Get the schemas for all DNS providers we support for ACME DNS Challenge and the respective attributes required for connecting to them while validating a DNS Challenge

Create a DNS Authenticator

Create a specific DNS Authenticator containing required authentication details for the said provider to successfully connect with it

Create a DNS Authenticator for Route53

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.create",
    "params": [{
        "name": "route53_authenticator",
        "authenticator": "route53",
        "attributes": {
            "access_key_id": "AQX13",
            "secret_access_key": "JKW90"
        }
    }]
}

Delete DNS Authenticator of id

Delete a DNS Authenticator of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.delete",
    "params": [
        1
    ]
}

Update DNS Authenticator of id

Update a DNS Authenticator of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.update",
    "params": [
        1,
        {
            "name": "route53_authenticator",
            "attributes": {
                "access_key_id": "AQX13",
                "secret_access_key": "JKW90"
            }
        }
    ]
}

Force an update of the AD machine account password. This can be used to refresh the Kerberos principals in the server's system keytab.

Returns the following information about the currently joined domain:

LDAP server IP address of current LDAP server to which TrueNAS is connected.

LDAP server name DNS name of LDAP server to which TrueNAS is connected

Realm Kerberos realm

LDAP port

Server time timestamp.

KDC server Kerberos KDC to which TrueNAS is connected

Server time offset current time offset from DC.

Last machine account password change. timestamp

Return list of kerberos SPN entries registered for the server's Active Directory computer account. This may not reflect the state of the server's current kerberos keytab.

Wrapper function for 'directoryservices.get_state'. Returns only the state of the Active Directory service.

Leave Active Directory domain. This will remove computer object from AD and clear relevant configuration data from the NAS. This requires credentials for appropriately-privileged user. Credentials are used to obtain a kerberos ticket, which is used to perform the actual removal from the domain.

Returns list of available LDAP schema choices.

Issue a no-effect command to our DC. This checks if our secure channel connection to our domain controller is still alive. It has much less impact than wbinfo -t. Default winbind request timeout is 60 seconds, and can be adjusted by the smb4.conf parameter 'winbind request timeout ='

Update active directory configuration. domainname full DNS domain name of the Active Directory domain.

bindname username used to perform the intial domain join.

bindpw password used to perform the initial domain join. User- provided credentials are used to obtain a kerberos ticket, which is used to perform the actual domain join.

verbose_logging increase logging during the domain join process.

use_default_domain controls whether domain users and groups have the pre-windows 2000 domain name prepended to the user account. When enabled, the user appears as "administrator" rather than "EXAMPLEdministrator"

allow_trusted_doms enable support for trusted domains. If this parameter is enabled, then separate idmap backends must be configured for each trusted domain, and the idmap cache should be cleared.

allow_dns_updates during the domain join process, automatically generate DNS entries in the AD domain for the NAS. If this is disabled, then a domain administrator must manually add appropriate DNS entries for the NAS. This parameter is recommended for TrueNAS HA servers.

disable_freenas_cache disables active caching of AD users and groups. When disabled, only users cached in winbind's internal cache are visible in GUI dropdowns. Disabling active caching is recommended in environments with a large amount of users.

site AD site of which the NAS is a member. This parameter is auto- detected during the domain join process. If no AD site is configured for the subnet in which the NAS is configured, then this parameter appears as 'Default-First-Site-Name'. Auto-detection is only performed during the initial domain join.

kerberos_realm in which the server is located. This parameter is automatically populated during the initial domain join. If the NAS has an AD site configured and that site has multiple kerberos servers, then the kerberos realm is automatically updated with a site-specific configuration to use those servers. Auto-detection is only performed during initial domain join.

kerberos_principal kerberos principal to use for AD-related operations outside of Samba. After intial domain join, this field is updated with the kerberos principal associated with the AD machine account for the NAS.

nss_info controls how Winbind retrieves Name Service Information to construct a user's home directory and login shell. This parameter is only effective if the Active Directory Domain Controller supports the Microsoft Services for Unix (SFU) LDAP schema.

timeout timeout value for winbind-related operations. This value may need to be increased in environments with high latencies for communications with domain controllers or a large number of domain controllers. Lowering the value may cause status checks to fail.

dns_timeout timeout value for DNS queries during the initial domain join. This value is also set as the NETWORK_TIMEOUT in the ldap config file.

createcomputer Active Directory Organizational Unit in which new computer accounts are created.

The OU string is read from top to bottom without RDNs. Slashes ("/") are used as delimiters, like Computers/Servers/NAS. The backslash ("\") is used to escape characters but not as a separator. Backslashes are interpreted at multiple levels and might require doubling or even quadrupling to take effect.

When this field is blank, new computer accounts are created in the Active Directory default OU.

The Active Directory service is started after a configuration update if the service was initially disabled, and the updated configuration sets enable to True. The Active Directory service is stopped if enable is changed to False. If the configuration is updated, but the initial enable state is True, and remains unchanged, then the samba server is only restarted.

During the domain join, a kerberos keytab for the newly-created AD machine account is generated. It is used for all future LDAP / AD interaction and the user-provided credentials are removed.

Dismiss id alert.

List all types of alerts including active/dismissed currently in the system.

List all types of alerts which the system can issue.

List all alert policies which indicate the frequency of the alerts.

Restore id alert which had been dismissed.

Update default Alert settings.

Create an Alert Service of specified type.

If enabled, it sends alerts to the configured type of Alert Service.

Create an Alert Service of Mail type

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "alertservice.create",
    "params": [{
        "name": "Test Email Alert",
        "enabled": true,
        "type": "Mail",
        "attributes": {
            "email": "dev@ixsystems.com"
        },
        "settings": {
            "VolumeVersion": "HOURLY"
        }
    }]
}

Delete Alert Service of id.

List all types of supported Alert services which can be configured with the system.

Send a test alert using type of Alert Service.

Send a test alert using Alert Service of Mail type.

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "alertservice.test",
    "params": [{
        "name": "Test Email Alert",
        "enabled": true,
        "type": "Mail",
        "attributes": {
            "email": "dev@ixsystems.com"
        },
        "settings": {}
    }]
}

Update Alert Service of id.

Creates API Key.

name is a user-readable name for key.

Delete API Key id.

Update API Key id.

Specify reset: true to reset this API Key.

Verify username and password

Verify username and password (this will only validate root user's password and would return false for any other user)

Generate a token to be used for authentication.

ttl stands for Time To Live, in seconds. The token will be invalidated if the connection has been inactive for a time greater than this.

attrs is a general purpose object/dictionary to hold information about the token.

Authenticate session using username and password. Currently only root user is allowed. otp_token must be specified if two factor authentication is enabled.

Authenticate session using API Key.

Authenticate session using token generated with auth.generate_token.

Deauthenticates an app and if a token exists, removes that from the session.

Returns list of active auth sessions.

Example of return value:

[ { "id": "NyhB1J5vjPjIV82yZ6caU12HLA1boDJcZNWuVQM4hQWuiyUWMGZTz2ElDp7Yk87d", "origin": "192.168.0.3:40392", "credentials": "TOKEN", "internal": False, "created_at": {"$date": 1545842426070} } ]

credentials can be UNIX_SOCKET, ROOT_TCP_SOCKET, TRUENAS_NODE, LOGIN_PASSWORD or TOKEN, depending on what authentication method was used.

