ProxKey

The bootstrap problem with fresh containers: you can’t SSH in to install your key because your key isn’t there yet. ProxKey sidesteps SSH entirely — it talks to the Proxmox API, discovers every LXC and VM on the node, and executes inside the guest via pct exec (LXC) or qm guest exec (QEMU) to write the right keys to the right authorized_keys. Injection scripts are base64-encoded before being piped so shell quoting survives the SSH → pct exec → bash gauntlet, and the script grep -qFs before appending, so re-deploys are idempotent.

Around that core: a key library with per-host or global assignment, clean revocation through the same execution path, an inspect mode that reads deployed keys without touching the guest manually, a hookscript endpoint so new containers auto-receive keys the moment they start, and a full audit log of every injection and revocation.

The stack is a two-container Compose deploy: FastAPI backend with single-file SQLite state (SQLModel), and an nginx-served React 19 frontend (Vite, Tailwind, TanStack Query) with dashboard, host, key, and audit views.