FIX: The project account filters are searchable chip selects — the native multi-select needed Ctrl-click and its selection was barely visible on the dark themes
Checkmk
FIX: Setup Rules with "Loop over List" set but no list attribute are exported again instead of being skipped
FIX: Errors during the Checkmk rule export always show on the CLI as well, not only in the run's log entry
FEAT: The host debug page evaluates the Checkmk downtime rules too, including why a rule did not match
Interface
FEAT: Tidier navigation — Accounts and Cronjobs sit flat in the Settings menu (separated by dividers), Log is a top-level entry again, the Filemanager is now called "Files" and "Config Childs" is now "Account Overrides"
FEAT: The per-user actions (change password, 2FA, theme, logout) live in a profile icon menu on the right side of the navbar
FEAT: The Commit button carries the pending-changes counter inside it instead of a separate floating badge
FIX: The user list no longer styles every active user as a disabled row — the grayed-out marking now only applies to the Enabled column of rule lists
FIX: The Files admin path bar follows the active theme instead of Bootstrap's light default
FIX: Rule outcome previews (e.g. "Checkmk Outcomes") are readable on the dark themes — value and subtitle no longer render dark-on-dark
FIX: Template label group headers on the host edit form follow the active theme — they were a hardcoded light bar with unreadable text on the dark themes
FIX: Searchable dropdown fields (select2: selection, chips, open result list and search box) follow the active theme — they stayed white on the dark themes
Version 4.2.6
Projects
FEAT: Projects have their own top-level menu entry next to Modules; run ./cmdbsyncer sys self_configure once after the update so existing projects appear there
FEAT: Projects can exclude accounts — the project's members are never exported to the listed accounts, and the exclusion wins over "Exported to Accounts"
FEAT: Hosts can be assigned to a Project (host edit form or "Assign Project" bulk action in the host list) — the Checkmk host export then only pushes them to the accounts the project's account filter allows; the assignment never converts an imported host into a CMDB object
Checkmk
FIX: Checkmk Setup/DCD rule exports cache rule results per account, so project rules are no longer served from another account's cached outcomes — previously the first exporting account decided which project rules everyone else got
FIX: Opening the host debug page no longer overwrites the cached rule results used by the Checkmk rule export, and its Setup Rules table now shows on every visit instead of only the first
FIX: Editing, renaming or deleting a Checkmk Rule Project takes effect on the next export — renames keep the assigned rules attached, and filter changes clear the hosts' cached rule results
FIX: Importing a Rule Project from JSON keeps its account filter — imported projects no longer silently export to all accounts
Interface
FIX: The section cards of the modern rule edit forms (e.g. DCD rules: header bars and nested outcome/condition cards) follow the active theme instead of showing hardcoded light backgrounds on the dark themes
Rules
FIX: Editing or deleting a rule now clears the hosts' cached rule results, so exports pick up rule changes immediately instead of using outcomes cached before the edit
FIX: --debug-rules shows the rule evaluation on every run — an existing rule cache no longer silences the output
FEAT: --debug-rules shows the deciding condition per rule — which condition failed on a miss, which one matched on a hit
FIX: Rule list views no longer crash when a condition was created without negate flags (e.g. programmatically or via JSON import)
Version 4.2.5
Setup
FEAT: An account can override the global HTTP request timeout with a request_timeout custom field (value in seconds) — useful for slow target systems such as large distributed Checkmk setups, where downtime operations can take longer than the default 30 seconds
Checkmk
FIX: Downtime export is much faster on large inventories — it now reads all existing Checkmk downtimes in a single query instead of one per host, so runs that previously appeared to hang for minutes (one livestatus round-trip per matching host) finish quickly
FEAT: Downtime export ends with a status line showing how many downtimes were created, how many already existed in Checkmk and how many failed — a run where everything already exists no longer ends silently; the counts are also recorded in the run's log entry
Version 4.2.4
Checkmk
FIX: Downtime export now reports the real error — a Checkmk/livestatus timeout or connection problem while reading current downtimes is surfaced (and re-raised with --debug) instead of ending in a generic "Checkmk: Export Downtimes" failure with no detail; reading downtimes for a host that returns no data no longer aborts the run
