bvm-netbox: complete setup

nix/pkgs/default.nix

@@ -31,5 +31,6 @@
   mercurial = with pkgs; (mercurial.overridePythonAttrs (origAttrs: {
     propagatedBuildInputs = [python3Packages.hg-evolve python3Packages.pygit2];
   }));
+  netbox = pkgs.python3Packages.callPackage ./netbox {};
 } // (import ./heptapod-runner.nix args)
   // (import ./lightspeed args)

nix/pkgs/netbox/default.nix

@@ -0,0 +1,98 @@
+{ buildPythonApplication
+, overrideScope
+, fetchFromGitHub
+, lib
+, callPackage
+, configuration ? ""
+, psycopg2
+}:
+
+let
+  deps = overrideScope (callPackage ./python-packages.nix {});
+in
+buildPythonApplication rec {
+  pname = "netbox";
+  version = "3.0-beta2";
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "05cwdkqs8vlpbn10pk8yj4a0ywp0x5h5ndf2a5zf4nlmg33d0sbi";
+  };
+
+  propagatedBuildInputs = (with deps; [
+    Django
+    django-cors-headers
+    django-debug-toolbar
+    django-filter
+    django-graphiql-debug-toolbar
+    django-mptt
+    django-pglocks
+    django-prometheus
+    django-redis
+    django-rq
+    django-tables2
+    django-taggit
+    django-timezone-field
+    djangorestframework
+    drf-yasg
+    graphene-django
+    gunicorn
+    Jinja2
+    Markdown
+    markdown-include
+    mkdocs-material
+    netaddr
+    pillow
+    pycryptodome
+    PyYAML
+    svgwrite
+    tablib
+
+    django-storages
+  ]) ++ [
+    psycopg2
+  ];
+
+  format = "other";
+
+  buildPhase = ''
+    runHook preBuild
+    # Do nothing.
+    runHook postBuild
+  '';
+
+  passAsFile = [ "configuration" ];
+  inherit configuration;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/netbox
+    cp -R . $out/share/netbox
+    PYVER="$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")"
+    PYDIR="$out/lib/python$PYVER"
+    mkdir -p $PYDIR
+    ln -s $out/share/netbox/netbox $PYDIR/site-packages
+    mkdir -p $out/bin
+    cp $out/share/netbox/netbox/manage.py $out/bin/netbox-manage
+
+    cat <<"EOF" >$out/bin/netbox-gunicorn
+    #!/usr/bin/python
+    import sys
+    from gunicorn.app.wsgiapp import run
+    if __name__ == '__main__':
+        sys.exit(run())
+    EOF
+    chmod +x $out/bin/netbox-gunicorn
+
+    cp $out/share/netbox/netbox/netbox/configuration.testing.py $out/share/netbox/netbox/netbox/configuration.py
+    PYTHONPATH=$PYDIR/site-packages:$PYTHONPATH python $out/bin/netbox-manage collectstatic --no-input
+
+    cp $configurationPath $out/share/netbox/netbox/netbox/configuration.py
+
+    runHook postInstall
+  '';
+
+  passthru.deps = deps;
+}

