Ilker ManapandClaude Opus 5.5
44ac453bde
With ipam.ui_login_secret_file, the proxy tells NetBox who the admin is (X-Rollcall-User: the certificate's admin name) together with a shared secret (X-Rollcall-Proxy-Secret). NetBox takes the user from that header (REMOTE_AUTH) and creates it on first use; the web server in front of NetBox drops the header from any request that lacks the secret or does not come from the region, so reaching NetBox directly claims no one. Both headers coming from a browser are always dropped by Rollcall; an admin signed in with a token instead of a certificate logs in to NetBox by hand. A secret under 16 characters or an unreadable file leaves the proxy off, with a log line. The lab NetBox install sets it up: REMOTE_AUTH settings, a guarded Caddyfile (readable by caddy only: the secret is in it), the secret in secrets.env, and a rollcall-admins group that may do everything. Rollcall's NetBox user may now view cables. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>