FIX: Host export no longer logs "Created Host" when the host creation actually failed — the success line is now only printed when Checkmk accepted the host, so a failed single-host create is reported as an error instead of a false success
FIX: Exporting host tags to Checkmk 2.5 no longer fails with "Unknown field" — the tag group id field (renamed from ident to id in Checkmk 2.4) is now selected per Checkmk version, so 2.3 and older keep working too
FEAT: DCD rules can be flagged "static" — a host-independent DCD rule is rendered once and always created instead of being recalculated for every host, which speeds up the DCD export on large inventories (like the Setup rule static flag)
FIX: Exporting DCD rules works again on Checkmk 2.4 and 2.5 — the connector settings are now sent nested under a connector object as the REST API requires; before, the export failed with many "Unknown field" errors. Checkmk 2.3 keeps its two extra connector fields
FEAT: A DCD rule's site can be set to {{ cmk_site }}, which resolves to the exporting account's Checkmk site — so one rule targets the right site on a test and a prod instance with different site names; the field now shows this as a placeholder hint
FEAT: DCD rules can use {{ account.<field> }} to insert any (non-secret) attribute of the exporting Checkmk account — including per-account custom fields — so one rule adapts its values per account (e.g. test vs prod); passwords are never exposed
Netbox
FEAT: Netbox can now import interfaces of devices and virtual machines (analogous to the device and VM import) — each host's Netbox interfaces, including their assigned IP addresses, are stored on the host's inventory; with the account option import_as_hosts every interface is instead imported as its own host so it can be exported again
Jira
FEAT: jira export_cloud --debug now prints, per object, which fields it changes and their old and new value — so an object that keeps updating on every run (even with --dry-run) can be traced to the exact field responsible
Interface
FIX: Rule forms render fully theme-aware on the dark themes (Gruvbox, Dracula, Nord) — the nested outcome/condition field groups and their "Add …" buttons no longer show a hard-coded white/light background; nested cards, bg-light/bg-white utilities and the inline "Add" buttons now follow the active theme's surface colours everywhere
Version 4.2.3
Ansible
FIX: Playbook tasks delegated to localhost (delegate_to: localhost) no longer abort with "Failed to create temporary directory" under the web server — the local connection's temp dir now points at a writable per-run path instead of the web user's home
FEAT: Checkmk Settings gain an "installation staging path" — the Checkmk server-management playbook stages the downloaded installer there instead of /tmp; leave it empty to keep using /tmp. Use it when the executing user can't reliably use /tmp (permission or private-tmp isolation)
FIX: The Checkmk site-update playbook no longer fails the "set downtime" step with "401 Unauthorized" when no Checkmk API user/secret is configured — the downtime is skipped instead
FIX: Running a playbook from the UI no longer aborts with "cmdbsyncer binary not found" — the local-mode inventory now resolves the cmdbsyncer CLI from the venv even when the web server's PATH omits it
Setup
FIX: A fresh docker compose up from git now starts — the bundled compose stack was told to reach MongoDB on 127.0.0.1 (the app container itself) instead of the mongo service, so the API aborted on boot with Connection refused (gh #124)
Checkmk
FIX: Importing Setup Rules from a Checkmk folder now surfaces the real Checkmk error (e.g. wrong credentials) instead of silently reporting "0 rules imported"
FEAT: The Checkmk group export now honors an account's (or child account's) object filter for "Checkmk: Export Groups" — set it to include CMDB objects/shadow hosts in the group calculation; without a filter the export stays host-only as before
FEAT: The Checkmk module menu is tidier — "Setup Rule Projects" now sits next to "Manage Checkmk Setup Rules", "Limit Host Export to Folders" moved under the host filters, and the separate "Export Scoping" submenu is gone
FIX: "Limit Host Export to Folders" now lists rule folders in lowercase to match Checkmk's folder names, so the scope reliably matches the folders hosts are exported to
FEAT: "Limit Host Export to Folders" is easier to use — clicking a rule folder or typing one adds it to a list of selected folders you can remove individually, instead of editing a comma-separated text field
FEAT: Importing Setup Rules from a Checkmk folder into a project now shows a progress bar and status message while it runs, so you can see it is working
FEAT: Checkmk Setup Rules can reference a syncer Checkmk Password with {{ cmk_password("name") }}, which resolves to that entry's Checkmk password-store ident on export — run the password export so the entry exists in the target Checkmk
