Skip to main content

NetBox — DCIM/IPAM source of truth

NetBox records what the infrastructure should look like — racks, U positions, cables, VLANs, prefixes and IP assignments across both sites — so that the markdown tables stop being the only inventory and Ansible can read the same data as a dynamic inventory. Installed 2026-08-16, first pick of the admin wave from the service ideas.

Guestsrv-netbox — unprivileged LXC, CT 113 on rumba, 192.168.88.164, 2 cores / 4 GB / 12 GB local-lvm, nesting=1
URLhttp://srv-netbox.isc3/ — VPN/LAN only, plain HTTP, not published through srv-web01
VersionNetBox 4.6.8 (Aug 2026), native install: PostgreSQL 17 + Redis + gunicorn + Caddy in-container
LoginSSO via Keycloak (client netbox), restricted to the role-rack-admins group — members land as superuser. Local admin account at /login/ is the break-glass path (password in secretzone/rumba.md)
Managed fromprovisioning/netbox/ — deploy-netbox.sh is idempotent; re-running it upgrades to the latest NetBox release (NETBOX_VERSION=x.y.z to pin)
Backupwhole-CT via PBS like every guest

How the SSO gate works​

Keycloak's netbox client carries a group-membership mapper (claim groups); on the NetBox side oidc.py (pushed by the deploy script, untracked — it holds the client secret) rejects any login without role-rack-admins in the claim and grants staff+superuser to the rest. Adding an admin to NetBox = adding them to the role-rack-admins group in Keycloak, nothing NetBox-side.

Operations​

  • Initial content: seeded 2026-08-16 by provisioning/netbox/populate.py (idempotent, stdlib-only) from the then-current docs — the 39U rack with 30 devices and their mgmt/user IPs, the 7 logical prefixes, 13 VMs/CTs. From here NetBox is maintained in NetBox; the script is a seed, not a sync.
  • Upgrade: re-run provisioning/netbox/deploy-netbox.sh. It installs into a fresh /opt/netbox-<version> tree, carries configuration.py, oidc.py and media over, flips the /opt/netbox symlink and runs the official upgrade.sh.
  • API tokens: v2 tokens work (API_TOKEN_PEPPERS is set) — create them per consumer in the UI; the Ansible dynamic-inventory integration is an open item on the ops todo.
  • Housekeeping runs daily via the netbox-housekeeping systemd timer.

Open items: ops todo → Rumba.