update static data and schema definitions

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

pct.1-synopsis.adoc

@@ -124,7 +124,7 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
-`--features` `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`--features` `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
@@ -238,7 +238,7 @@ NOTE: Requires option(s): `restore`
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`--unused[n]` `<string>` ::
+`--unused[n]` `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
@@ -266,9 +266,13 @@ Destroy the container (also delete all uses files).
 
 The (unique) ID of the VM.
 
-`--purge` `<boolean>` ::
+`--force` `<boolean>` ('default =' `0`)::
 
-Remove vmid from backup cron jobs.
+Force destroy, even if running.
+
+`--purge` `<boolean>` ('default =' `0`)::
+
+Remove container from all related configurations. For example, backup jobs, replication jobs or HA. Related ACLs and Firewall entries will *always* be removed.
 
 *pct df* `<vmid>`
 
@@ -573,7 +577,7 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
-`--features` `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`--features` `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
@@ -683,7 +687,7 @@ NOTE: Requires option(s): `restore`
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`--unused[n]` `<string>` ::
+`--unused[n]` `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
@@ -755,7 +759,7 @@ Container description. Only used on the configuration web interface.
 
 Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
 
-`--features` `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`--features` `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
@@ -835,7 +839,7 @@ Specify the number of tty available to the container
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`--unused[n]` `<string>` ::
+`--unused[n]` `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 

pct.conf.5-opts.adoc

@@ -30,10 +30,14 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
-`features`: `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`features`: `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
+`force_rw_sys`=`<boolean>` ('default =' `0`);;
+
+Mount /sys in unprivileged containers as `rw` instead of `mixed`. This can break networking under newer (>= v245) systemd-network use.
+
 `fuse`=`<boolean>` ('default =' `0`);;
 
 Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
@@ -42,6 +46,10 @@ Allow using 'fuse' file systems in a container. Note that interactions between f
 
 For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
 
+`mknod`=`<boolean>` ('default =' `0`);;
+
+Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.
+
 `mount`=`<fstype;fstype;...>` ;;
 
 Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
@@ -252,7 +260,11 @@ Specify the number of tty available to the container
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`unused[n]`: `<string>` ::
+`unused[n]`: `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
+`volume`=`<volume>` ;;
+
+The volume that is not used currently.
+

pveceph.1-synopsis.adoc

@@ -262,11 +262,11 @@ List all pools.
 
 Destroy ceph related data and configuration files.
 
-*pveceph start* `[<service>]`
+*pveceph start* `[OPTIONS]`
 
 Start ceph services.
 
-`<service>`: `(ceph|mon|mds|osd|mgr)\.[A-Za-z0-9\-]{1,32}` ('default =' `ceph.target`)::
+`--service` `(ceph|mon|mds|osd|mgr)(\.[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?)?` ('default =' `ceph.target`)::
 
 Ceph service name.
 
@@ -274,11 +274,11 @@ Ceph service name.
 
 Get ceph status.
 
-*pveceph stop* `[<service>]`
+*pveceph stop* `[OPTIONS]`
 
 Stop ceph services.
 
-`<service>`: `(ceph|mon|mds|osd|mgr)\.[A-Za-z0-9\-]{1,32}` ('default =' `ceph.target`)::
+`--service` `(ceph|mon|mds|osd|mgr)(\.[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?)?` ('default =' `ceph.target`)::
 
 Ceph service name.
 

pvecm.1-synopsis.adoc

@@ -18,7 +18,7 @@ Do not throw error if node already exists.
 
 `--link[n]` `[address=]<IP> [,priority=<integer>]` ::
 
-Address and priority information of a single corosync link.
+Address and priority information of a single corosync link. (up to 8 links supported; link0..link7)
 
 `--nodeid` `<integer> (1 - N)` ::
 
@@ -40,13 +40,21 @@ Adds a node to the cluster configuration. This call is for internal use.
 
 The cluster node name.
 
+`--apiversion` `<integer>` ::
+
+The JOIN_API_VERSION of the new node.
+
 `--force` `<boolean>` ::
 
 Do not throw error if node already exists.
 
 `--link[n]` `[address=]<IP> [,priority=<integer>]` ::
 
-Address and priority information of a single corosync link.
+Address and priority information of a single corosync link. (up to 8 links supported; link0..link7)
+
+`--new_node_ip` `<string>` ::
+
+IP Address of node to add. Used as fallback if no links are given.
 
