drop my own netbox build in favour of nixpkgs

ci-root.nix

@@ -36,7 +36,7 @@ let
       home-manager = depot.ops.home-manager-ext.built;
     };
     aarch64-linux = builtins.removeAttrs x86_64-linux [ "home-manager" "pkg-authentik" ] // {
-      pkgs = builtins.removeAttrs x86_64-linux.pkgs [ "lutris" "plex-pass" "sheepshaver" "fr24feed" "netbox" "javaws-env" "copybara" ];
+      pkgs = builtins.removeAttrs x86_64-linux.pkgs [ "lutris" "plex-pass" "sheepshaver" "fr24feed" "javaws-env" "copybara" ];
     };
     x86_64-darwin = {
       home-manager = {

nix/pkgs/default.nix

@@ -30,7 +30,6 @@
   mercurial = pkgs.mercurialFull.withExtensions (pm: with pm; [
     hg-evolve
   ]);
-  netbox = pkgs.python3Packages.callPackage ./netbox {};
   ubi_reader = pkgs.python3Packages.callPackage ./ubi_reader {};
   prometheus-bird-exporter-lfty = pkgs.callPackage ./prometheus-bird-exporter-lfty.nix {};
   eapol-test = pkgs.callPackage ./eapol-test.nix {};

nix/pkgs/netbox/default.nix

@@ -1,105 +0,0 @@
-{ buildPythonApplication
-, overrideScope
-, fetchFromGitHub
-, lib
-, callPackage
-, configuration ? ""
-, psycopg2
-}:
-
-let
-  deps = overrideScope (callPackage ./python-packages.nix {});
-in
-buildPythonApplication rec {
-  pname = "netbox";
-  version = "3.2.5";
-
-  src = fetchFromGitHub {
-    owner = "netbox-community";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0blqlfl7djl1zb92cvqndy5l8drn0axjjqvhjc1q881h3sif123w";
-  };
-
-  propagatedBuildInputs = (with deps; [
-    bleach
-    django
-    django-cors-headers
-    django-debug-toolbar
-    django-filter
-    django-graphiql-debug-toolbar
-    django-mptt
-    django-pglocks
-    django-prometheus
-    django-redis
-    django-rq
-    django-tables2
-    django-taggit
-    django-timezone-field
-    djangorestframework
-    drf-yasg
-    graphene-django
-    gunicorn
-    Jinja2
-    Markdown
-    markdown-include
-    mkdocs-material
-    mkdocstrings
-    mkdocstrings-python-legacy
-    netaddr
-    pillow
-    PyYAML
-    sentry-sdk
-    social-auth-app-django
-    social-auth-core
-    svgwrite
-    tablib
-    tzdata
-    jsonschema
-
-    django-storages
-  ]) ++ [
-    psycopg2
-  ];
-
-  format = "other";
-
-  buildPhase = ''
-    runHook preBuild
-    # Do nothing.
-    runHook postBuild
-  '';
-
-  passAsFile = [ "configuration" ];
-  inherit configuration;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/netbox
-    cp -R . $out/share/netbox
-    PYVER="$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")"
-    PYDIR="$out/lib/python$PYVER"
-    mkdir -p $PYDIR
-    ln -s $out/share/netbox/netbox $PYDIR/site-packages
-    mkdir -p $out/bin
-    cp $out/share/netbox/netbox/manage.py $out/bin/netbox-manage
-
-    cat <<"EOF" >$out/bin/netbox-gunicorn
-    #!/usr/bin/python
-    import sys
-    from gunicorn.app.wsgiapp import run
-    if __name__ == '__main__':
-        sys.exit(run())
-    EOF
-    chmod +x $out/bin/netbox-gunicorn
-
-    cp $out/share/netbox/netbox/netbox/configuration_testing.py $out/share/netbox/netbox/netbox/configuration.py
-    PYTHONPATH=$PYDIR/site-packages:$PYTHONPATH python $out/bin/netbox-manage collectstatic --no-input
-
-    cp $configurationPath $out/share/netbox/netbox/netbox/configuration.py
-
-    runHook postInstall
-  '';
-
-  passthru.deps = deps;
-}

ops/nixos/bvm-netbox/default.nix

@@ -6,126 +6,101 @@
 let
   inherit (depot.ops) secrets;
 