FEAT: Importing rules from a Checkmk folder now rewrites inline rule passwords (which Checkmk masks as ****** on read) into such password-store references, so imported rules deploy from a test to a production Checkmk without exposing or overwriting the secret — create a Checkmk Password with the reported name and export it
FEAT: The Checkmk rule export now respects an account's folder scope ("Limit Host Export to Folders") — a scoped account only receives Setup rules whose target folder is in scope, just like the host export
FEAT: DCD rules can be assigned to a Rule Project — they show on the project overview, follow the project's account filter on export (only exported to the accounts the project allows), and are included in the project's JSON export/import; the project list gains an "Import project from JSON" button
Interface
FIX: Card-style admin form pages (e.g. the "New Account" plugin-type picker) render with consistent padding and a theme-aware header in all four themes, instead of a header hanging off the edge of a flat card
Version 4.2.0
Hosts
FIX: Inventorize runs now update a host's "Last Import Seen" (and "Last Import Sync" when the inventory actually changed), so hosts fed only by an inventorize source no longer show stale import timestamps; lifecycle/archive state is deliberately left untouched
FIX: An account named "cmdb" no longer has its imported hosts wrongly locked as syncer-managed objects — they can be re-imported and updated as normal
FIX: Bad regex / unsupported expressions in the host search box no longer return a 500 — MongoDB-side regex errors are caught and shown as a flash message, the search box keeps the user's expression so they can correct it
FIX: {{ACCOUNT:name:field}} macros in rule values now tolerate surrounding spaces ({{ ACCOUNT:name:field }}), and a macro pointing at a missing account no longer crashes rule rendering or the debug page — it resolves to an empty value instead
Checkmk
FIX: Host import/sync with "get hosts by folder" enabled no longer fails on Checkmk 2.4 and newer with include_links: Unknown field — that parameter is not valid on the per-folder hosts endpoint (only on the global host collection), and Checkmk 2.4+ rejects unknown query fields where 2.3 silently ignored them
FIX: Rule management no longer creates a rule twice when an outcome with condition "anyway" pins a fixed host as its condition host — the identical rule is now exported only once
FEAT: Checkmk setup rules can be flagged "static" — a host-independent rule is then rendered once and always created instead of being recalculated for every host, which noticeably speeds up the rule export on large inventories
FEAT: Setup rules can be grouped into projects that limit where their rules are exported — a project's "Exported to Accounts" filter restricts its rules to the listed Checkmk accounts during the normal rule export (leave it empty to export everywhere like ordinary rules); projects can be im-/exported as JSON to move them between syncer instances
FEAT: A rule project can import all existing Setup Rules of a chosen folder from a selected Checkmk account with one click (optionally including subfolders); re-running the import updates the same rules instead of creating duplicates
FEAT: Clicking a rule project opens a project page that lists its assigned Setup Rules (with each rule's condition and value) and offers the folder import and JSON export right on that page
FEAT: A Checkmk account's host export can be limited to selected folders (subfolders included) via the new "Limit Host Export to Folders" page — pick folders produced by your rules or add custom ones; only that account is affected and its export then pushes only the hosts of those folders
FEAT: Editing a Setup Rule Project now shows direct links to the Setup Rules that belong to that project and to the project overview
FEAT: The Setup Rule Project overview now shows each rule's match condition and the resulting rule value, so it is clear what every assigned rule does
FIX: Opening the Checkmk Setup Rules list filtered or searched by project no longer errors
Ansible
FEAT: Ansible projects can seed a ready-made Checkmk agent-management rule set (cmk_agent_mngmt.yml) with one click — a base rule with all variables plus conditional rules that install and register the agent only where Checkmk reports it is needed; adapt the values and enable
FEAT: The project workspace is more informative and editable — each rule shows its match type, conditions and outcomes at a glance, and you can enable/disable a rule from its status badge or delete it inline; the Ansible menu is regrouped into Projects, Run Playbook, Run History and a single "Rules" submenu
FEAT: "Run Playbook" from the UI now works end to end — it finds the inventory plugin and serves the provider you pick (the duplicate "Default" provider entry is gone), accepts an SSH user and password (via sshpass, now bundled in the Docker image), streams the log live on the self-refreshing detail page, and can be cancelled; a run whose inventory cannot be parsed is recorded as a failure instead of a success
