Oxidized — network config backup

Oxidized pulls every network device's configuration on a schedule and commits each change to a local git repo, so "what changed on the router, and when" has an answer independent of anyone remembering to run the manual backup. Installed 2026-08-16, second pick of the admin wave from the service ideas.

Guest	srv-oxidized — unprivileged LXC, CT 114 on rumba, 192.168.88.165, 1 core / 1 GB / 6 GB local-lvm, nesting=1
URL	http://srv-oxidized.isc3/ — VPN/LAN only, no auth of its own (the VPN is the gate), not published through srv-web01
Devices	CCR2004 (.1) and CRS326 (.254), model routeros, polled hourly over SSH as the read-only oxidized account (policy ssh,read,sensitive, login restricted to .165; password in secretzone/isc3.md)
Data	git repo /var/lib/oxidized/devices.git in the CT — full /export including sensitive values, same content as the manual .rsc backups; leaves the rack only inside the PBS backup
Managed from	provisioning/oxidized/ — deploy-oxidized.sh (idempotent); add-router-user.sh creates the router account

Oxidized complements, not replaces, the manual MikroTik backup process: that one also captures the binary .backup (user accounts, certificates) and lands in this repo's git history; Oxidized catches every change within the hour with no human in the loop.

To add a device: append a name:ip:model line to provisioning/oxidized/router.db, create the read-only account on it, re-run the deploy script. The FS S3600 at .2 is the known gap — no credentials recorded (todo).

Open items: ops todo.