-  netbox = depot.nix.pkgs.netbox.override {
+  netboxConfiguration = ''
-    configuration = ''
+    SECRET_KEY = '${secrets.netbox.secretKey}'
-      ALLOWED_HOSTS = ["netbox.int.lukegb.com"]
-      DATABASE = {
-        'ENGINE': 'django.db.backends.postgresql',
-        'NAME': 'netbox',
-      }
 
-      REDIS = {
+    ADMINS = []
-        'tasks': {
+    ALLOWED_URL_SCHEMES = (
-          'HOST': 'localhost',
+      'file', 'ftp', 'ftps', 'http', 'https', 'irc', 'mailto', 'sftp', 'ssh', 'tel', 'telnet', 'tftp', 'vnc', 'xmpp',
-          'PORT': 6379,
+    )
-          'DATABASE': 0,
-          'SSL': False,
-        },
-        'caching': {
-          'HOST': 'localhost',
-          'PORT': 6379,
-          'DATABASE': 1,
-          'SSL': False,
-        },
-      }
 
-      SECRET_KEY = '${secrets.netbox.secretKey}'
+    BANNER_TOP = ""
+    BANNER_BOTTOM = ""
+    BANNER_LOGIN = ""
+    BASE_PATH = ""
 
-      ADMINS = []
+    CHANGELOG_RETENTION = 0
-      ALLOWED_URL_SCHEMES = (
-        'file', 'ftp', 'ftps', 'http', 'https', 'irc', 'mailto', 'sftp', 'ssh', 'tel', 'telnet', 'tftp', 'vnc', 'xmpp',
-      )
 
-      BANNER_TOP = ""
+    CORS_ORIGIN_ALLOW_ALL = False
-      BANNER_BOTTOM = ""
+    CORS_ORIGIN_WHITELIST = []
-      BANNER_LOGIN = ""
+    CORS_ORIGIN_REGEX_WHITELIST = []
-      BASE_PATH = ""
 
-      CHANGELOG_RETENTION = 0
+    CUSTOM_VALIDATORS = {}
 
-      CORS_ORIGIN_ALLOW_ALL = False
+    DEBUG = False
-      CORS_ORIGIN_WHITELIST = []
-      CORS_ORIGIN_REGEX_WHITELIST = []
 
-      CUSTOM_VALIDATORS = {}
+    EMAIL = {}
 
-      DEBUG = False
+    ENFORCE_GLOBAL_UNIQUE = True
 
-      EMAIL = {}
+    EXEMPT_VIEW_PERMISSIONS = []
 
-      ENFORCE_GLOBAL_UNIQUE = True
+    GRAPHQL_ENABLED = False
 
-      EXEMPT_VIEW_PERMISSIONS = []
+    INTERNAL_IPS = ('127.0.0.1', '::1')
 
-      GRAPHQL_ENABLED = False
+    LOGIN_REQUIRED = True
+    LOGIN_TIMEOUT = None
 
-      INTERNAL_IPS = ('127.0.0.1', '::1')
+    MAINTENANCE_MODE = False
 
-      LOGGING = {}
+    MAPS_URL = 'https://maps.google.com/?q='
 
-      LOGIN_REQUIRED = True
+    MAX_PAGE_SIZE = 1000
-      LOGIN_TIMEOUT = None
 
-      MAINTENANCE_MODE = False
+    MEDIA_ROOT = '/srv/netbox/media'
 
-      MAPS_URL = 'https://maps.google.com/?q='
+    STORAGE_BACKEND = 'storages.backends.s3boto3.S3Boto3Storage'
+    STORAGE_CONFIG = {
+      'AWS_ACCESS_KEY_ID': "${secrets.netbox.s3.accessKey}",
+      'AWS_SECRET_ACCESS_KEY': "${secrets.netbox.s3.secretAccessKey}",
+      'AWS_STORAGE_BUCKET_NAME': 'netbox',
+      'AWS_S3_ENDPOINT_URL': 'https://objdump.zxcvbnm.ninja',
+      'AWS_S3_REGION_NAME': 'london',
+    }
 
