Record a new boost and persist state.

Check if a container resource is currently boosted.

Increment saturation counter. Return True if threshold met for N samples.

Check that a URL does not point to internal/private network addresses (SSRF prevention).

Schedule a coroutine as a background task with reference tracking.

Map config string to a Paramiko host-key policy. ``"reject"`` (default) — refuse unknown hosts (safe). ``"system"`` — warn on unknown but all

Recursively expand ${ENV_VAR} and ${ENV_VAR:-default} in strings.

Send notification in a background thread — never blocks the event loop.

Clean up SSH pool if remote mode was used.

Get or create the singleton AppConfig.

Return a per-container async lock via the state cache.

Return timezone-aware current time using configured timezone.

Remove boost records for containers no longer active.

Return cached core count or None.

Determine if the current time is within off-peak hours (timezone-aware).

Load and validate the full application configuration.

Execute a command on the remote host (async, non-blocking).

Cache core count. Never stores 0.

Configure logging with console and file handlers + secret masking.

Handle boost/revert scaling for a single container.

Compute boosted value with fallback. Returns (new_value, factor_used) or (None, 0) if neither fits. For CPU (cores): rounds up to int

Return a per-container async lock, creating on first access.

Remove boost record and return original value for revert command. Returns the original value to revert to, or None if not boosted.

Reset module-level state between tests.

Persist active boosts to JSON file.

Context manager to acquire an exclusive lock on the lock file. Prevents multiple daemon instances from running concurrently. The lock is rele

Return True if settings match last backup (skip write).

Get the active boost record, if any.

Get the global ContainerStateCache singleton.

Check if cgroup CPU path discovery should be skipped.

Load persisted boost state from JSON file.

Reconcile persisted boosts against live Proxmox config. For each persisted boost: - If container doesn't exist: remove boost

Remove a single boost record and persist.

Synchronous SSH command execution (called in a thread).

Check if admin changed the value during boost. Returns True if live config differs from boosted value, meaning an admin modified it v

Legacy function-level accessor.

Return list of (resource, record) for expired boosts on a container.

Build SSHConfig from flattened legacy fields.

Return True if pinning matches last applied state.

Reset saturation counter (after boost applied or revert).

Override secrets from environment variables.

Warn if the config file is readable by group or others.

Return current hour in the configured timezone.

Get core count — use cache first, fall back to pct config. Never returns 0.

Resolve symlinks and verify the path stays within allowed_dir.

Admin changed config during boost — adopt as new baseline.

Apply CPU core pinning only if it differs from last applied state.

Close all pooled connections.

Factory: create the appropriate backend from config.

Check if cgroup memory path discovery should be skipped.

Record that a backup was written.

Record that pinning was applied.