 `--nodeid` `<integer> (1 - N)` ::
 
@@ -56,9 +64,14 @@ Node id for this node.
 
 Number of votes for this node
 
+*pvecm apiver*
+
+Return the version of the cluster join API available on this node.
+
 *pvecm create* `<clustername>` `[OPTIONS]`
 
-Generate new cluster configuration.
+Generate new cluster configuration. If no links given, default to local IP
+address as link0.
 
 `<clustername>`: `<string>` ::
 
@@ -66,7 +79,7 @@ The name of the cluster.
 
 `--link[n]` `[address=]<IP> [,priority=<integer>]` ::
 
-Address and priority information of a single corosync link.
+Address and priority information of a single corosync link. (up to 8 links supported; link0..link7)
 
 `--nodeid` `<integer> (1 - N)` ::
 

pvenode.1-synopsis.adoc

@@ -69,6 +69,98 @@ Force renewal even if expiry is more than 30 days away.
 
 Revoke existing certificate from CA.
 
+*pvenode acme plugin add* `<type> <id>` `[OPTIONS]`
+
+Add ACME plugin configuration.
+
+`<type>`: `<dns | standalone>` ::
+
+ACME challenge type.
+
+`<id>`: `<string>` ::
+
+ACME Plugin ID name
+
+`--api` `<acmedns | acmeproxy | active24 | ad | ali | autodns | aws | azure | cf | clouddns | cloudns | cn | conoha | constellix | cx | cyon | da | ddnss | desec | dgon | dnsimple | do | doapi | domeneshop | dp | dpi | dreamhost | duckdns | durabledns | dyn | dynu | dynv6 | easydns | euserv | exoscale | freedns | gandi_livedns | gcloud | gd | gdnsdk | he | hexonet | hostingde | infoblox | internetbs | inwx | ispconfig | jd | kas | kinghost | knot | leaseweb | lexicon | linode | linode_v4 | loopia | lua | maradns | me | miab | misaka | myapi | mydevil | mydnsjp | namecheap | namecom | namesilo | nederhost | neodigit | netcup | nic | nsd | nsone | nsupdate | nw | one | online | openprovider | opnsense | ovh | pdns | pleskxml | pointhq | rackspace | rcode0 | regru | schlundtech | selectel | servercow | tele3 | ultra | unoeuro | variomedia | vscale | vultr | yandex | zilore | zone | zonomi>` ::
+
+API plugin name
+
+`--data` `File with one key-value pair per line, will be base64url encode for storage in plugin config.` ::
+
+DNS plugin data. (base64 encoded)
+
+`--disable` `<boolean>` ::
+
+Flag to disable the config.
+
+`--nodes` `<string>` ::
+
+List of cluster node names.
+
+`--validation-delay` `<integer> (0 - 172800)` ('default =' `30`)::
+
+Extra delay in seconds to wait before requesting validation. Allows to cope with a long TTL of DNS records.
+
+*pvenode acme plugin config* `<id>` `[FORMAT_OPTIONS]`
+
+Get ACME plugin configuration.
+
+`<id>`: `<string>` ::
+
+Unique identifier for ACME plugin instance.
+
+*pvenode acme plugin list* `[OPTIONS]` `[FORMAT_OPTIONS]`
+
+ACME plugin index.
+
+`--type` `<dns | standalone>` ::
+
+Only list ACME plugins of a specific type
+
+*pvenode acme plugin remove* `<id>`
+
+Delete ACME plugin configuration.
+
+`<id>`: `<string>` ::
+
+Unique identifier for ACME plugin instance.
+
+*pvenode acme plugin set* `<id>` `[OPTIONS]`
+
+Update ACME plugin configuration.
+
+`<id>`: `<string>` ::
+
+ACME Plugin ID name
+
+`--api` `<acmedns | acmeproxy | active24 | ad | ali | autodns | aws | azure | cf | clouddns | cloudns | cn | conoha | constellix | cx | cyon | da | ddnss | desec | dgon | dnsimple | do | doapi | domeneshop | dp | dpi | dreamhost | duckdns | durabledns | dyn | dynu | dynv6 | easydns | euserv | exoscale | freedns | gandi_livedns | gcloud | gd | gdnsdk | he | hexonet | hostingde | infoblox | internetbs | inwx | ispconfig | jd | kas | kinghost | knot | leaseweb | lexicon | linode | linode_v4 | loopia | lua | maradns | me | miab | misaka | myapi | mydevil | mydnsjp | namecheap | namecom | namesilo | nederhost | neodigit | netcup | nic | nsd | nsone | nsupdate | nw | one | online | openprovider | opnsense | ovh | pdns | pleskxml | pointhq | rackspace | rcode0 | regru | schlundtech | selectel | servercow | tele3 | ultra | unoeuro | variomedia | vscale | vultr | yandex | zilore | zone | zonomi>` ::
+
+API plugin name
+
+`--data` `File with one key-value pair per line, will be base64url encode for storage in plugin config.` ::
+
+DNS plugin data. (base64 encoded)
+
+`--delete` `<string>` ::
+
+A list of settings you want to delete.
+
+`--digest` `<string>` ::
+
+Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
+
+`--disable` `<boolean>` ::
+
+Flag to disable the config.
+
+`--nodes` `<string>` ::
+
+List of cluster node names.
+
+`--validation-delay` `<integer> (0 - 172800)` ('default =' `30`)::
+
+Extra delay in seconds to wait before requesting validation. Allows to cope with a long TTL of DNS records.
+
 *pvenode cert delete* `[<restart>]`
 
