What my automation is never allowed to do

说明与用途

一款自动同步脚本，读取 FortiGate、MikroTik 和 Proxmox 的状态，应用安全规则，更新 NetBox，避免数据删除风险。

问题

Automating inventory sync between network devices and NetBox while preventing unintended destructive actions.

结果

The script reliably syncs device state to NetBox without accidental deletions, flags misconfigurations, and ensures IP availability is accurately reflected.

工作流

• 1. Collect data from FortiGate (REST API), MikroTik (RouterOS API), Proxmox VE (API token) and perform a local network sweep (ping + ARP).
• 2. Apply four safety rules: (a) least privilege – read‑only accounts on devices, (b) retire but never delete – mark missing items as deprecated, (c) dry‑run preview – show all changes before applying, (d) free‑address logic – ensure IPAM reflects true availability and sweep for unknown hosts.
• 3. If dry‑run passes, write changes to NetBox and log a Journal Entry.
• 4. Optional manual prune with --prune to delete objects tagged [netbox-sync] that were created by the script.
• 5. Monitor logs for alerts on orphan DHCP servers, missing interfaces, under‑reported VM disks, MAC conflicts, and hypervisor overcommit.
• 6. Repeat nightly via systemd timer; run on demand via shortcut.

证据

I wanted NetBox to reflect what my lab actually runs, not what I remembered to type into it.

来源

The script never needs to change the network, so it never gets the ability to.

来源

That rule is fine until an API call times out. Then one bad night wipes good data, and the next morning your source of truth says the VLAN never existed.

来源

A preview that shows less than the real run is worse than no preview: it gives you confidence you didn't earn.

来源

NetBox was happy to suggest addresses inside my DHCP pools — addresses the DHCP server could hand to a phone at any moment.

来源