The unattend FirstLogonCommands runs via 'cmd.exe /c' (command-line context),
where a FOR loop variable must be %d, not the batch-file form %%d. The %%d
form raised '%%d was unexpected at this time', so the else branch that locates
and runs FirstLogon.ps1 from the unattend ISO never executed.
Combined with $OEM$ not being processed from a separate ISO (so
C:\CLICD\FirstLogon.ps1 is never staged), the entire Windows post-install
init was skipped: RDP was never enabled, the firewall was never opened, and
the network profile stayed Public, so the guest dropped all inbound traffic.
The host NAT DNAT for 3389 was correct, but the guest silently dropped it,
making the mapping appear to have no effect.
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected.
- Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies.
- Add NAT network configuration with validation for RFC1918 compliance and subnet parsing.
- Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers.
- Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests.
- Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives.
- Include comprehensive tests for all new functionalities to ensure reliability and correctness.
LusineStar