 DELETE custom certificate chain and key.
@@ -105,7 +197,7 @@ Restart pveproxy.
 
 Get node configuration options.
 
-`--property` `<acme | description | startall-onboot-delay | wakeonlan>` ('default =' `all`)::
+`--property` `<acme | acmedomain0 | acmedomain1 | acmedomain2 | acmedomain3 | acmedomain4 | acmedomain5 | description | startall-onboot-delay | wakeonlan>` ('default =' `all`)::
 
 Return only a specific property from the node configuration.
 
@@ -113,10 +205,14 @@ Return only a specific property from the node configuration.
 
 Set node configuration options.
 
-`--acme` `domains=<domain[;domain;...]> [,account=<name>]` ::
+`--acme` `[account=<name>] [,domains=<domain[;domain;...]>]` ::
 
 Node specific ACME settings.
 
+`--acmedomain[n]` `[domain=]<domain> [,alias=<domain>] [,plugin=<name of the plugin configuration>]` ::
+
+ACME domain and validation plugin
+
 `--delete` `<string>` ::
 
 A list of settings you want to delete.

pvesm.1-synopsis.adoc

@@ -4,7 +4,7 @@
 
 Create a new storage.
 
-`<type>`: `<cephfs | cifs | dir | drbd | glusterfs | iscsi | iscsidirect | lvm | lvmthin | nfs | rbd | zfs | zfspool>` ::
+`<type>`: `<cephfs | cifs | dir | drbd | glusterfs | iscsi | iscsidirect | lvm | lvmthin | nfs | pbs | rbd | zfs | zfspool>` ::
 
 Storage type.
 
@@ -42,6 +42,10 @@ Allowed content types.
 +
 NOTE: the value 'rootdir' is used for Containers, and value 'images' for VMs.
 
+`--datastore` `<string>` ::
+
+Proxmox backup server datastore name.
+
 `--disable` `<boolean>` ::
 
 Flag to disable the storage.
@@ -54,6 +58,10 @@ CIFS domain.
 
 NFS export path.
 
+`--fingerprint` `([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}` ::
+
+Certificate SHA 256 fingerprint.
+
 `--format` `<string>` ::
 
 Default image format.
@@ -218,6 +226,10 @@ no description available
 +
 NOTE: Requires option(s): `size`
 
+*pvesm apiinfo*
+
+Returns APIVER and APIAGE.
+
 *pvesm cifsscan*
 
 An alias for 'pvesm scan cifs'.
@@ -306,6 +318,10 @@ Import stream format
 
 Source file name. For '-' stdin is used, the tcp://<IP-or-CIDR> format allows to use a TCP connection as input. Else, the file is treated as common file.
 
+`--allow-rename` `<boolean>` ('default =' `0`)::
+
+Choose a new volume ID if the requested volume ID already exists, instead of throwing an error.
+
 `--base` `(?^:[a-z0-9_\-]{1,40})` ::
 
 Base snapshot of an incremental stream
@@ -472,6 +488,10 @@ Flag to disable the storage.
 
 CIFS domain.
 
