With NetBox as the IPAM under a path (its BASE_PATH) and ipam.url carrying it, Rollcall serves NetBox's UI at that same path, for admins only (the admin certificate, as for the API); NetBox keeps its own login. Redirects that name NetBox's own address are turned back to Rollcall's, Rollcall's credentials are not passed on. NetBox opens wherever Rollcall does: a lab NetBox on a segment the browser cannot reach, say. The web UI links to NetBox: the sidebar, sites, rooms, racks, switches and a machine's device (by its rollcall_machine field). ipam.ui_url points the links at NetBox directly instead. NetBox paging under a BASE_PATH doubled the path on the next page (the next link carries it already); fixed. The lab NetBox moves under /netbox/ and trusts the region's addresses for its forms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>