If you want to exclude all internal connections from the list, call this method with following arguments:

[ [ ["internal", "=", True] ] ]

Returns true if two factor authorization is required for authorizing user's login.

Returns the provisioning URI for the OTP. This can then be encoded in a QR Code and used to provision an OTP app like Google Authenticator.

Generates a new secret for Two Factor Authentication. Returns boolean true on success.

otp_digits represents number of allowed digits in the OTP.

window extends the validity to window many counter ticks before and after the current one.

interval is time duration in seconds specifying OTP expiration time from it's creation time.

Returns boolean true if provided token is successfully authenticated.

Attach a disk to the boot pool, turning a stripe into a mirror.

expand option will determine whether the new disk partition will be the maximum available or the same size as the current disk.

Detach given dev from boot pool.

Returns disks of the boot pool.

Get Automatic Scrub Interval value in days.

Returns the current state of the boot pool, including all vdevs, properties and datasets.

Replace device label on boot pool with dev.

Scrub on boot pool.

Set Automatic Scrub Interval value in days.

Activates boot environment id.

Create a new boot environment using name.

If a new boot environment is desired which is a clone of another boot environment, source can be passed. Then, a new boot environment of name is created using boot environment source by cloning it.

Ensure that name and source are valid boot environment names.

Delete id boot environment. This removes the clone from the system.

Query all Boot Environments with query-filters and query-options.

Sets attributes boot environment id.

Currently only keep attribute is allowed.

Update id boot environment name with a new provided valid name.

catalog_create.preferred_trains specifies trains which will be displayed in the UI directly for a user.

Retrieve information of item_name item_version_details.catalog catalog item.

Retrieve item details for label catalog.

options.cache is a boolean which when set will try to get items details for label catalog from cache if available.

options.cache_only is a boolean which when set will force usage of cache only for retrieving catalog information. If the content for the catalog in question is not cached, no content would be returned. If options.cache is unset, this attribute has no effect.

options.retrieve_all_trains is a boolean value which when set will retrieve information for all the trains present in the catalog ( it is set by default ).

options.trains is a list of train name(s) which will allow selective filtering to retrieve only information of desired trains in a catalog. If options.retrieve_all_trains is set, it has precedence over options.train.

options.retrieve_versions can be unset to skip retrieving version details of each catalog item. This can help in cases to optimize performance. Retrieving versions would be deprecated in the next major release from this endpoint.

Sync label catalog to retrieve latest changes from upstream.

Refresh all available catalogs from upstream.

Validates label catalog format which includes validating trains and applications with their versions.

This does not test if an app version is valid in terms of kubernetes resources but instead ensures it has the correct format and files necessary for TrueNAS to use it.

Dictionary of popular ACME Servers with their directory URI endpoints which we display automatically in UI

Returns a dictionary of predefined options for specific use cases i.e openvpn client/server configurations which can be used for creating certificate signing requests.

Returns country choices for creating a certificate/csr.

Create a new Certificate

Certificates are classified under following types and the necessary keywords to be passed for create_type attribute to create the respective type of certificate

1) Internal Certificate - CERTIFICATE_CREATE_INTERNAL

2) Imported Certificate - CERTIFICATE_CREATE_IMPORTED

3) Certificate Signing Request - CERTIFICATE_CREATE_CSR

4) Imported Certificate Signing Request - CERTIFICATE_CREATE_IMPORTED_CSR

5) ACME Certificate - CERTIFICATE_CREATE_ACME

By default, created certs use RSA keys. If an Elliptic Curve Key is desired, it can be specified with the key_type attribute. If the ec_curve attribute is not specified for the Elliptic Curve Key, then default to using "BrainpoolP384R1" curve.

A type is selected by the Certificate Service based on create_type. The rest of the values in data are validated accordingly and finally a certificate is made based on the selected type.

cert_extensions can be specified to set X509v3 extensions.

Create an ACME based certificate

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "tos": true,
        "csr_id": 1,
        "acme_directory_uri": "https://acme-staging-v02.api.letsencrypt.org/directory",
        "name": "acme_certificate",
        "dns_mapping": {
            "domain1.com": "1"
        },
        "create_type": "CERTIFICATE_CREATE_ACME"
    }]
}

Create an Imported Certificate Signing Request

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "name": "csr",
        "CSR": "CSR string",
        "privatekey": "Private key string",
        "create_type": "CERTIFICATE_CREATE_IMPORTED_CSR"
    }]
}

Create an Internal Certificate

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "name": "internal_cert",
        "key_length": 2048,
        "lifetime": 3600,
        "city": "Nashville",
        "common": "domain1.com",
        "country": "US",
        "email": "dev@ixsystems.com",
        "organization": "iXsystems",
        "state": "Tennessee",
        "digest_algorithm": "SHA256",
        "signedby": 4,
        "create_type": "CERTIFICATE_CREATE_INTERNAL"
    }]
}

Delete certificate of id.

If the certificate is an ACME based certificate, certificate service will try to revoke the certificate by updating it's status with the ACME server, if it fails an exception is raised and the certificate is not deleted from the system. However, if force is set to True, certificate is deleted from the system even if some error occurred while revoking the certificate with the ACME Server

Delete certificate of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.delete",
    "params": [
        1,
        true
    ]
}

Dictionary of supported EC curves.

Dictionary of choices for ExtendedKeyUsage extension which can be passed over to usages attribute.

Dictionary of supported key types for certificates.

Returns a dictionary of predefined options for specific use cases i.e openvpn client/server configurations which can be used for creating certificates.

Update certificate of id

Only name and revoked attribute can be updated.

When revoked is enabled, the specified cert id is revoked and if it belongs to a CA chain which exists on this system, its serial number is added to the CA's certificate revocation list.

Update a certificate of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.update",
    "params": [
        1,
        {
            "name": "updated_name"
        }
    ]
}

Sign CSR by Certificate Authority of ca_id

Sign CSR's and generate a certificate from it. ca_id provides which CA is to be used for signing a CSR of csr_cert_id which exists in the system

cert_extensions can be specified if specific extensions are to be set in the newly signed certificate.

Sign CSR of csr_cert_id by Certificate Authority of ca_id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.ca_sign_csr",
    "params": [{
        "ca_id": 1,
        "csr_cert_id": 1,
        "name": "signed_cert"
    }]
}

Create a new Certificate Authority

Certificate Authorities are classified under following types with the necessary keywords to be passed for create_type attribute to create the respective type of certificate authority

1) Internal Certificate Authority - CA_CREATE_INTERNAL

2) Imported Certificate Authority - CA_CREATE_IMPORTED

3) Intermediate Certificate Authority - CA_CREATE_INTERMEDIATE

Created certificate authorities use RSA keys by default. If an Elliptic Curve Key is desired, then it can be specified with the key_type attribute. If the ec_curve attribute is not specified for the Elliptic Curve Key, default to using "BrainpoolP384R1" curve.