+`--fingerprint` `([A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}` ::
+
+Certificate SHA 256 fingerprint.
+
 `--format` `<string>` ::
 
 Default image format.

pvesr.1-synopsis.adoc

@@ -30,7 +30,7 @@ Mark the replication job for removal. The job will remove all local replication
 
 `--schedule` `<string>` ('default =' `*/15`)::
 
-Storage replication schedule. The format is a subset of `systemd` calender events.
+Storage replication schedule. The format is a subset of `systemd` calendar events.
 
 `--source` `<string>` ::
 
@@ -224,7 +224,7 @@ Mark the replication job for removal. The job will remove all local replication
 
 `--schedule` `<string>` ('default =' `*/15`)::
 
-Storage replication schedule. The format is a subset of `systemd` calender events.
+Storage replication schedule. The format is a subset of `systemd` calendar events.
 
 `--source` `<string>` ::
 

pveum.1-synopsis.adoc

@@ -136,6 +136,284 @@ Change user password.
 
 User ID
 
+*pveum realm add* `<realm> --type <string>` `[OPTIONS]`
+
+Add an authentication server.
+
+`<realm>`: `<string>` ::
+
+Authentication domain ID
+
+`--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP base domain name
+
+`--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP bind domain name
+
+`--capath` `<string>` ('default =' `/etc/ssl/certs`)::
+
+Path to the CA certificate store
+
+`--cert` `<string>` ::
+
+Path to the client certificate
+
+`--certkey` `<string>` ::
+
+Path to the client certificate key
+
+`--comment` `<string>` ::
+
+Description.
+
+`--default` `<boolean>` ::
+
+Use this as default realm
+
+`--domain` `\S+` ::
+
+AD domain name
+
+`--filter` `<string>` ::
+
+LDAP filter for user sync.
+
+`--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
+
+The objectclasses for groups.
+
+`--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP base domain name for group sync. If not set, the base_dn will be used.
+
+`--group_filter` `<string>` ::
+
+LDAP filter for group sync.
+
+`--group_name_attr` `<string>` ::
+
+LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
+
+`--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
+
+LDAP protocol mode.
+
+`--password` `<string>` ::
+
+LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
+
+`--port` `<integer> (1 - 65535)` ::
+
+Server port.
+
+`--secure` `<boolean>` ::
+
+Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
+
+`--server1` `<string>` ::
+
+Server IP address (or DNS name)
+
+`--server2` `<string>` ::
+
+Fallback Server IP address (or DNS name)
+
+`--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
+
+LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
+
+`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
+
+The default options for behavior of synchronizations.
+
+`--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
+
+`--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
+
+Use Two-factor authentication.
+
+`--type` `<ad | ldap | pam | pve>` ::
+
+Realm type.
+
+`--user_attr` `\S{2,}` ::
+
+LDAP user attribute name
+
+`--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
+
+The objectclasses for users.
+
+`--verify` `<boolean>` ('default =' `0`)::
+
+Verify the server's SSL certificate
+
+*pveum realm delete* `<realm>`
+
+Delete an authentication server.
+
+`<realm>`: `<string>` ::
+
+Authentication domain ID
+
+*pveum realm list* `[FORMAT_OPTIONS]`
+
+Authentication domain index.
+
+*pveum realm modify* `<realm>` `[OPTIONS]`
+
+Update authentication server settings.
+
+`<realm>`: `<string>` ::
+
+Authentication domain ID
+
+`--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP base domain name
+
+`--bind_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP bind domain name
+
+`--capath` `<string>` ('default =' `/etc/ssl/certs`)::
+
+Path to the CA certificate store
+
+`--cert` `<string>` ::
+
+Path to the client certificate
+
+`--certkey` `<string>` ::
+
+Path to the client certificate key
+
+`--comment` `<string>` ::
+
+Description.
+
+`--default` `<boolean>` ::
+
+Use this as default realm
+
+`--delete` `<string>` ::
+
+A list of settings you want to delete.
+
+`--digest` `<string>` ::
+
+Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.
+
+`--domain` `\S+` ::
+
+AD domain name
+
+`--filter` `<string>` ::
+
+LDAP filter for user sync.
+
+`--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
+
+The objectclasses for groups.
+
+`--group_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+LDAP base domain name for group sync. If not set, the base_dn will be used.
+
+`--group_filter` `<string>` ::
+
+LDAP filter for group sync.
+
+`--group_name_attr` `<string>` ::
+
+LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
+
+`--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
+
+LDAP protocol mode.
+
+`--password` `<string>` ::
+
+LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
+
+`--port` `<integer> (1 - 65535)` ::
+
+Server port.
+
+`--secure` `<boolean>` ::
+
+Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
+
+`--server1` `<string>` ::
+
+Server IP address (or DNS name)
+
+`--server2` `<string>` ::
+
+Fallback Server IP address (or DNS name)
+
+`--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
+
+LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
+
+`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
+
+The default options for behavior of synchronizations.
+
+`--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
+
+Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
+
+`--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
+
+Use Two-factor authentication.
+
+`--user_attr` `\S{2,}` ::
+
+LDAP user attribute name
+
+`--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
+
+The objectclasses for users.
+
+`--verify` `<boolean>` ('default =' `0`)::
+
+Verify the server's SSL certificate
+
+*pveum realm sync* `<realm>` `[OPTIONS]`
+
+Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
+Synced groups will have the name 'name-$realm', so make sure those groups
+do not exist to prevent overwriting.
+
+`<realm>`: `<string>` ::
+
+Authentication domain ID
+
+`--dry-run` `<boolean>` ('default =' `0`)::
+
+If set, does not write anything.
+
+`--enable-new` `<boolean>` ('default =' `1`)::
+
+Enable newly synced users immediately.
+
+`--full` `<boolean>` ::
+
+If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync. Otherwise only syncs information which is not already present, and does not deletes or modifies anything else.
+
+`--purge` `<boolean>` ::
+
+Remove ACLs for users or groups which were removed from the config during a sync.
+
+`--scope` `<both | groups | users>` ::
+
+Select what to sync.
+
 *pveum role add* `<roleid>` `[OPTIONS]`
 
