graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/ansible/roles/netbox
History
Graham McIntire fb5803c866
add FreeBSD bootstrap, irc servers, hostname overrides, and cleanups 
- bootstrap.yml: support pkg for FreeBSD sudo/python3 install
- base role: FreeBSD package sets, sudoers paths, host key regen, admin group, usermod process-in-use tolerance
- freebsd role: pkg update/upgrade tasks
- general role: standalone hostname tasks (ungated from network.skip), hostname_override support
- inspircd role: deploy configs for ca/us manero.org irc servers with vault-backed secrets
- uisp role: download and run installer on fresh hosts, skip if already running
- netbox role: stop services before usermod to avoid process-in-use failures
- hosts: add irc_servers group, ca/us.manero.org (Tailscale), drop staging.towerops.net
- all.yml: graham user gets static ed25519 key alongside github keys
2026-06-19 17:19:29 -05:00
..
defaults ansible: rewrite netbox role to match live netbox.vntx.net (bare-metal install) 2026-05-08 12:17:30 -05:00
handlers ansible: rewrite netbox role to match live netbox.vntx.net (bare-metal install) 2026-05-08 12:17:30 -05:00
tasks add FreeBSD bootstrap, irc servers, hostname overrides, and cleanups 2026-06-19 17:19:29 -05:00
templates ansible: rewrite netbox role to match live netbox.vntx.net (bare-metal install) 2026-05-08 12:17:30 -05:00
README.md ansible: rewrite netbox role to match live netbox.vntx.net (bare-metal install) 2026-05-08 12:17:30 -05:00

README.md

netbox role

Bare-metal NetBox install matching the live netbox.vntx.net layout:

  • Debian 13 (trixie) host
  • System PostgreSQL 17 + Redis 8
  • NetBox release tarball extracted under /opt/netbox-<version>, symlinked to /opt/netbox
  • Python venv managed by NetBox's bundled upgrade.sh
  • gunicorn bound to 127.0.0.1:8001 under systemd (netbox.service)
  • Background worker under netbox-rq.service
  • Reverse proxy via the repo's existing caddy role using the per-host template roles/caddy/templates/Caddyfile-netbox.vntx.net.j2

Required vault variables

The role refuses to render config without these. Put them in host_vars/netbox.vntx.net/vault.yml (encrypted with ansible-vault) or any equivalent secrets store:

netbox_secret_key: "<>= 50 random chars>"        # generate with /opt/netbox/netbox/generate_secret_key.py
netbox_db_password: "<postgres password>"
netbox_api_token_peppers:                         # optional, only if rotating peppers
  1: "<32+ random hex chars>"

Idempotency

Re-running the playbook against a host already at the target version is a no-op except for config rendering. To upgrade:

  1. Bump netbox_version in defaults or host_vars.
  2. Run the play. The role downloads the new tarball, re-points the /opt/netbox symlink, runs upgrade.sh (which handles venv + migrations
    • collectstatic), and bounces the systemd units.

What the role does NOT manage

  • The data inside NetBox (sites, devices, IPs, etc.). Use the netbox.netbox Ansible collection or NetBox's import APIs for that.
  • Postgres performance tuning beyond defaults (shared_buffers, etc.).
  • Off-host backups of the Postgres DB. Add a separate cron / restic job.