NetBoxでIPアドレスと機器の台帳を作る：Docker構築から空きIP払い出しまで

services:
  netbox:
    image: netboxcommunity/netbox:v4.7.1-5.1.1
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment: &netbox-env
      DB_HOST: postgres
      DB_NAME: netbox
      DB_USER: netbox
      DB_PASSWORD: ${DB_PASSWORD}
      REDIS_HOST: redis
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_DATABASE: "0"
      REDIS_CACHE_HOST: redis
      REDIS_CACHE_PASSWORD: ${REDIS_PASSWORD}
      REDIS_CACHE_DATABASE: "1"
      SECRET_KEY: ${SECRET_KEY}
      API_TOKEN_PEPPER_1: ${API_TOKEN_PEPPER_1}
      SKIP_SUPERUSER: "false"
      SUPERUSER_NAME: admin
      SUPERUSER_EMAIL: [email protected]
      SUPERUSER_PASSWORD: ${SUPERUSER_PASSWORD}
      SUPERUSER_API_KEY: ${SUPERUSER_API_KEY}
      SUPERUSER_API_TOKEN: ${SUPERUSER_API_TOKEN}
      TIME_ZONE: Asia/Tokyo
      GRANIAN_WORKERS: "2"
      CENSUS_REPORTING_ENABLED: "false"
    ports:
      - "127.0.0.1:18000:8080"
    volumes:
      - netbox-media:/opt/netbox/netbox/media
      - netbox-reports:/opt/netbox/netbox/reports
      - netbox-scripts:/opt/netbox/netbox/scripts
    mem_limit: 900m
    restart: unless-stopped
    healthcheck:
      test: curl -f http://localhost:8080/login/ || exit 1
      start_period: 600s
      interval: 30s
      timeout: 3s
      retries: 5

  netbox-worker:
    image: netboxcommunity/netbox:v4.7.1-5.1.1
    command: /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py rqworker
    depends_on:
      netbox:
        condition: service_healthy
    environment: *netbox-env
    mem_limit: 400m
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: netbox
      POSTGRES_USER: netbox
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    mem_limit: 200m
    restart: unless-stopped
    healthcheck:
      test: pg_isready -U netbox -d netbox
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD} --save 60 1 --appendonly no
    volumes:
      - redis-data:/data
    mem_limit: 100m
    restart: unless-stopped
    healthcheck:
      test: redis-cli -a ${REDIS_PASSWORD} --no-auth-warning ping | grep -q PONG
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgres-data:
  redis-data:
  netbox-media:
  netbox-reports:
  netbox-scripts:

mkdir -p ~/netbox && cd ~/netbox
umask 077
cat > .env <<EOF
DB_PASSWORD=$(python3 -c 'import secrets; print(secrets.token_urlsafe(24))')
REDIS_PASSWORD=$(python3 -c 'import secrets; print(secrets.token_urlsafe(24))')
SECRET_KEY=$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')
API_TOKEN_PEPPER_1=$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')
SUPERUSER_PASSWORD=$(python3 -c 'import secrets; print(secrets.token_urlsafe(18))')
SUPERUSER_API_KEY=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 12)
SUPERUSER_API_TOKEN=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 40)
EOF
ls -l .env    # -rw------- になっていれば umask が効いている

docker compose up -d
docker compose logs --timestamps netbox | grep -E '⚙️|✅|💡|Listening'

netbox-1  | 2026-09-24T06:47:47.589550762Z ⚙️ Applying database migrations
netbox-1  | 2026-09-24T06:54:24.094782911Z ⚙️ Running trace_paths
netbox-1  | 2026-09-24T06:54:33.626074279Z ⚙️ Removing stale content types
netbox-1  | 2026-09-24T06:54:41.668211710Z ⚙️ Removing expired user sessions
netbox-1  | 2026-09-24T06:54:49.541804837Z ⚙️ Building search index (lazy)
netbox-1  | 2026-09-24T06:55:03.684126671Z 💡 Superuser Username: admin, E-Mail: [email protected],
netbox-1  | 2026-09-24T06:55:03.684129121Z 💡 API Token: use with 'Bearer nbt_vvzv06g5h3Wg.<Your token>'
netbox-1  | 2026-09-24T06:55:04.724223884Z ✅ Initialisation is done.
netbox-1  | 2026-09-24T06:55:04.914427057Z [INFO] Listening at: http://:::8080

read -rs NB_PASS
jq -n --arg u admin --arg p "$NB_PASS" '{username: $u, password: $p, description: "seed script"}' \
  | curl -s -X POST http://127.0.0.1:18000/api/users/tokens/provision/ \
      -H 'Content-Type: application/json' -H 'Accept: application/json' --data @- \
  | jq '{version, key, token, write_enabled, expires}'