-      MAX_PAGE_SIZE = 1000
+    METRICS_ENABLED = False
 
-      MEDIA_ROOT = '/srv/netbox/media'
+    NAPALM_USERNAME = ""
+    NAPALM_PASSWORD = ""
+    NAPALM_TIMEOUT = 30
+    NAPALM_ARGS = {}
 
-      STORAGE_BACKEND = 'storages.backends.s3boto3.S3Boto3Storage'
+    PAGINATE_COUNT = 50
-      STORAGE_CONFIG = {
-        'AWS_ACCESS_KEY_ID': "${secrets.netbox.s3.accessKey}",
-        'AWS_SECRET_ACCESS_KEY': "${secrets.netbox.s3.secretAccessKey}",
-        'AWS_STORAGE_BUCKET_NAME': 'netbox',
-        'AWS_S3_ENDPOINT_URL': 'https://objdump.zxcvbnm.ninja',
-        'AWS_S3_REGION_NAME': 'london',
-      }
 
-      METRICS_ENABLED = False
+    PLUGINS = []
 
-      NAPALM_USERNAME = ""
+    PREFER_IPV4 = False
-      NAPALM_PASSWORD = ""
-      NAPALM_TIMEOUT = 30
-      NAPALM_ARGS = {}
 
-      PAGINATE_COUNT = 50
+    RACK_ELEVATION_DEFAULT_UNIT_HEIGHT = 22
+    RACK_ELEVATION_DEFAULT_UNIT_WIDTH = 220
 
-      PLUGINS = []
+    REMOTE_AUTH_ENABLED = False
+    REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
+    REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
+    REMOTE_AUTH_AUTO_CREATE_USER = True
+    REMOTE_AUTH_DEFAULT_GROUPS = []
+    REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
 
-      PREFER_IPV4 = False
+    RELEASE_CHECK_URL = None
 
-      RACK_ELEVATION_DEFAULT_UNIT_HEIGHT = 22
+    REPORTS_ROOT = '/srv/netbox/reports'
-      RACK_ELEVATION_DEFAULT_UNIT_WIDTH = 220
 
-      REMOTE_AUTH_ENABLED = False
+    RQ_DEFAULT_TIMEOUT = 300
-      REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
-      REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
-      REMOTE_AUTH_AUTO_CREATE_USER = True
-      REMOTE_AUTH_DEFAULT_GROUPS = []
-      REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
 
-      RELEASE_CHECK_URL = None
+    SCRIPTS_ROOT = '/srv/netbox/scripts'
 
-      REPORTS_ROOT = '/srv/netbox/reports'
+    SESSION_COOKIE_NAME = 'netboxsess'
 
-      RQ_DEFAULT_TIMEOUT = 300
+    TIME_ZONE = 'UTC'
 
-      SCRIPTS_ROOT = '/srv/netbox/scripts'
+    DATE_FORMAT = 'Y-m-d'
-
+    SHORT_DATE_FORMAT = 'Y-m-d'
-      SESSION_COOKIE_NAME = 'netboxsess'
+    TIME_FORMAT = 'g:i a'
-
+    SHORT_TIME_FORMAT = 'H:i:s'
-      TIME_ZONE = 'UTC'
+    DATETIME_FORMAT = 'Y-m-d g:i a'
-
+    SHORT_DATETIME_FORMAT = 'Y-m-d H:i'
-      DATE_FORMAT = 'Y-m-d'
+  '';
-      SHORT_DATE_FORMAT = 'Y-m-d'
-      TIME_FORMAT = 'g:i a'
-      SHORT_TIME_FORMAT = 'H:i:s'
-      DATETIME_FORMAT = 'Y-m-d g:i a'
-      SHORT_DATETIME_FORMAT = 'Y-m-d H:i'
-    '';
-  };
 in {
   imports = [
     ../lib/bvm.nix
@@ -150,62 +125,51 @@ in {
   my.ip.tailscale = "100.81.27.52";
   my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:6251:1b34";
 
-  services.postgresql = {
-    enable = true;
-    ensureDatabases = [
-      "netbox"
-    ];
-    ensureUsers = [{
-      name = "netbox";
-      ensurePermissions = { "DATABASE netbox" = "ALL PRIVILEGES"; };
-    }];
-  };
   services.postgresqlBackup.enable = true;
 