A type is selected by the Certificate Authority Service based on create_type. The rest of the values are validated accordingly and finally a certificate is made based on the selected type.

cert_extensions can be specified to set X509v3 extensions.

Create an Internal Certificate Authority

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.create",
    "params": [{
        "name": "internal_ca",
        "key_length": 2048,
        "lifetime": 3600,
        "city": "Nashville",
        "common": "domain1.com",
        "country": "US",
        "email": "dev@ixsystems.com",
        "organization": "iXsystems",
        "state": "Tennessee",
        "digest_algorithm": "SHA256"
        "create_type": "CA_CREATE_INTERNAL"
    }]
}

Create an Imported Certificate Authority

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.create",
    "params": [{
        "name": "imported_ca",
        "certificate": "Certificate string",
        "privatekey": "Private key string",
        "create_type": "CA_CREATE_IMPORTED"
    }]
}

Delete a Certificate Authority of id

Delete a Certificate Authority of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.delete",
    "params": [
        1
    ]
}

Returns a dictionary of predefined options for specific use cases i.e OpenVPN certificate authority configurations which can be used for creating certificate authorities.

Update Certificate Authority of id

Only name and revoked attribute can be updated.

If revoked is enabled, the CA and its complete chain is marked as revoked and added to the CA's certificate revocation list.

Update a Certificate Authority of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.update",
    "params": [
        1,
        {
            "name": "updated_ca_name"
        }
    ]
}

Returns certificate authorities which can be used by applications.

Returns certificates which can be used by applications.

Create a chart release for a catalog item.

release_name is the name which will be used to identify the created chart release.

catalog is a valid catalog id where system will look for catalog item details.

train is which train to look for under catalog i.e stable / testing etc.

version specifies the catalog item version.

values is configuration specified for the catalog item version in question which will be used to create the chart release.

Delete existing chart release.

This will delete the chart release from the kubernetes cluster and also remove any associated volumes / data. To clarify, host path volumes will not be deleted which live outside the chart release dataset.

Returns kubernetes events for release_name Chart Release.

Available choices for NIC which can be added to a pod in a chart release.

Returns choices for console access to a chart release.

Output is a dictionary with names of pods as keys and containing names of containers which the pod comprises of.

Export logs of options.container_name container in options.pod_name pod in release_name chart release.

options.tail_lines is an option to select how many lines of logs to retrieve for the said container. It defaults to 500. If set to null, it will retrieve complete logs of the container.

options.limit_bytes is an option to select how many bytes to retrieve from the tail lines selected. If set to null ( which is the default ), it will not limit the bytes returned. To clarify, options.tail_lines is applied first and the required number of lines are retrieved and then options.limit_bytes is applied.

Please refer to websocket documentation for downloading the file.

Returns choices for accessing logs of any container in any pod in a chart release.

Retrieve available/desired pods status for a chart release and it's current state.

Update container images being used by release_name chart release.

redeploy when set will redeploy pods which will result in chart release using newer updated versions of the container images.

Query available chart releases.

query-options.extra.retrieve_resources is a boolean when set will retrieve existing kubernetes resources in the chart namespace.

query-options.extra.history is a boolean when set will retrieve all chart version upgrades for a chart release.

query-options.extra.include_chart_schema is a boolean when set will retrieve the schema being used by the chart release in question.

query-options.extra.resource_events is a boolean when set will retrieve individual events of each resource. This only has effect if query-options.extra.retrieve_resources is set.

Redeploy will initiate a new rollout of the Helm chart according to upgrade strategy defined by the chart release workloads. A good example for redeploying is updating kubernetes pods with an updated container image.

Remove volume_name ix_volume from release_name chart release.

Rollback a chart release to a previous chart version.

item_version is version which we want to rollback a chart release to.

rollback_snapshot is a boolean value which when set will rollback snapshots of any PVC's or ix volumes being consumed by the chart release.

force_rollback is a boolean which when set will force rollback operation to move forward even if no snapshots are found. This is only useful when rollback_snapshot is set.

recreate_resources is a boolean which will delete and then create the kubernetes resources on rollback of chart release. This should be used with caution as if chart release is consuming immutable objects like a PVC, the rollback operation can't be performed and will fail as helm tries to do a 3 way patch for rollback.

Rollback is functional for the actual configuration of the release at the item_version specified and any associated ix_volumes with any PVC's which were consuming chart release storage class.

Scale a release_name chart release to scale_options.replica_count specified.

This will scale deployments/statefulset to replica count specified.

Scale workloads in a chart release to specified replica_count.

Returns choices for types of workloads which can be scaled up/down.

Update an existing chart release.

values is configuration specified for the catalog item version in question which will be used to create the chart release.

Upgrade release_name chart release.

upgrade_options.item_version specifies to which item version chart release should be upgraded to.

System will update container images being used by release_name chart release as a chart release upgrade is not considered complete until the images in use have also been updated to latest versions.

During upgrade, upgrade_options.values can be specified to apply configuration changes for configuration changes for the chart release in question.

When chart version is upgraded, system will automatically take a snapshot of ix_volumes in question which can be used to rollback later on.

Retrieve upgrade summary for release_name which will include which container images will be updated and changelog for options.item_version chart version specified if applicable. If only container images need to be updated, changelog will be null.

If chart release release_name does not require an upgrade, an error will be raised.

Returns ports in use by applications.

Aborts cloud sync task.

Creates a new cloud_sync entry.

Create a new cloud_sync using amazon s3 attributes, which is supposed to run every hour.

{
  "id": "6841f242-840a-11e6-a437-00e04d680384",
  "msg": "method",
  "method": "cloudsync.create",
  "params": [{
    "description": "s3 sync",
    "path": "/mnt/tank",
    "credentials": 1,
    "minute": "00",
    "hour": "*",
    "daymonth": "*",
    "month": "*",
    "attributes": {
      "bucket": "mybucket",
      "folder": ""
    },
    "enabled": true
  }]
}

Deletes cloud_sync entry id.

List contents of a remote bucket / directory.

If remote supports buckets, path is constructed by two keys "bucket"/"folder" in attributes. If remote does not support buckets, path is constructed using "folder" key only in attributes. "folder" is directory name and "bucket" is bucket name for remote.

Path examples:

S3 Service bucketname/directory/name

Dropbox Service directory/name

credentials is a valid id of a Cloud Sync Credential which will be used to connect to the provider.

Lists all available drives and their types for given Microsoft OneDrive credentials.

{
  "id": "6841f242-840a-11e6-a437-00e04d680384",
  "msg": "method",
  "method": "cloudsync.onedrive_list_drives",
  "params": [{
    "client_id": "...",
    "client_secret": "",
    "token": "{...}",
  }]
}

Returns

[{"drive_type": "PERSONAL", "drive_id": "6bb903a25ad65e46"}]

Returns a list of dictionaries of supported providers for Cloud Sync Tasks.

credentials_schema is JSON schema for credentials attributes.

task_schema is JSON schema for task attributes.

buckets is a boolean value which is set to "true" if provider supports buckets.