ops/nixos/bvm-netbox/default.nix

@@ -2,8 +2,131 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{ config, ... }:
-{
+{ config, depot, pkgs, ... }:
+let
+  inherit (depot.ops) secrets;
+
+  netbox = depot.nix.pkgs.netbox.override {
+    configuration = ''
+      ALLOWED_HOSTS = ["netbox.int.lukegb.com"]
+      DATABASE = {
+        'ENGINE': 'django.db.backends.postgresql',
+        'NAME': 'netbox',
+      }
+
+      REDIS = {
+        'tasks': {
+          'HOST': 'localhost',
+          'PORT': 6379,
+          'DATABASE': 0,
+          'SSL': False,
+        },
+        'caching': {
+          'HOST': 'localhost',
+          'PORT': 6379,
+          'DATABASE': 1,
+          'SSL': False,
+        },
+      }
+
+      SECRET_KEY = '${secrets.netbox.secretKey}'
+
+      ADMINS = []
+      ALLOWED_URL_SCHEMES = (
+        'file', 'ftp', 'ftps', 'http', 'https', 'irc', 'mailto', 'sftp', 'ssh', 'tel', 'telnet', 'tftp', 'vnc', 'xmpp',
+      )
+
+      BANNER_TOP = ""
+      BANNER_BOTTOM = ""
+      BANNER_LOGIN = ""
+      BASE_PATH = ""
+
+      CHANGELOG_RETENTION = 0
+
+      CORS_ORIGIN_ALLOW_ALL = False
+      CORS_ORIGIN_WHITELIST = []
+      CORS_ORIGIN_REGEX_WHITELIST = []
+
+      CUSTOM_VALIDATORS = {}
+
+      DEBUG = False
+
+      EMAIL = {}
+
+      ENFORCE_GLOBAL_UNIQUE = True
+
+      EXEMPT_VIEW_PERMISSIONS = []
+
+      GRAPHQL_ENABLED = False
+
+      INTERNAL_IPS = ('127.0.0.1', '::1')
+
+      LOGGING = {}
+
+      LOGIN_REQUIRED = True
+      LOGIN_TIMEOUT = None
+
+      MAINTENANCE_MODE = False
+
+      MAPS_URL = 'https://maps.google.com/?q='
+
+      MAX_PAGE_SIZE = 1000
+
+      MEDIA_ROOT = '/srv/netbox/media'
+
+      STORAGE_BACKEND = 'storages.backends.s3boto3.S3Boto3Storage'
+      STORAGE_CONFIG = {
+        'AWS_ACCESS_KEY_ID': "${secrets.netbox.s3.accessKey}",
+        'AWS_SECRET_ACCESS_KEY': "${secrets.netbox.s3.secretAccessKey}",
+        'AWS_STORAGE_BUCKET_NAME': 'netbox',
+        'AWS_S3_ENDPOINT_URL': 'https://objdump.zxcvbnm.ninja',
+        'AWS_S3_REGION_NAME': 'london',
+      }
+
+      METRICS_ENABLED = False
+
+      NAPALM_USERNAME = ""
+      NAPALM_PASSWORD = ""
+      NAPALM_TIMEOUT = 30
+      NAPALM_ARGS = {}
+
+      PAGINATE_COUNT = 50
+
+      PLUGINS = []
+
+      PREFER_IPV4 = False
+
+      RACK_ELEVATION_DEFAULT_UNIT_HEIGHT = 22
+      RACK_ELEVATION_DEFAULT_UNIT_WIDTH = 220
+
+      REMOTE_AUTH_ENABLED = False
+      REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
+      REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
+      REMOTE_AUTH_AUTO_CREATE_USER = True
+      REMOTE_AUTH_DEFAULT_GROUPS = []
+      REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
+
+      RELEASE_CHECK_URL = None
+
+      REPORTS_ROOT = '/srv/netbox/reports'
+
+      RQ_DEFAULT_TIMEOUT = 300
+
+      SCRIPTS_ROOT = '/srv/netbox/scripts'
+
+      SESSION_COOKIE_NAME = 'netboxsess'
+
+      TIME_ZONE = 'UTC'
+
+      DATE_FORMAT = 'Y-m-d'
+      SHORT_DATE_FORMAT = 'Y-m-d'
+      TIME_FORMAT = 'g:i a'
+      SHORT_TIME_FORMAT = 'H:i:s'
+      DATETIME_FORMAT = 'Y-m-d g:i a'
+      SHORT_DATETIME_FORMAT = 'Y-m-d H:i'
+    '';
+  };
+in {
   imports = [
     ../lib/bvm.nix
   ];
@@ -49,5 +172,53 @@
     group = "netbox";
   };
 
+  environment.systemPackages = with pkgs; [
+    netbox
+  ];
+
+  systemd.services.netbox-rq = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "netbox";
+      Group = "netbox";
+      WorkingDirectory = "/srv/netbox";
+      ExecStart = "${netbox}/bin/netbox-manage rqworker high default low";
+      Restart = "on-failure";
+      RestartSec = 30;
+      PrivateTmp = true;
+    };
+  };
+
+  systemd.services.netbox = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "netbox";
+      Group = "netbox";
+      WorkingDirectory = "/srv/netbox";
+      PIDFile = "/srv/netbox/gunicorn.pid";
+      ExecStart = "${netbox}/bin/netbox-gunicorn --pid /srv/netbox/gunicorn.pid --config ${netbox}/share/netbox/contrib/gunicorn.py netbox.wsgi";
+      Restart = "on-failure";
+      RestartSec = 30;
+      PrivateTmp = true;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."netbox.int.lukegb.com" = {
+      locations."/static/" = {
+        alias = "${netbox}/share/netbox/netbox/static/";
+      };
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8001";
+      };
+    };
+  };
+
   system.stateVersion = "21.05";
 }

ops/nixos/etheroute-lon01/default.nix

@@ -254,6 +254,7 @@ in {
         })
         (service "bvm-ipfs:5001" "ipfs.int.lukegb.com" {})
         (service "bvm-ipfs:8080" "ipfs-gw.int.lukegb.com" {})
+        (service "bvm-netbox:80" "netbox.int.lukegb.com" {})
       ];
     };
   };

web/int/index.html

@@ -22,8 +22,8 @@ SPDX-License-Identifier: Apache-2.0
 			<li><a href="https://twitterchiver.int.lukegb.com">twitterchiver</a></li>
 			<li><a href="https://hg.lukegb.com">hg (heptapod)</a></li>
 			<li><a href="https://rundeck.int.lukegb.com">rundeck</a></li>
+			<li><a href="https://netbox.int.lukegb.com">netbox</a></li>
 		</ul>
-		<!-- TODO(lukegb): pick a better redirect URI -->
-		<p><a href="/.pomerium/sign_out?pomerium_redirect_uri=https%3A%2F%2Fwww.google.com">Log out</a></p>
+		<p><a href="/.pomerium/sign_out?pomerium_redirect_uri=https%3A%2F%2Flogged-out.int.lukegb.com">Log out</a></p>
 	</body>
 </html>