on the nodes' own network) and bridged, optionally VLAN-tagged.
• A network is validated on every node before it is created, so a bridge missing on one host is reported instead of discovered later.

Overlay networks1.7.3

A VXLAN segment that spans nodes, so virtual machines on different hosts share one layer-2 network without touching the physical switches. Peers are set up from the console and the MTU is lowered to leave room for the encapsulation.

Limits: Unencrypted. VXLAN carries the frames as they are, so the underlying network has to be one you trust.

Firewall1.7.2

Rules that open and block traffic between virtual machines, compiled to an nftables ruleset and pushed to every node. Rules name machines, and names are resolved against the live cluster on every apply, because an address learned an hour ago may belong to a different guest now.

Limits: A node without nftables cannot enforce, and the readiness report names it rather than letting the console believe a rule is in force everywhere.

Load balancer1.7.4

One address and port spread over several backends, as destination NAT in the kernel's connection tracker. Round-robin or source affinity.

Limits: Layer 4, and the page says so: it balances TCP and UDP connections and knows nothing about requests, paths, headers or TLS. There is no health checking — a backend that is down still receives its share.

Monitoring1.4

CPU, memory and disk per node and per virtual machine, recorded over time, with a capacity runway derived from what was actually measured.

Alerts1.4

What is wrong now, most severe first, with the reason and the fix. A message goes out once per problem — and again if it gets worse — never repeatedly for the same thing.

What it includes

• Delivery by e-mail (any SMTP server, STARTTLS or SSL) and by webhook in Slack, Microsoft Teams or plain JSON format.
• A minimum severity decides what is sent; each problem is sent once, and again only if it gets worse.
• Failed deliveries are retried, and the settings page shows whether the last attempt worked.

Tasks1.3

Everything slow — clones, image copies, migrations, backups, updates — runs as a task with progress and history, rather than holding a request open.

High availability1.7.3

A virtual machine marked for HA is restarted on another node when its own is lost — after a second node confirms it cannot reach the first, so a console that merely lost its own network does not fail everything over. When the lost node returns, the copy there is stopped and taken off autostart before it can write to the same disks. That obligation is written to the database with the failover itself, so it survives the console restarting.

Limits: Only virtual machines whose disks are on shared storage, and fencing goes through the returning node's own agent — a node whose agent is dead but whose guests are running cannot be fenced.

Kubernetes1.7.5

Builds a k3s cluster out of virtual machines from a cloud image, and fetches the kubeconfig back for you.

Limits: Provisioning only. There is no workload view, no upgrade path and no reconciliation — once it is built, it is an ordinary k3s cluster you manage with kubectl.

AI agents1.8.3

The console is an MCP server, so Claude Code, Codex, Agent Zero, Hermes, OpenCLAO or any other Model Context Protocol client can read and operate a cluster with nothing installed on the agent's machine: a URL and an API key are enough. One button creates the key and downloads a finished configuration. Every tool call goes through the console's own API with that key, so its role decides what the agent may do and every action appears in the audit log under it.

Limits: Read-only unless the address ends in ?write=1, and there is no tool that deletes anything and no command execution at all — by choice, not omission.

HCI console1.9.0

A console for whoever runs the infrastructure rather than the virtual machines, on a port of its own (9440 by default) so it can be firewalled to the management network. Installing or updating LexiVirt sets that port up by itself. One page answers: is the cluster healthy, could it lose a node, when does it run out of room, what is each node and storage pool doing, what is alerting, what is running right now and which version is each part on. It reads the console's own API and uses the same sign-in, for administrators and operators; a viewer is told it is not for them. A figure that could not be collected is shown as unknown, never as zero, and when the console stops answering the page keeps the last data it had under a banner that says so.

Limits: Read-only. The node-failure check is about memory for the cluster as a whole: it does not look at disks, CPU or the network and does not check that a particular virtual machine fits in one node's remainder. A runway is a straight line through recorded history, for memory and the system disk only — not a forecast. Storage figures are what each node agent reports for its own containers; there is no physical-disk inventory. The same API also answers on the VM console's port, so the allow-list on the management port narrows what is exposed there and does not replace the sign-in. Setting the port up takes root: the default install has it, while a console moved to an unprivileged account prints the one command to run in its update log instead. The page is in English only.

Projects1.6

Group virtual machines and the people who may touch them, so one team's machines are not another team's to start, stop or delete.

Users and roles1.0

Local accounts in three roles — administrator, operator and viewer — with optional two-factor authentication. The role is read from the database on every request, so demoting somebody takes effect at once.

What it includes

• Two-factor sign-in with any authenticator app (TOTP). Turning it on takes a working code, and eight one-time recovery codes are issued with it, stored hashed.
• An administrator can clear two-factor for someone who has lost both their phone and their recovery codes; it is written to the audit log.

Limits: Accounts are local to the installation. There is no LDAP, Active Directory or SAML.

Security1.6

API keys for scripts and agents, each with its own role and revocable on its own, and the recent activity on the installation in one place.

What it includes

• A REST API for everything the console does, under /api/v1/. The interactive reference is at /api/docs on your own console, for anyone signed in.
• Scripts authenticate with an API key sent as Authorization: Bearer <key>. Only a hash of the key is stored, and it is shown once.
• Each key has its own role — a read-only integration gets a viewer key — and each can be revoked on its own.

Limits: There is no LexiVirt command-line tool and no Terraform provider or Ansible collection: automation calls the HTTP API directly, with curl or any HTTP library.

Audit log1.2

Who did what, when, and from where — written per action by the console that performed it. Actions on a node are recorded by that node, not copied here: two logs that disagree are worse than one in the right place.

Files1.5

A shared drive for administrators: upload a file from one machine and download it from another, with nothing but the console sign-in. Installer ISOs and cloud images are not kept here — they have their own library on the Nodes page, which takes them once and relays them to every node chunk by chunk, so the console never holds a whole image in memory.

Terminal1.6

A shell on the console host, in the browser, as the account the console runs as — not as root, once the console has been moved onto its own unprivileged account.

Settings1.4

Thresholds for alerts, notification delivery, session length, appearance, what each node is told about time and name servers, and what this installation reports about itself.

What it includes

• An address allowlist for the console. It has to include the address of whoever saves it, so nobody locks themselves out.
• Cluster lockdown: SSH to every node by key only. It is refused on a node whose root account has no authorized key.
• Session length from 1 hour to 30 days, a minimum password length from 10 to 72 characters, an optional rule that a password mixes letters and digits, and a sign-in banner.

Updates1.2

One pass updates the console and every node agent it can reach, each reported by name. The page shows which version is running against which is installed, because an update that synced files and never restarted is the failure that silently voids every fix in it.

What it includes

• Versions, from 1.9.2: install any published release from 1.8.0 on, newer or older, on the whole cluster, on the console alone, or on one node. Going back is the same operation as going forward.
• Before every version change the console saves a snapshot of its own code and keeps the last five; putting one back works without reaching the update server.
• Upload a release package for a console that should not download from the internet. One identical to a published release is that release; anything else is an unofficial build, which may go on the console only, after its version is typed to confirm.
• A node taken back to an older version is held there, so the hourly pass does not bring it forward again, until someone installs the newest or releases the hold. Going back on the console turns automatic updates off for the same reason.

Limits: Node agents install published releases only, and nothing older than 1.8.0 is offered. The database is never rolled back: schema changes only add, so an older console reads a newer database.

Readiness1.0

What stands between this installation and running its first virtual machine: each finding with its severity, why it matters and the command that fixes it. A check that cannot say what to do is left out.