Example of a single provider:

[ { "name": "AMAZON_CLOUD_DRIVE", "title": "Amazon Cloud Drive", "credentials_schema": [ { "property": "client_id", "schema": { "title": "Amazon Application Client ID", "required": true, "type": "string" } }, { "property": "client_secret", "schema": { "title": "Application Key", "required": true, "type": "string" } } ], "credentials_oauth": null, "buckets": false, "bucket_title": "Bucket", "task_schema": [] } ]

Query all Cloud Sync Tasks with query-filters and query-options.

Create the opposite of cloud sync task id (PULL if it was PUSH and vice versa).

Run the cloud_sync job id, syncing the local data to remote.

Run cloud sync task without creating it.

Updates the cloud_sync entry id with data.

Create Cloud Sync Credentials.

attributes is a dictionary of valid values which will be used to authorize with the provider.

Delete Cloud Sync Credentials of id.

Update Cloud Sync Credentials of id.

Verify if attributes provided for provider are authorized by the provider.

Reset database to configuration defaults.

If reboot is true this job will reboot the system after its completed with a delay of 10 seconds.

Create a bundle of security-sensitive information. These options select which information is included in the bundle:

secretseed: include password secret seed.

pool_keys: include GELI encryption keys.

root_authorized_keys: include "authorized_keys" file for the root user.

If none of these options are set, the bundle is not generated and the database file is provided.

Accepts a configuration file via job pipe.

When enable_image_updates is set, system will check if existing container images need to be updated. System will basically check if we have an updated image hash available for the same tag available and if we do, user is alerted to update the image. A use case for unsetting this variable can be rate limits for docker registries, as each time we check if a single image needs update, we consume the rate limit and eventually it can hinder operations if the number of images to be checked is a lot.

options.force should be used to force delete an image even if it's in use by a stopped container.

from_image is the name of the image to pull. Format for the name is "registry/repo/image" where registry may be omitted and it will default to docker registry in this case.

tag specifies tag of the image and defaults to null. In case of null it will retrieve all the tags of the image.

docker_authentication should be specified if image to be retrieved is under a private repository.

Retrieve container images present in the system.

query-options.extra.parse_tags is a boolean which when set will have normalized tags to be retrieved for container images.

Will loop on a list of items for the given method, returning a list of dicts containing a result and error key.

description contains format string for job progress (e.g. "Deleting snapshot {0[dataset]}@{0[name]}")

Result will be the message returned by the method being called, or a string of an error, in which case the error key will be the exception

Setup middlewared for remote debugging.

engines: - PTVS: Python Visual Studio - PYDEV: Python Dev (Eclipse/PyCharm) - REMOTE_PDB: Remote vanilla PDB (over TCP sockets)

options: - secret: password for PTVS - host: required for PYDEV, hostname of local computer (developer workstation) - local_path: required for PYDEV, path for middlewared source in local computer (e.g. /home/user/freenas/src/middlewared/middlewared - threaded: run debugger in a new thread instead of event loop

Core helper to call a job marked for download.

Non-buffered downloads will allow job to write to pipe as soon as download URL is requested, job will stay blocked meanwhile. buffered downloads must wait for job to complete before requesting download URL, job's pipe output will be buffered to ramfs.

Returns the job id and the URL for download.

Returns metadata for every possible event emitted from websocket server.

Get the long running jobs.

Return methods metadata of every available service.

service parameter is optional and filters the result for a single service.

Returns a list of all registered services.

Retrieve last 1000 incoming/outgoing message(s) logged over websocket.

Utility method which just returns "pong". Can be used to keep connection/authtoken alive instead of using "ping" protocol message.

Method that will send an ICMP echo request to "hostname" and will wait up to "timeout" for a reply.

Resize terminal session (/websocket/shell) to cols x rows

Get currently open websocket sessions.

Set debug_mode for middleware.

Create a new cron job.

stderr and stdout are boolean values which if true, represent that we would like to suppress standard error / standard output respectively.

Create a cron job which executes touch /tmp/testfile after every 5 minutes.

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "cronjob.create",
    "params": [{
        "enabled": true,
        "schedule": {
            "minute": "5",
            "hour": "*",
            "dom": "*",
            "month": "*",
            "dow": "*"
        },
        "command": "touch /tmp/testfile",
        "description": "Test command",
        "user": "root",
        "stderr": true,
        "stdout": true
    }]
}

Delete cronjob of id.

Job to run cronjob task of id.

Update cronjob of id.

Returns a boolean if the ctdb cluster is healthy.

Return a list of public ip addresses in the ctdb cluster.

Return a list of nodes in the ctdb cluster.

Return node number for this node. This value should be static for life of cluster.

List the status of nodes in the ctdb cluster.

all_nodes: Boolean if True, return status for all nodes in the cluster else return status of this node.

Add a ctdb private address to the cluster

ip string representing an IP v4/v6 address

Update Private IP address from the ctdb cluster with pnn value of id.

id integer representing the PNN value for the node. enable boolean. When True, enable the node else disable the node.

Add a ctdb public address to the cluster

pnn node number of record to adjust ip string representing an IP v4/v6 address netmask integer representing a cidr notated netmask (i.e. 16/24/48/64 etc) interface string representing a network interface to apply the ip

Retrieve information about configured public IP addresses for the ctdb cluster. This call raise a CallError with errno set to ENXIO if this node is not in a state where it can provide accurate information about cluster. Examples problematic states are:

• ctdb or glusterd are not running on this node

• ctdb shared volume is not mounted

Update Public IP address in the ctdb cluster. pnn - cluster node number ip string representing the public ip address enable boolean. When True, enable the node else disable the node.

Get info for SERIAL/DISK/GPU device types.

Retrieve choices for GPU PCI ids located in the system.

This method refreshes the directory services cache for users and groups that is used as a backing for user.query and group.query methods. The first cache fill in an Active Directory domain may take a significant amount of time to complete and so it is performed as within a job. The most likely situation in which a user may desire to refresh the directory services cache is after new users or groups to a remote directory server with the intention to have said users or groups appear in the results of the aforementioned account-related methods.

A cache refresh is not required in order to use newly-added users and groups for in permissions and ACL related methods. Likewise, a cache refresh will not resolve issues with users being unable to authenticate to shares.

DISABLED Directory Service is disabled.

FAULTED Directory Service is enabled, but not HEALTHY. Review logs and generated alert messages to debug the issue causing the service to be in a FAULTED state.

LEAVING Directory Service is in process of stopping.

JOINING Directory Service is in process of starting.

HEALTHY Directory Service is enabled, and last status check has passed.

Helper method to get all disks that are not in use, either by the boot pool or the user pools.

Query disks.

The following extra options are supported:

 include_expired: true - will also include expired disks (default: false)
 passwords: true - will not hide KMIP password for the disks (default: false)
 pools: true - will join pool name for each disk (default: false)

Returns S.M.A.R.T. attributes values for specified disk name.

Returns temperature for device name using specified S.M.A.R.T. powermode.

Returns temperatures for a list of devices (runs in parallel). See disk.temperature documentation for more details.

Update disk of id.

If extra options need to be passed to SMART which we don't already support, they can be passed by smartoptions.

critical, informational and difference are integer values on which alerts for SMART are configured if the disk temperature crosses the assigned threshold for each respective attribute. If they are set to null, then SMARTD config values are used as defaults.

