4 Commits

Include renames

Author	SHA1	Message	Date
Ilker ManapandClaude Opus 5.5	44ac453bde	NetBox through Rollcall: the admin certificate signs in to NetBox ... With ipam.ui_login_secret_file, the proxy tells NetBox who the admin is (X-Rollcall-User: the certificate's admin name) together with a shared secret (X-Rollcall-Proxy-Secret). NetBox takes the user from that header (REMOTE_AUTH) and creates it on first use; the web server in front of NetBox drops the header from any request that lacks the secret or does not come from the region, so reaching NetBox directly claims no one. Both headers coming from a browser are always dropped by Rollcall; an admin signed in with a token instead of a certificate logs in to NetBox by hand. A secret under 16 characters or an unreadable file leaves the proxy off, with a log line. The lab NetBox install sets it up: REMOTE_AUTH settings, a guarded Caddyfile (readable by caddy only: the secret is in it), the secret in secrets.env, and a rollcall-admins group that may do everything. Rollcall's NetBox user may now view cables. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 14:19:10 +01:00
Ilker ManapandClaude Opus 5.5	d2624b2fc2	NetBox proxy: one route per method, beside the UI's "GET /" ... A bare "/netbox/" pattern conflicts with "GET /" in ServeMux (neither is more specific), and the region panicked at start once ipam.url carried a path. The proxy is registered per method now, and a test builds the routes with it. The lab install script's own API calls use the new /netbox/ base. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 12:29:13 +01:00
Ilker ManapandClaude Opus 5.5	cc1245da1e	NetBox's web UI through Rollcall, and links to it from the web UI ... With NetBox as the IPAM under a path (its BASE_PATH) and ipam.url carrying it, Rollcall serves NetBox's UI at that same path, for admins only (the admin certificate, as for the API); NetBox keeps its own login. Redirects that name NetBox's own address are turned back to Rollcall's, Rollcall's credentials are not passed on. NetBox opens wherever Rollcall does: a lab NetBox on a segment the browser cannot reach, say. The web UI links to NetBox: the sidebar, sites, rooms, racks, switches and a machine's device (by its rollcall_machine field). ipam.ui_url points the links at NetBox directly instead. NetBox paging under a BASE_PATH doubled the path on the next page (the next link carries it already); fixed. The lab NetBox moves under /netbox/ and trusts the region's addresses for its forms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 12:21:22 +01:00
Ilker ManapandClaude Opus 5.5	133b5f38d9	NetBox device sync; lab NetBox container ... ipam.device_sync mirrors commissioned machines as dcim devices: serial, device type and role (created when missing), status, interfaces with MAC objects, Rollcall's addresses assigned to them and the management address as primary IP. Site, location and rack are matched by name from the machine's location and never created. Ownership by tag and rollcall_machine; a foreign device of the same name is a conflict. lab/netbox/install.sh sets up a NetBox on the lab segment so the drivers are tested without writing to a real NetBox. Refs #10 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-30 22:00:43 +01:00