-  services.redis.servers."" = {
+  my.vault.secrets.netbox-secret-key = {
+    restartUnits = ["netbox.service"];
+    group = "root";
+    template = ''
+      {{ with secret "kv/apps/netbox" }}
+      {{ .Data.data.secret-key }}
+      {{ end }}
+    '';
+  };
+  my.vault.secrets.netbox-s3-access-key = {
+    restartUnits = ["netbox.service"];
+    group = "root";
+    template = ''
+      {{ with secret "kv/apps/netbox" }}
+      {{ .Data.data.s3-access-key }}
+      {{ end }}
+    '';
+  };
+  my.vault.secrets.netbox-s3-secret-access-key = {
+    restartUnits = ["netbox.service"];
+    group = "root";
+    template = ''
+      {{ with secret "kv/apps/netbox" }}
+      {{ .Data.data.s3-secret-access-key }}
+      {{ end }}
+    '';
+  };
+
+  services.netbox = {
     enable = true;
-  };
+    dataDir = "/srv/netbox";
-
+    extraConfig = lib.mkAfter (netboxConfiguration + ''
-  users.groups.netbox = {};
+      with open("${config.my.vault.secrets.netbox-s3-access-key.path}", "r") as f:
-  users.users.netbox = {
+        STORAGE_CONFIG['AWS_ACCESS_KEY_ID'] = f.readline()
-    home = "/srv/netbox";
+      with open("${config.my.vault.secrets.netbox-s3-secret-access-key.path}", "r") as f:
-    isSystemUser = true;
+        STORAGE_CONFIG['AWS_SECRET_ACCESS_KEY'] = f.readline()
-    createHome = true;
+    '');
-    group = "netbox";
+    listenAddress = "127.0.0.1";
-  };
+    port = 8001;
-
+    package = pkgs.netbox_3_6;
-  environment.systemPackages = with pkgs; [
+    secretKeyFile = config.my.vault.secrets.netbox-secret-key.path;
-    netbox
+    settings = {
-  ];
+      ALLOWED_HOSTS = ["netbox.int.lukegb.com"];
-
-  systemd.services.netbox-rq = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" ];
-    serviceConfig = {
-      Type = "simple";
-      User = "netbox";
-      Group = "netbox";
-      WorkingDirectory = "/srv/netbox";
-      ExecStart = "${netbox}/bin/netbox-manage rqworker high default low";
-      Restart = "on-failure";
-      RestartSec = 30;
-      PrivateTmp = true;
-    };
-  };
-
-  systemd.services.netbox = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" ];
-    serviceConfig = {
-      Type = "simple";
-      User = "netbox";
-      Group = "netbox";
-      WorkingDirectory = "/srv/netbox";
-      PIDFile = "/srv/netbox/gunicorn.pid";
-      ExecStart = "${netbox}/bin/netbox-gunicorn --pid /srv/netbox/gunicorn.pid --config ${netbox}/share/netbox/contrib/gunicorn.py netbox.wsgi";
-      Restart = "on-failure";
-      RestartSec = 30;
-      PrivateTmp = true;
     };
   };
 
@@ -214,7 +178,7 @@ in {
     recommendedProxySettings = true;
     virtualHosts."netbox.int.lukegb.com" = {
       locations."/static/" = {
-        alias = "${netbox}/share/netbox/netbox/static/";
+        alias = "/srv/netbox/static";
       };
       locations."/" = {
         proxyPass = "http://127.0.0.1:8001";

ops/vault/cfg/config.nix

@@ -71,6 +71,7 @@
   my.apps.ads-b = {};
   my.apps.nixbuild = {};
   my.apps.tumblrandom = {};
+  my.apps.netbox = {};
 
   my.servers.etheroute-lon01.apps = [ "pomerium" ];
   my.servers.howl.apps = [ "nixbuild" ];
@@ -85,4 +86,5 @@
   my.servers.bvm-heptapod.apps = [ "gitlab-runner" ];
   my.servers.bvm-nixosmgmt.apps = [ "plex-pass" ];
   my.servers.blade-tuvok.apps = [ "fup" ];
+  my.servers.bvm-netbox.apps = [ "netbox" ];
 }