Email of log level LOG_CRIT is issued when disk temperature crosses critical.

Email of log level LOG_INFO is issued when disk temperature crosses informational.

If temperature of a disk changes by difference degree Celsius since the last report, SMART reports this.

Performs a wipe of a disk dev. It can be of the following modes: - QUICK: clean the first and last 32 megabytes on dev - FULL: write whole disk with zero's - FULL_RANDOM: write whole disk with random bytes

Query Name Servers with query-filters and query-options.

List supported Dynamic DNS Service Providers.

Update dynamic dns service configuration.

period indicates how often the IP is checked in seconds.

ssl if set to true, makes sure that HTTPS is used for the connection to the server which updates the DNS record.

Restart the keepavlived service which will cause any VIP addresses on this controller to be migrated to the other controller. This will cause a failover event if run on the master controller. If this is run on the passive controller it will do 1 of 2 things:

1: if there are no VIP(s) on the passive controller, then this will do nothing. 2: if there are VIP(s) on the passive controller, then the VIP(s) will be migrated to the active controller. A failover event will be triggered but it will do nothing since the active will already have the zpool(s) imported.

Call a method in the other node.

Returns a list of reasons why failover is not enabled/functional.

NO_VOLUME - There are no pools configured. NO_VIP - There are no interfaces configured with Virtual IP. NO_SYSTEM_READY - Other storage controller has not finished booting. NO_PONG - Other storage controller is not communicable. NO_FAILOVER - Failover is administratively disabled. NO_LICENSE - Other storage controller has no license. DISAGREE_CARP - Nodes CARP states do not agree. MISMATCH_DISKS - The storage controllers do not have the same quantity of disks. NO_CRITICAL_INTERFACES - No network interfaces are marked critical for failover.

Force this controller to become MASTER, if it's not already.

Get a list of IPs for which the webUI can be accessed.

Returns the hardware type for an HA system. ECHOSTREAM ECHOWARP PUMA BHYVE MANUAL

Returns True if there is an ongoing failover event.

Checks whether this instance is licensed as a HA unit.

Returns the slot position in the chassis that the controller is located. A - First node B - Seconde Node MANUAL - slot position in chassis could not be determined

Get the current HA status.

Returns: MASTER BACKUP ELECTING IMPORTING ERROR SINGLE

Sync database and files from the other controller.

Sync database and files to the other controller.

reboot as true will reboot the other controller after syncing.

Unlock datasets in HA, syncing passphrase between controllers and forcing this controller to be MASTER importing the pools.

Update failover state.

disabled When true indicates that HA will be disabled. master Marks the particular node in the chassis as the master node. The standby node will have the opposite value.

timeout is the time to WAIT until a failover occurs when a network event occurs on an interface that is marked critical for failover AND HA is enabled and working appropriately.

The default time to wait is 2 seconds.
**NOTE**
    This setting does NOT effect the `disabled` or `master` parameters.

Upgrades both controllers.

Files will be downloaded to the Active Controller and then transferred to the Standby Controller.

Upgrade process will start concurrently on both nodes.

Once both upgrades are applied, the Standby Controller will reboot. This job will wait for that job to complete before finalizing.

Perform the last stage of an HA upgrade.

This will activate the new boot environment on the Standby Controller and reboot it.

Verify if HA upgrade is pending.

upgrade_finish needs to be called to finish the HA upgrade process if this method returns true.

Returns True if the ACL can be fully expressed as a file mode without losing any access rules.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

Check if username is able to access path with specific permissions. At least one of read/write/execute permission must be specified for checking with each of these defaulting to null. null for read/write/execute represents that the permission should not be checked.

Change owner or group of file at path.

uid and gid specify new owner of the file. If either key is absent or None, then existing value on the file is not changed.

recursive performs action recursively, but does not traverse filesystem mount points.

If traverse and recursive are specified, then the chown operation will traverse filesystem mount points.

DEPRECATED Returns list of names of ACL templates. Wrapper around filesystem.acltemplate.query.

Job to get contents of path.

DEPRECATED Returns a default ACL depending on the usage specified by acl_type. If an admin group is defined, then an entry granting it full control will be placed at the top of the ACL. Optionally may pass share_type to argument to get share-specific template ACL.

Return ACL of a given path. This may return a POSIX1e ACL or a NFSv4 ACL. The acl type is indicated by the acltype key.

simplified - effect of this depends on ACL type on underlying filesystem. In the case of NFSv4 ACLs simplified permissions and flags are returned for ACL entries where applicable. NFSv4 errata below. In the case of POSIX1E ACls, this setting has no impact on returned ACL.

resolve_ids - adds additional who key to each ACL entry, that converts the numeric id to a user name or group name. In the case of owner@ and group@ (NFSv4) or USER_OBJ and GROUP_OBJ (POSIX1E), st_uid or st_gid will be converted from stat() return for file. In the case of MASK (POSIX1E), OTHER (POSIX1E), everyone@ (NFSv4), key who will be included, but set to null. In case of failure to resolve the id to a name, who will be set to null. This option should only be used if resolving ids to names is required.

Errata about ACLType NFSv4:

simplified returns a shortened form of the ACL permset and flags where applicable. If permissions have been simplified, then the perms object will contain only a single BASIC key with a string describing the underlying permissions set.

TRAVERSE sufficient rights to traverse a directory, but not read contents.

READ sufficient rights to traverse a directory, and read file contents.

MODIFIY sufficient rights to traverse, read, write, and modify a file.

FULL_CONTROL all permissions.

If the permisssions do not fit within one of the pre-defined simplified permissions types, then the full ACL entry will be returned.

Retrieves boolean which is set when immutable flag is set on path.

Get the contents of a directory.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

Each entry of the list consists of: name(str): name of the file path(str): absolute path of the entry realpath(str): absolute real path of the entry (if SYMLINK) type(str): DIRECTORY | FILESYSTEM | SYMLINK | OTHER size(int): size of the entry mode(int): file mode/permission uid(int): user id of entry owner gid(int): group id of entry onwer acl(bool): extended ACL is present on file

Create a directory at the specified path.

Job to put contents to path.

Set/Unset immutable flag at path.

set_flag when set will set immutable flag and when unset will unset immutable flag at path.

Set ACL of a given path. Takes the following parameters: path full path to directory or file.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

dacl ACL entries. Formatting depends on the underlying acltype. NFS4ACL requires NFSv4 entries. POSIX1e requires POSIX1e entries.

uid the desired UID of the file user. If set to None (the default), then user is not changed.

gid the desired GID of the file group. If set to None (the default), then group is not changed.

recursive apply the ACL recursively

traverse traverse filestem boundaries (ZFS datasets)

strip convert ACL to trivial. ACL is trivial if it can be expressed as a file mode without losing any access rules.

canonicalize reorder ACL entries so that they are in concanical form as described in the Microsoft documentation MS-DTYP 2.4.5 (ACL). This only applies to NFSv4 ACLs.

For case of NFSv4 ACLs USER_OBJ, GROUP_OBJ, and EVERYONE with owner@, group@, everyone@ for consistency with getfacl and setfacl. If one of aforementioned special tags is used, 'id' must be set to None.