 Create new role.

qm.1-synopsis.adoc

@@ -121,7 +121,7 @@ Virtual processor architecture. Defaults to the host.
 
 `--archive` `<string>` ::
 
-The backup file.
+The backup archive. Either the file system path to a .tar or .vma file (use '-' to pipe data from stdin) or a proxmox storage backup volume identifier.
 
 `--args` `<string>` ::
 
@@ -179,7 +179,7 @@ cloud-init: User name to change ssh keys and password for instead of the image's
 
 The number of cores per socket.
 
-`--cpu` `[cputype=]<enum> [,flags=<+FLAG[;-FLAG...]>] [,hidden=<1|0>] [,hv-vendor-id=<vendor-id>]` ::
+`--cpu` `<string>` ::
 
 Emulated CPU type.
 
@@ -320,6 +320,10 @@ Sets the protection flag of the VM. This will disable the remove VM and remove d
 
 Allow reboot. If set to '0' the VM exit on reboot.
 
+`--rng0` `[source=]</dev/urandom|/dev/random|/dev/hwrng> [,max_bytes=<integer>] [,period=<integer>]` ::
+
+Configure a VirtIO-based Random Number Generator.
+
 `--sata[n]` `[file=]<volume> [,aio=<native|threads>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]` ::
 
 Use volume as SATA hard disk or CD-ROM (n is 0 to 5).
@@ -402,7 +406,7 @@ Assign a unique random ethernet address.
 +
 NOTE: Requires option(s): `archive`
 
-`--unused[n]` `<string>` ::
+`--unused[n]` `[file=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
@@ -490,6 +494,10 @@ The (unique) ID of the VM.
 
 Extra arguments as array
 
+`--pass-stdin` `<boolean>` ('default =' `0`)::
+
+When set, read STDIN until EOF and forward to guest agent via 'input-data' (usually treated as STDIN to process launched by guest agent). Allows maximal 1 MiB.
+
 `--synchronous` `<boolean>` ('default =' `1`)::
 
 If set to off, returns the pid immediately instead of waiting for the commmand to finish or the timeout.
@@ -633,7 +641,7 @@ Use online/live migration if VM is running. Ignored if VM is stopped.
 
 `--targetstorage` `<string>` ::
 
-Default target storage.
+Mapping from source to target storages. Providing only a single storage ID maps all source storages to that storage. Providing the special value '1' will map each source storage to itself.
 
 `--with-local-disks` `<boolean>` ::
 
@@ -878,7 +886,7 @@ cloud-init: User name to change ssh keys and password for instead of the image's
 
 The number of cores per socket.
 