FIX: The host debug page (Ansible mode) shows the evaluated variables again and lets you pick which project's rules to preview — it previously evaluated an empty rule set and showed nothing
Netbox
FEAT: The Netbox import filter accepts the same key more than once (e.g. role:router,role:firewall) to import devices matching any of the given values
VMware
FEAT: New inventorize_vm_hardware command collects the VMs' virtual hardware (resource pool, ESXi host, VMware Tools version, CPU/memory, network-card and disk counts, virtual disks, network cards, IDE/SCSI controllers, datastores, networks) into a _hardware inventory key
FEAT: inventorize_custom_attributes now collects only the VMs' vCenter Custom Attributes, cleanly separated from the hardware inventory
FEAT: An inventory_filter account setting limits both inventories and the custom-attribute export to VMs matching any collected attribute, e.g. power_state:poweredOn or power_state:poweredOn,guest_os:Linux (same key repeated = OR, different keys = AND); new accounts default to power_state:poweredOn, clear it to process all VMs
FEAT: All VMware commands accept --dry-run, which reports what would change without writing custom attributes to vCenter or inventory data to the Syncer
FIX: Custom-attribute export no longer rewrites a VM attribute whose value is unchanged but empty — only attributes that actually differ from the value already on the VM are written to vCenter
FEAT: Custom-attribute export with --debug reports per attribute whether it is written or skipped and why (value differs from the one on the VM, or not set yet)
FEAT: VMware accounts honour the verify_cert setting to disable vCenter SSL certificate validation, and ca_cert_chain / ca_root_cert to validate against a custom CA certificate
Jira Cloud
FEAT: The host debug page can preview the Jira Cloud export — pick "Jira Cloud Export" to see which filter/rewrite/export rules match a host and which object fields would be written
FEAT: A new "Jira" permission role grants access to the Jira Cloud rule views and debug preview without making a user a full admin
FIX: The export_cloud progress output renders its status colours correctly instead of printing raw escape codes like [92m
FEAT: export_cloud accepts --dry-run, which reports which objects would be created or updated in Jira without writing anything
FEAT: A new update_only account setting makes the export update existing Jira objects only and skip hosts that have no matching object instead of creating one
FEAT: sync_schema --debug now lists every cached attribute per object type (id, type, editable/read-only) so you can verify which (inherited) attributes were actually synchronised
FEAT: The Schema Cache view lets you expand each object type to see its synchronised attributes (id, type, editable/read-only)
FEAT: The export rule's Field Mapping dropdown now prefixes each entry with its account, so you can tell which account/schema an attribute comes from once several schemas are cached
Setup
FEAT: The Ansible dependencies for Windows targets (WinRM + Kerberos/NTLM) are split into a separate requirements-ansible-windows.txt (pip install cmdbsyncer[ansible-windows]), so Linux-only installs no longer pull in packages that need system Kerberos libraries
FEAT: The offline bundle builder is now configurable — base dependencies are always bundled while extras, Ansible and Ansible-Windows are opt-in (--with-extras / --with-ansible / --with-ansible-windows); cmdbsyncer itself can come from PyPI (--include-syncer) or the current local checkout (--syncer-from-git); and --syncer-only ships just the syncer and installs it with --no-deps to update an existing install without re-downloading or changing its dependencies
UI / Themes
FIX: The account list's custom-attribute rows no longer show a light background on dark themes (Gruvbox / Dracula / Nord) — the nested key/value table now stays theme-transparent
FIX: Rule overview lists render Jinja templates and filter outcomes as a plain theme-aware code block instead of a hard-coded light-gray syntax-highlighted box that read as washed out on dark themes; the previous Pygments highlighter never actually rendered colours because no Pygments stylesheet was loaded
FIX: Deactivated rules in list views no longer render in washed-out library defaults — Gruvbox / Dracula / Nord now style the x-editable inline link (.editable-click, .editable-empty) and the deactivated state (fa-minus-circle) with theme-aware colours; the active boolean stays green (fa-check-circle)
FIX: Pagination numbers at the bottom of list views are visible across all four themes — pagination rules now use !important and explicitly style the disabled / hover / active state so Bootstrap defaults can't leak through
FEAT: The cmdbsyncer logo is now used in the navigation header, on the login and password-reset screens, and as the browser tab favicon