An inheriting empty everyone@ ACE is appended to non-trivial ACLs in order to enforce Windows expectations regarding permissions inheritance. This entry is removed from NT ACL returned to SMB clients when 'ixnas' samba VFS module is enabled.

Set unix permissions on given path.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

If mode is specified then the mode will be applied to the path and files and subdirectories depending on which options are selected. Mode should be formatted as string representation of octal permissions bits.

uid the desired UID of the file user. If set to None (the default), then user is not changed.

gid the desired GID of the file group. If set to None (the default), then group is not changed.

stripacl setperm will fail if an extended ACL is present on path, unless stripacl is set to True.

recursive remove ACLs recursively, but do not traverse dataset boundaries.

traverse remove ACLs from child datasets.

If no mode is set, and stripacl is True, then non-trivial ACLs will be converted to trivial ACLs. An ACL is trivial if it can be expressed as a file mode without losing any access rules.

Return the filesystem stat(2) for a given path.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

Return stats from the filesystem of a given path.

Paths on clustered volumes may be specifed with the path prefix CLUSTER:<volume name>. For example, to list directories in the directory 'data' in the clustered volume smb01, the path should be specified as CLUSTER:smb01/data.

Raises: CallError(ENOENT) - Path not found

Retrieve list of available ACL templates for a given path.

Supports query-filters and query-options. format-options gives additional options to alter the results of the template query:

canonicalize - place ACL entries for NFSv4 ACLs in Microsoft canonical order. ensure_builtins - ensure all results contain entries for builtin_users and builtin_administrators groups. resolve_names - convert ids in ACL entries into names.

Create a new filesystem ACL template.

update filesystem ACL template with id.

Update ftp service configuration.

clients is an integer value which sets the maximum number of simultaneous clients allowed. It defaults to 32.

ipconnections is an integer value which shows the maximum number of connections per IP address. It defaults to 0 which equals to unlimited.

timeout is the maximum number of seconds that proftpd will allow clients to stay connected without receiving any data on either the control or data connection.

timeout_notransfer is the maximum number of seconds a client is allowed to spend connected, after authentication, without issuing a command which results in creating an active or passive data connection (i.e. sending/receiving a file, or receiving a directory listing).

rootlogin is a boolean value which when configured to true enables login as root. This is generally discouraged because of the security risks.

onlyanonymous allows anonymous FTP logins with access to the directory specified by anonpath.

banner is a message displayed to local login users after they successfully authenticate. It is not displayed to anonymous login users.

filemask sets the default permissions for newly created files which by default are 077.

dirmask sets the default permissions for newly created directories which by default are 077.

resume if set allows FTP clients to resume interrupted transfers.

fxp if set to true indicates that File eXchange Protocol is enabled. Generally it is discouraged as it makes the server vulnerable to FTP bounce attacks.

defaultroot when set ensures that for local users, home directory access is only granted if the user is a member of group wheel.

ident is a boolean value which when set to true indicates that IDENT authentication is required. If identd is not running on the client, this can result in timeouts.

masqaddress is the public IP address or hostname which is set if FTP clients cannot connect through a NAT device.

localuserbw is a positive integer value which indicates maximum upload bandwidth in KB/s for local user. Default of zero indicates unlimited upload bandwidth ( from the FTP server configuration ).

localuserdlbw is a positive integer value which indicates maximum download bandwidth in KB/s for local user. Default of zero indicates unlimited download bandwidth ( from the FTP server configuration ).

anonuserbw is a positive integer value which indicates maximum upload bandwidth in KB/s for anonymous user. Default of zero indicates unlimited upload bandwidth ( from the FTP server configuration ).

anonuserdlbw is a positive integer value which indicates maximum download bandwidth in KB/s for anonymous user. Default of zero indicates unlimited download bandwidth ( from the FTP server configuration ).

tls is a boolean value which when set indicates that encrypted connections are enabled. This requires a certificate to be configured first with the certificate service and the id of certificate is passed on in ssltls_certificate.

tls_policy defines whether the control channel, data channel, both channels, or neither channel of an FTP session must occur over SSL/TLS.

tls_opt_enable_diags is a boolean value when set, logs verbosely. This is helpful when troubleshooting a connection.

options is a string used to add proftpd(8) parameters not covered by ftp service.

Add url webhook that will be called with a JSON formatted POST request that will include the event that was triggered along with the relevant data.

url is a http address (i.e. http://192.168.1.50/endpoint) bearer_token is a bearer token secret secret to encode the JWT message

NOTE: This webhook will be synchronized to all peers in the trusted storage pool.

Delete url webhook

url is a http address (i.e. http://192.168.1.50/endpoint)

Sync the webhooks config file to all peers in the trusted storage pool

List the current webhooks (if any)

Check if gluster volume is FUSE mounted locally.

name String representing name of the gluster volume

Mount a gluster volume using the gluster FUSE client.

name String representing the name of the gluster volume all Boolean if True locally FUSE mount all detected gluster volumes raise Boolean if True raise a CallError if the FUSE mount fails

Unmount a locally FUSE mounted gluster volume.

name String representing the name of the gluster volume all Boolean if True umount all locally detected FUSE mounted gluster volumes raise Boolean if True raise a CallError if the FUSE mount fails

Add a secret key used to encode/decode JWT messages for sending/receiving gluster events.

secret String representing the key to be used to encode/decode JWT messages force Boolean if set to True, will forcefully wipe any existing jwt key for this peer. Note, if forcefully adding a new key, the other peers in the TSP will also need to be sent this key.

Note: this secret is only used for messages that are destined for the api endpoint at http://*:6000/_clusterevents for each peer in the trusted storage pool.

Return the secret key used to encode/decode JWT messages for sending/receiving gluster events.

Note: this secret is only used for messages that are destined for the api endpoint at http://*:6000/_clusterevents for each peer in the trusted storage pool.

Add peer to the Trusted Storage Pool.

hostname String representing an IP(v4/v6) address or DNS name

Remove peer of id from the Trusted Storage Pool.

id String representing the uuid of the peer

Return list of VIP(v4/v6) addresses available on the system

List the status of peers in the Trusted Storage Pool.

localhost Boolean if True, include localhost else exclude localhost

Start a fix-layout operation for a given gluster volume.

name String representing the gluster volume.

Start a rebalance operation for a given gluster volume.

name String representing the gluster volume. force Boolean, when True will forcefully start the rebalance operation.

Return the status of a rebalance operation for a given gluster volume.

name String representing the gluster volume.

Stop a rebalance operation for a given gluster volume.

name String representing the gluster volume.

Add bricks to a gluster volume.

name String representing name of gluster volume bricks List representing the brick paths peer_name String representing IP or DNS name of the peer peer_path String representing the full path of the brick replica Integer replicating replica count arbiter Integer replicating arbiter count force Boolean, if True, forcefully add brick(s)

Create a gluster volume.

name String representing name to be given to the volume bricks List representing the brick paths peer_name String representing IP or DNS name of the peer peer_path String representing the full path of the brick

replica Integer representing number of replica bricks arbiter Integer representing number of arbiter bricks disperse Integer representing number of disperse bricks disperse_data Integer representing number of disperse data bricks redundancy Integer representing number of redundancy bricks force Boolean, if True ignore potential warnings

Delete a gluster volume.

id String representing name of gluster volume to be deleted

Return information about gluster volume(s).

name String representing name of gluster volume

Return list of gluster volumes.

