What my automation is never allowed to do

Описание и применение

Автоматический синхронный скрипт, который читает состояние FortiGate, MikroTik и Proxmox, применяет правила безопасности и обновляет NetBox без риска удаления данных.

Задача

Automating inventory sync between network devices and NetBox while preventing unintended destructive actions.

Результат

The script reliably syncs device state to NetBox without accidental deletions, flags misconfigurations, and ensures IP availability is accurately reflected.

Рабочий процесс

• 1. Collect data from FortiGate (REST API), MikroTik (RouterOS API), Proxmox VE (API token) and perform a local network sweep (ping + ARP).
• 2. Apply four safety rules: (a) least privilege – read‑only accounts on devices, (b) retire but never delete – mark missing items as deprecated, (c) dry‑run preview – show all changes before applying, (d) free‑address logic – ensure IPAM reflects true availability and sweep for unknown hosts.
• 3. If dry‑run passes, write changes to NetBox and log a Journal Entry.
• 4. Optional manual prune with --prune to delete objects tagged [netbox-sync] that were created by the script.
• 5. Monitor logs for alerts on orphan DHCP servers, missing interfaces, under‑reported VM disks, MAC conflicts, and hypervisor overcommit.
• 6. Repeat nightly via systemd timer; run on demand via shortcut.

Доказательства

I wanted NetBox to reflect what my lab actually runs, not what I remembered to type into it.

Источник

The script never needs to change the network, so it never gets the ability to.

Источник

That rule is fine until an API call times out. Then one bad night wipes good data, and the next morning your source of truth says the VLAN never existed.

Источник

A preview that shows less than the real run is worse than no preview: it gives you confidence you didn't earn.

Источник

NetBox was happy to suggest addresses inside my DHCP pools — addresses the DHCP server could hand to a phone at any moment.

Источник