{
  "version": 2,
  "key": "mxTlUJ0X7mMZ",
  "token": "（英数字40文字）",
  "write_enabled": true,
  "expires": null
}

#!/usr/bin/env bash
# 小さなオフィス（1拠点・2VLAN・2サブネット・機器2台）をNetBox 4.7のREST APIで登録する
# 使い方: NETBOX_TOKEN='nbt_<key>.<token>' ./seed.sh
set -euo pipefail
NB=${NETBOX_URL:-http://127.0.0.1:18000}/api
: "${NETBOX_TOKEN:?NETBOX_TOKEN を設定してください}"
HDR=(-H "Authorization: Bearer $NETBOX_TOKEN" -H 'Content-Type: application/json' -H 'Accept: application/json')

# POSTして、作られたオブジェクトのidだけを出力する。失敗したら応答本文を出して止まる
post() {
  local out
  out=$(curl -sS -X POST "$NB$1" "${HDR[@]}" --data "$2")
  jq -e '.id' <<<"$out" 2>/dev/null || { echo "POST $1 failed: $out" >&2; return 1; }
}
patch() {
  curl -sS -o /dev/null --fail-with-body -X PATCH "$NB$1" "${HDR[@]}" --data "$2"
}

# 拠点とVLANグループ（VLAN IDの重複チェックはグループ単位）
SITE=$(post /dcim/sites/ '{"name":"名古屋オフィス","slug":"nagoya-office","status":"active"}')
VG=$(post /ipam/vlan-groups/ "{\"name\":\"nagoya-office\",\"slug\":\"nagoya-office\",\"scope_type\":\"dcim.site\",\"scope_id\":$SITE}")
R_SRV=$(post /ipam/roles/ '{"name":"サーバー","slug":"servers"}')
R_CLI=$(post /ipam/roles/ '{"name":"クライアント","slug":"clients"}')
V10=$(post /ipam/vlans/ "{\"vid\":10,\"name\":\"servers\",\"site\":$SITE,\"group\":$VG,\"role\":$R_SRV,\"status\":\"active\"}")
V20=$(post /ipam/vlans/ "{\"vid\":20,\"name\":\"clients\",\"site\":$SITE,\"group\":$VG,\"role\":$R_CLI,\"status\":\"active\"}")

# プレフィックス: /16をコンテナにして、その下に/24を2つ
post /ipam/prefixes/ "{\"prefix\":\"10.10.0.0/16\",\"status\":\"container\",\"scope_type\":\"dcim.site\",\"scope_id\":$SITE,\"description\":\"名古屋オフィス 全体\"}" >/dev/null
P_SRV=$(post /ipam/prefixes/ "{\"prefix\":\"10.10.10.0/24\",\"status\":\"active\",\"scope_type\":\"dcim.site\",\"scope_id\":$SITE,\"vlan\":$V10,\"role\":$R_SRV,\"description\":\"サーバーセグメント\"}")
P_CLI=$(post /ipam/prefixes/ "{\"prefix\":\"10.10.20.0/24\",\"status\":\"active\",\"scope_type\":\"dcim.site\",\"scope_id\":$SITE,\"vlan\":$V20,\"role\":$R_CLI,\"description\":\"クライアントセグメント（DHCP）\"}")

# IPレンジ: mark_populated=true で範囲内の個別登録と払い出しを止める
post /ipam/ip-ranges/ '{"start_address":"10.10.10.2/24","end_address":"10.10.10.9/24","status":"reserved","mark_populated":true,"description":"ネットワーク機器用に予約"}' >/dev/null
# DHCPプール: mark_utilized=true で使用率の計算上は全部使用中として数える
post /ipam/ip-ranges/ '{"start_address":"10.10.20.100/24","end_address":"10.10.20.199/24","status":"active","mark_populated":true,"mark_utilized":true,"description":"DHCPプール"}' >/dev/null