Reset volumes options. If opt is not provided, then all options will be reset.

name String representing name of gluster volume opt String representing name of the option to reset force Boolean, if True forcefully reset option(s)

Set gluster volume options.

name String representing name of gluster volume opts Dict where --key-- is the name of the option --value-- is the value to be given to the option

Enable/Disable the quota for a given gluster volume.

name String representing name of gluster volume enable Boolean, if True enable quota else disable it

Perform a remove operation on the brick(s) in the gluster volume.

name String representing name of gluster volume bricks List representing the brick paths peer_name String representing IP or DNS name of the peer peer_path String representing the full path of the brick operation String representing the operation to be performed START Start the removal of the brick(s) STOP Stop the removal of the brick(s) COMMIT Commit the removal of the brick(s) STATUS Display status of the removal of the brick(s) FORCE Force the removal of the brick(s) replica Integer representing replica count

Commit the replacement of a brick.

name String representing name of gluster volume src_brick Dict where peer_name key is a string representing IP or DNS name of the peer peer_path key is a string representing the full path of the brick new_brick Dict where peer_name key is a string representing IP or DNS name of the peer peer_path key is a string representing the full path of the brick

Restart a gluster volume.

name String representing name of gluster volume force Boolean, if True forcefully restart the gluster volume

Start a gluster volume.

name String representing name of gluster volume force Boolean, if True forcefully start the gluster volume

Return detailed information about gluster volume.

name String representing name of gluster volume verbose Boolean, If False, only return brick information

Stop a gluster volume.

name String representing name of gluster volume force Boolean, if True forcefully stop the gluster volume

Create a new group.

If gid is not provided it is automatically filled with the next one available.

allow_duplicate_gid allows distinct group names to share the same gid.

users is a list of user ids (id attribute from user.query).

smb specifies whether the group should be mapped into an NT group.

Delete group id.

The delete_users option deletes all users that have this group as their primary group.

Returns dictionary containing information from struct grp for the group specified by either the groupname or gid. Bypasses group cache.

Get the next available/free gid.

Query groups with query-filters and query-options. As a performance optimization, only local groups will be queried by default.

Expanded information may be requested by specifying the extra option "extra": {"additional_information": []}.

The following additional_information options are supported: SMB - include Windows SID and NT Name for group. If this option is not specified, then these keys will have null value. DS - include groups from Directory Service (LDAP or Active Directory) in results

"extra": {"search_dscache": true} is a legacy method of querying for directory services groups.

Update attributes of an existing group.

Returns array of valid idmap backend choices per directory service.

This returns full information about idmap backend options. Not all options are valid for every backend.

Stop samba, remove the winbindd_cache.tdb file, start samba, flush samba's cache. This should be performed after finalizing idmap changes.

Create a new IDMAP domain. These domains must be unique. This table will be automatically populated after joining an Active Directory domain if "allow trusted domains" is set to True in the AD service configuration. There are three default system domains: DS_TYPE_ACTIVEDIRECTORY, DS_TYPE_LDAP, DS_TYPE_DEFAULT_DOMAIN. The system domains correspond with the idmap settings under Active Directory, LDAP, and SMB respectively.

name the pre-windows 2000 domain name.

DNS_domain_name DNS name of the domain.

idmap_backend provides a plugin interface for Winbind to use varying backends to store SID/uid/gid mapping tables. The correct setting depends on the environment in which the NAS is deployed.

range_low and range_high specify the UID and GID range for which this backend is authoritative.

certificate_id references the certificate ID of the SSL certificate to use for certificate-based authentication to a remote LDAP server. This parameter is not supported for all idmap backends as some backends will generate SID to ID mappings algorithmically without causing network traffic.

options are additional parameters that are backend-dependent:

AD idmap backend options: unix_primary_group If True, the primary group membership is fetched from the LDAP attributes (gidNumber). If False, the primary group membership is calculated via the "primaryGroupID" LDAP attribute.

unix_nss_info if True winbind will retrieve the login shell and home directory from the LDAP attributes. If False or if the AD LDAP entry lacks the SFU attributes the smb4.conf parameters template shell and template homedir are used.

schema_mode Defines the schema that idmap_ad should use when querying Active Directory regarding user and group information. This can be either the RFC2307 schema support included in Windows 2003 R2 or the Service for Unix (SFU) schema. For SFU 3.0 or 3.5 please choose "SFU", for SFU 2.0 please choose "SFU20". The behavior of primary group membership is controlled by the unix_primary_group option.

AUTORID idmap backend options: readonly sets the module to read-only mode. No new ranges will be allocated and new mappings will not be created in the idmap pool.

ignore_builtin ignores mapping requests for the BUILTIN domain.

LDAP idmap backend options: ldap_base_dn defines the directory base suffix to use for SID/uid/gid mapping entries.

ldap_user_dn defines the user DN to be used for authentication.

ldap_url specifies the LDAP server to use for SID/uid/gid map entries.

ssl specifies whether to encrypt the LDAP transport for the idmap backend.

NSS idmap backend options: linked_service specifies the auxiliary directory service ID provider.

RFC2307 idmap backend options: domain specifies the domain for which the idmap backend is being created. Numeric id, short-form domain name, or long-form DNS domain name of the domain may be specified. Entry must be entered as it appears in idmap.domain.

range_low and range_high specify the UID and GID range for which this backend is authoritative.

ldap_server defines the type of LDAP server to use. This can either be an LDAP server provided by the Active Directory Domain (ad) or a stand-alone LDAP server.

bind_path_user specfies the search base where user objects can be found in the LDAP server.

bind_path_group specifies the search base where group objects can be found in the LDAP server.

user_cn query cn attribute instead of uid attribute for the user name in LDAP.

realm append @realm to cn for groups (and users if user_cn is set) in LDAP queries.

ldmap_domain when using the LDAP server in the Active Directory server, this allows one to specify the domain where to access the Active Directory server. This allows using trust relationships while keeping all RFC 2307 records in one place. This parameter is optional, the default is to access the AD server in the current domain to query LDAP records.

ldap_url when using a stand-alone LDAP server, this parameter specifies the LDAP URL for accessing the LDAP server.

ldap_user_dn defines the user DN to be used for authentication.

ldap_user_dn_password is the password to be used for LDAP authentication.

realm defines the realm to use in the user and group names. This is only required when using cn_realm together with a stand-alone ldap server.

RID backend options: sssd_compat generate idmap low range based on same algorithm that SSSD uses by default.

Delete a domain by id. Deletion of default system domains is not permitted. In case of registry config for clustered server, this will remove all smb4.conf entries for the domain associated with the id.

Returns a list of supported keys for the specified idmap backend.

Update a domain by id.

Create an initshutdown script task.

type indicates if a command or script should be executed at when.