-`--cpu` `[cputype=]<enum> [,flags=<+FLAG[;-FLAG...]>] [,hidden=<1|0>] [,hv-vendor-id=<vendor-id>]` ::
+`--cpu` `<string>` ::
 
 Emulated CPU type.
 
@@ -1027,6 +1035,10 @@ Allow reboot. If set to '0' the VM exit on reboot.
 
 Revert a pending change.
 
+`--rng0` `[source=]</dev/urandom|/dev/random|/dev/hwrng> [,max_bytes=<integer>] [,period=<integer>]` ::
+
+Configure a VirtIO-based Random Number Generator.
+
 `--sata[n]` `[file=]<volume> [,aio=<native|threads>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]` ::
 
 Use volume as SATA hard disk or CD-ROM (n is 0 to 5).
@@ -1099,7 +1111,7 @@ Enable/disable time drift fix.
 
 Enable/disable Template.
 
-`--unused[n]` `<string>` ::
+`--unused[n]` `[file=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
@@ -1201,6 +1213,10 @@ Start virtual machine.
 
 The (unique) ID of the VM.
 
+`--force-cpu` `<string>` ::
+
+Override QEMU's -cpu argument with the given string.
+
 `--machine` `(pc|pc(-i440fx)?-\d+(\.\d+)+(\+pve\d+)?(\.pxe)?|q35|pc-q35-\d+(\.\d+)+(\+pve\d+)?(\.pxe)?|virt(?:-\d+(\.\d+)+)?(\+pve\d+)?)` ::
 
 Specifies the Qemu machine type.
@@ -1227,7 +1243,7 @@ Some command save/restore state from this location.
 
 `--targetstorage` `<string>` ::
 
-Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)
+Mapping from source to target storages. Providing only a single storage ID maps all source storages to that storage. Providing the special value '1' will map each source storage to itself.
 
 `--timeout` `<integer> (0 - N)` ('default =' `max(30, vm memory in GiB)`)::
 

qm.conf.5-opts.adoc

@@ -98,26 +98,10 @@ cloud-init: User name to change ssh keys and password for instead of the image's
 
 The number of cores per socket.
 
-`cpu`: `[cputype=]<enum> [,flags=<+FLAG[;-FLAG...]>] [,hidden=<1|0>] [,hv-vendor-id=<vendor-id>]` ::
+`cpu`: `<string>` ::
 
 Emulated CPU type.
 
-`cputype`=`<486 | Broadwell | Broadwell-IBRS | Broadwell-noTSX | Broadwell-noTSX-IBRS | Cascadelake-Server | Conroe | EPYC | EPYC-IBPB | Haswell | Haswell-IBRS | Haswell-noTSX | Haswell-noTSX-IBRS | IvyBridge | IvyBridge-IBRS | KnightsMill | Nehalem | Nehalem-IBRS | Opteron_G1 | Opteron_G2 | Opteron_G3 | Opteron_G4 | Opteron_G5 | Penryn | SandyBridge | SandyBridge-IBRS | Skylake-Client | Skylake-Client-IBRS | Skylake-Server | Skylake-Server-IBRS | Westmere | Westmere-IBRS | athlon | core2duo | coreduo | host | kvm32 | kvm64 | max | pentium | pentium2 | pentium3 | phenom | qemu32 | qemu64>` ('default =' `kvm64`);;
-
-Emulated CPU type.
-
-`flags`=`<+FLAG[;-FLAG...]>` ;;
-
-List of additional CPU flags separated by ';'. Use '+FLAG' to enable, '-FLAG' to disable a flag. Currently supported flags: pcid, spec-ctrl, ibpb, ssbd, virt-ssbd, amd-ssbd, amd-no-ssb, pdpe1gb, md-clear, hv-tlbflush, hv-evmcs, aes.
-
-`hidden`=`<boolean>` ('default =' `0`);;
-
-Do not identify as a KVM virtual machine.
-
-`hv-vendor-id`=`<vendor-id>` ;;
-
-The Hyper-V vendor ID. Some drivers or programs inside Windows guests need a specific ID.
-
 `cpulimit`: `<number> (0 - 128)` ('default =' `0`)::
 
 Limit of CPU usage.
@@ -579,6 +563,22 @@ Sets the protection flag of the VM. This will disable the remove VM and remove d
 
 Allow reboot. If set to '0' the VM exit on reboot.
 
