phpIPAM (IPAM)

Self-hosted phpIPAM (1.8.3, GPLv3) — open-source IP address management tool tracking the rack's subnets, VLANs and IP allocations.

Guest	srv-phpipam — Rocky Linux 9.8, VM 124 on rumba, 192.168.88.35, 1024 MB RAM, 30G (local-lvm, scsi0)
URL	http://srv-phpipam.isc3/ — no TLS yet
Source	phpipam/phpipam, branch 1.8, cloned straight to /var/www/html (no subfolder)
Version	1.8.3, schema/dbversion 46
Stack	Apache (httpd) + PHP 8.x (module php:remi-8.2, via Remi repo) + MariaDB 10.5
Database	MariaDB, database phpipam, user phpipam@localhost, bind-address restricted to 127.0.0.1
Auth	Local phpIPAM accounts only (Admin + any created since) — no Keycloak/SSO integration

Standing rules

No TLS yet

The site is served plain HTTP.

caution

root cannot authenticate the automatic DB installer

MariaDB's root@localhost uses unix_socket auth (set via mysql_secure_installation), which the phpIPAM web installer's password-based connection cannot satisfy. Re-running the automatic database install (e.g. after a schema reset) needs a temporary MySQL user with full privileges instead:

CREATE USER 'phpipam_install'@'localhost' IDENTIFIED BY '<temp password>';
GRANT ALL PRIVILEGES ON *.* TO 'phpipam_install'@'localhost' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Drop it again as soon as the installer succeeds.

Mail

Notifications (ping check, discovery check, IP requests) go out through the rack's outbound relay rather than a direct credential:

Setting	Value
Server address	srv-mail.isc3 (192.168.88.163), port 25, no auth/TLS
Admin mail	rack-admins@isc-vs.ch

Requires this guest's address to be present in mynetworks on srv-mail (provisioning/mail/deploy-relay.sh) — confirmed added 2026-09-21 (postconf mynetworks on CT 112 lists 192.168.88.35), otherwise mail is refused at Client host rejected (layer 1, see Email).

Networks tracked

Four subnets mirror the rack layout:

Subnet	Purpose
192.168.88.0/24	Main network — routers, NAS, PDU, server user interfaces
192.168.90.0/24	Management (iDRAC) — R630 spares and carnaval nodes
192.168.91.0/24	User/OS network — carnaval cluster nodes
192.168.92.0/24	Management (iDRAC) — rumba

Automatic discovery (fping + PHP pcntl, via functions/scripts/discoveryCheck.php and pingCheck.php on a 30-minute cron) runs on the subnets.

Operations

• Config: /var/www/html/config.php — DB credentials, BASE path, mail settings. $disable_installer = true; since initial setup; the /install/ scripts must not be re-enabled outside a maintenance window.
• SELinux: enforcing; httpd_can_network_connect on (needed for the DB/LDAP connections Apache makes on phpIPAM's behalf).
• Firewall: firewalld zone public allows http, ssh, cockpit, dhcpv6-client only — no rule for MySQL (3306); MariaDB is additionally bound to 127.0.0.1 as defense in depth.