There are three choices for when:

1) PREINIT - This is early in the boot process before all the services / rc scripts have started 2) POSTINIT - This is late in the boot process when most of the services / rc scripts have started 3) SHUTDOWN - This is on shutdown

timeout is an integer value which indicates time in seconds which the system should wait for the execution of script/command. It should be noted that a hard limit for a timeout is configured by the base OS, so when a script/command is set to execute on SHUTDOWN, the hard limit configured by the base OS is changed adding the timeout specified by script/command so it can be ensured that it executes as desired and is not interrupted by the base OS's limit.

Delete init/shutdown task of id.

Update initshutdown script task of id.

Return available interface choices that can be added to a br (bridge) interface.

id is name of existing bridge interface on the system that will have its member interfaces included.

After interfaces changes are committed with checkin timeout this method needs to be called within that timeout limit to prevent reverting the changes.

This is to ensure user verifies the changes went as planned and its working.

Returns whether or not we are waiting user to checkin the applied network changes before they are rolled back. Value is in number of seconds or null.

Choices of available network interfaces.

bridge_members will include BRIDGE members. lag_ports will include LINK_AGGREGATION ports. vlan_parent will include VLAN parent interface. exclude is a list of interfaces prefix to remove. include is a list of interfaces that should not be removed.

Commit/apply pending interfaces changes.

rollback as true (default) will rollback changes in case they fail to apply. checkin_timeout is the time in seconds it will wait for the checkin call to acknowledge the interfaces changes happened as planned from the user. If checkin does not happen within this period of time the changes will get reverted.

Create virtual interfaces (Link Aggregation, VLAN)

For BRIDGE type the following attribute is required: bridge_members.

For LINK_AGGREGATION type the following attributes are required: lag_ports, lag_protocol.

For VLAN type the following attributes are required: vlan_parent_interface, vlan_tag and vlan_pcp.

Delete Interface of id.

Returns whether there are pending interfaces changes to be applied or not.

Get all IPv4 / Ipv6 from all valid interfaces, excluding tap and epair.

loopback will return loopback interface addresses.

any will return wildcard addresses (0.0.0.0 and ::).

static when enabled will ensure we only return static ip's configured.

Returns a list of dicts - eg -

[ { "type": "INET6", "address": "fe80::5054:ff:fe16:4aac", "netmask": 64 }, { "type": "INET", "address": "192.168.122.148", "netmask": 24, "broadcast": "192.168.122.255" }, ]

Available lacpdu rate policies for the LACP lagg type interfaces.

Return available interface choices that can be added to a bond (lag) interface.

id is name of existing bond interface on the system that will have its member interfaces included.

Query Interfaces with query-filters and query-options

Rollback pending interfaces changes.

Returns which services will be set to listen on 0.0.0.0 (and, thus, restarted) on sync.

Example result: [ // Samba service will be set ot listen on 0.0.0.0 and restarted because it was set up to listen on // 192.168.0.1 which is being removed. {"type": "SYSTEM_SERVICE", "service": "cifs", "ips": ["192.168.0.1"]}, ]

Update Interface of id.

Return available interface choices for vlan_parent_interface attribute.

Returns the interface this websocket is connected to.

Returns the ip this websocket is connected to.

Available transmit hash policies for the LACP or LOADBALANCE lagg type interfaces.

Return enabled, disabled and supported capabilities (also known as features) on a given interface.

name String representing name of the interface

Enable or Disable capabilties (also known as features) on a given interface.

name String representing name of the interface capabilities List representing capabilities to be acted upon action String when set to 'ENABLE' will enable capabilities else if set to DISABLE will disable capabilities.

Return a list with the IPMI channels available.

Clear IPMI System Event Log

Turn on IPMI chassis identify light.

To turn off specify 0 as seconds.

Returns a boolean true value indicating if ipmi device is loaded.

Query all IPMI Channels with query-filters and query-options.

Query IPMI System Event Log

Update id IPMI Configuration.

ipaddress is a valid ip which will be used to connect to the IPMI interface.

netmask is the subnet mask associated with ipaddress.

dhcp is a boolean value which if unset means that ipaddress, netmask and gateway must be set.

Create an iSCSI Authorized Access.

tag should be unique among all configured iSCSI Authorized Accesses.

secret and peersecret should have length between 12-16 letters inclusive.

peeruser and peersecret are provided only when configuring mutual CHAP. peersecret should not be similar to secret.

Delete iSCSI Authorized Access of id.

Update iSCSI Authorized Access of id.

Create an iSCSI Extent.

When type is set to FILE, attribute filesize is used and it represents number of bytes. filesize if not zero should be a multiple of blocksize. path is a required attribute with type set as FILE.

With type being set to DISK, a valid ZVOL is required.

insecure_tpc when enabled allows an initiator to bypass normal access control and access any scannable target. This allows xcopy operations otherwise blocked by access control.

xen is a boolean value which is set to true if Xen is being used as the iSCSI initiator.

ro when set to true prevents the initiator from writing to this LUN.

Delete iSCSI Extent of id.

If id iSCSI Extent's type was configured to FILE, remove can be set to remove the configured file.

Return a dict of available zvols that can be used when creating an extent.

ignore is a list of paths (i.e. ['zvol/cargo/zvol01',]) that will be ignored and included in the returned dict of available zvols even if they are already being used. For example, if zvol/cargo/zvol01 has already been added to an extent, and you pass that path in to this method then it will be returned (even though it's being used).

Update iSCSI Extent of id.

Returns whether iSCSI ALUA is enabled or not.

Return currently connected clients count.

Get a list of currently running iSCSI sessions. This includes initiator and target names and the unique connection IDs.

alua is a no-op for FreeNAS.

Creates iSCSI host.

ip indicates an IP address of the host. description is a human-readable name for the host. iqns is a list of initiator iSCSI Qualified Names.

Update iSCSI host id.

Returns initiator groups associated with host id.

Returns targets associated with host id.

Associates initiator groups ids with host id. Use force if you want to allow adding first or removing last initiator from initiator groups.

Associates targets ids with host id.

Update iSCSI host id.

Create an iSCSI Initiator.

initiators is a list of initiator hostnames which are authorized to access an iSCSI Target. To allow all possible initiators, initiators can be left empty.

auth_network is a list of IP/CIDR addresses which are allowed to use this initiator. If all networks are to be allowed, this field should be left empty.

Delete iSCSI initiator of id.

Update iSCSI initiator of id.

Create a new iSCSI Portal.

discovery_authgroup is required for CHAP and CHAP_MUTUAL.

Delete iSCSI Portal id.

Returns possible choices for listen.ip attribute of portal create and update.

Update iSCSI Portal id.

Create an iSCSI Target.

groups is a list of group dictionaries which provide information related to using a portal, initiator, authmethod and auth with this target. auth represents a valid iSCSI Authorized Access and defaults to null.

Delete iSCSI Target of id.

Deleting an iSCSI Target makes sure we delete all Associated Targets which use id iSCSI Target.

Update iSCSI Target of id.

Create an Associated Target.

lunid will be automatically assigned if it is not provided based on the target.

Delete Associated Target of id.

Update Associated Target of id.