+`rng0`: `[source=]</dev/urandom|/dev/random|/dev/hwrng> [,max_bytes=<integer>] [,period=<integer>]` ::
+
+Configure a VirtIO-based Random Number Generator.
+
+`max_bytes`=`<integer>` ('default =' `1024`);;
+
+Maximum bytes of entropy injected into the guest every 'period' milliseconds. Prefer a lower value when using /dev/random as source. Use 0 to disable limiting (potentially dangerous!).
+
+`period`=`<integer>` ('default =' `1000`);;
+
+Every 'period' milliseconds the entropy-injection quota is reset, allowing the guest to retrieve another 'max_bytes' of entropy.
+
+`source`=`</dev/hwrng | /dev/random | /dev/urandom>` ;;
+
+The file on the host to gather entropy from. In most cases /dev/urandom should be preferred over /dev/random to avoid entropy-starvation issues on the host. Using urandom does *not* decrease security in any meaningful way, as it's still seeded from real entropy, and the bytes provided will most likely be mixed with real entropy on the guest as well. /dev/hwrng can be used to pass through a hardware RNG from the host.
+
 `sata[n]`: `[file=]<volume> [,aio=<native|threads>] [,backup=<1|0>] [,bps=<bps>] [,bps_max_length=<seconds>] [,bps_rd=<bps>] [,bps_rd_max_length=<seconds>] [,bps_wr=<bps>] [,bps_wr_max_length=<seconds>] [,cache=<enum>] [,cyls=<integer>] [,detect_zeroes=<1|0>] [,discard=<ignore|on>] [,format=<enum>] [,heads=<integer>] [,iops=<iops>] [,iops_max=<iops>] [,iops_max_length=<seconds>] [,iops_rd=<iops>] [,iops_rd_max=<iops>] [,iops_rd_max_length=<seconds>] [,iops_wr=<iops>] [,iops_wr_max=<iops>] [,iops_wr_max_length=<seconds>] [,mbps=<mbps>] [,mbps_max=<mbps>] [,mbps_rd=<mbps>] [,mbps_rd_max=<mbps>] [,mbps_wr=<mbps>] [,mbps_wr_max=<mbps>] [,media=<cdrom|disk>] [,replicate=<1|0>] [,rerror=<ignore|report|stop>] [,secs=<integer>] [,serial=<serial>] [,shared=<1|0>] [,size=<DiskSize>] [,snapshot=<1|0>] [,ssd=<1|0>] [,trans=<none|lba|auto>] [,werror=<enum>] [,wwn=<wwn>]` ::
 
 Use volume as SATA hard disk or CD-ROM (n is 0 to 5).
@@ -1047,10 +1047,14 @@ Enable/disable time drift fix.
 
 Enable/disable Template.
 
-`unused[n]`: `<string>` ::
+`unused[n]`: `[file=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
+`file`=`<volume>` ;;
+
+The drive's backing volume.
+
 `usb[n]`: `[host=]<HOSTUSBDEVICE|spice> [,usb3=<1|0>]` ::
 
 Configure an USB device (n is 0 to 4).

vzdump.1-synopsis.adoc

@@ -16,7 +16,7 @@ Backup all known guest systems on this host.
 
 Limit I/O bandwidth (KBytes per second).
 
-`--compress` `<0 | 1 | gzip | lzo>` ('default =' `0`)::
+`--compress` `<0 | 1 | gzip | lzo | zstd>` ('default =' `0`)::
 
 Compress dump file.
 
@@ -108,3 +108,7 @@ Store resulting file to this storage.
 
 Store temporary files to specified directory.
 
+`--zstd` `<integer>` ('default =' `1`)::
+
+Zstd threads. N=0 uses half of the available cores, N>0 uses N as thread count.
+

vzdump.conf.5-opts.adoc

@@ -2,7 +2,7 @@
 
 Limit I/O bandwidth (KBytes per second).
 
-`compress`: `<0 | 1 | gzip | lzo>` ('default =' `0`)::
+`compress`: `<0 | 1 | gzip | lzo | zstd>` ('default =' `0`)::
 
 Compress dump file.
 
@@ -70,3 +70,7 @@ Store resulting file to this storage.
 
 Store temporary files to specified directory.
 
+`zstd`: `<integer>` ('default =' `1`)::
+
+Zstd threads. N=0 uses half of the available cores, N>0 uses N as thread count.
+