# 機器: メーカー → 機種 → 役割 → 機器 → インターフェース の順
MFR=$(post /dcim/manufacturers/ '{"name":"Generic","slug":"generic"}')
DT_SW=$(post /dcim/device-types/ "{\"manufacturer\":$MFR,\"model\":\"L3 switch 24-port\",\"slug\":\"l3-switch-24\",\"u_height\":1}")
DT_SRV=$(post /dcim/device-types/ "{\"manufacturer\":$MFR,\"model\":\"1U server\",\"slug\":\"server-1u\",\"u_height\":1}")
DR_SW=$(post /dcim/device-roles/ '{"name":"コアスイッチ","slug":"core-switch","color":"2196f3"}')
DR_SRV=$(post /dcim/device-roles/ '{"name":"サーバー","slug":"server","color":"4caf50"}')
SW=$(post /dcim/devices/ "{\"name\":\"sw-01\",\"device_type\":$DT_SW,\"role\":$DR_SW,\"site\":$SITE,\"status\":\"active\"}")
SRV=$(post /dcim/devices/ "{\"name\":\"srv-01\",\"device_type\":$DT_SRV,\"role\":$DR_SRV,\"site\":$SITE,\"status\":\"active\"}")
IF_V10=$(post /dcim/interfaces/ "{\"device\":$SW,\"name\":\"Vlan10\",\"type\":\"virtual\"}")
IF_V20=$(post /dcim/interfaces/ "{\"device\":$SW,\"name\":\"Vlan20\",\"type\":\"virtual\"}")
post /dcim/interfaces/ "{\"device\":$SW,\"name\":\"Gi1/0/1\",\"type\":\"1000base-t\",\"mode\":\"access\",\"untagged_vlan\":$V10,\"description\":\"to srv-01 eth0\"}" >/dev/null
IF_ETH0=$(post /dcim/interfaces/ "{\"device\":$SRV,\"name\":\"eth0\",\"type\":\"1000base-t\"}")

# IPアドレスをインターフェースに割り当て、機器の代表IP（primary_ip4）にする
GW10=$(post /ipam/ip-addresses/ "{\"address\":\"10.10.10.1/24\",\"status\":\"active\",\"assigned_object_type\":\"dcim.interface\",\"assigned_object_id\":$IF_V10,\"description\":\"ゲートウェイ\"}")
post /ipam/ip-addresses/ "{\"address\":\"10.10.20.1/24\",\"status\":\"active\",\"assigned_object_type\":\"dcim.interface\",\"assigned_object_id\":$IF_V20,\"description\":\"ゲートウェイ\"}" >/dev/null
IP_SRV=$(post /ipam/ip-addresses/ "{\"address\":\"10.10.10.10/24\",\"status\":\"active\",\"assigned_object_type\":\"dcim.interface\",\"assigned_object_id\":$IF_ETH0,\"dns_name\":\"srv-01.office.internal\",\"description\":\"ファイルサーバー\"}")
patch /dcim/devices/$SW/ "{\"primary_ip4\":$GW10}"
patch /dcim/devices/$SRV/ "{\"primary_ip4\":$IP_SRV}"

echo "site=$SITE prefix_servers=$P_SRV prefix_clients=$P_CLI switch=$SW server=$SRV"

chmod +x seed.sh
export NETBOX_TOKEN='nbt_<キー>.<トークン>'
./seed.sh
./seed.sh    # 2回目はわざと実行して、止まり方を確認する

site=2 prefix_servers=5 prefix_clients=6 switch=3 server=4
POST /dcim/sites/ failed: {"name":["site with this name already exists."],"slug":["site with this slug already exists."]}

NB=http://127.0.0.1:18000/api
H=(-H "Authorization: Bearer $NETBOX_TOKEN" -H 'Content-Type: application/json' -H 'Accept: application/json')
PFX=$(curl -s "${H[@]}" "$NB/ipam/prefixes/?prefix=10.10.10.0/24" | jq '.results[0].id')

# 空きを3つ見るだけ（何も確保しない）
curl -s "${H[@]}" "$NB/ipam/prefixes/$PFX/available-ips/?limit=3" | jq -r '.[].address'

# 次の空きを1つ確保して、NASとして登録する
curl -s "${H[@]}" -X POST "$NB/ipam/prefixes/$PFX/available-ips/" \
  --data '{"status":"active","dns_name":"nas-01.office.internal","description":"NAS"}' \
  | jq '{id, address, status: .status.value, dns_name}'

# クライアント側でプリンター2台分をまとめて確保する（配列で送る）
PCLI=$(curl -s "${H[@]}" "$NB/ipam/prefixes/?prefix=10.10.20.0/24" | jq '.results[0].id')
curl -s "${H[@]}" -X POST "$NB/ipam/prefixes/$PCLI/available-ips/" \
  --data '[{"description":"printer-01"},{"description":"printer-02"}]' \
  | jq -r '.[] | "\(.address) \(.description)"'

10.10.10.11/24
10.10.10.12/24
10.10.10.13/24
{
  "id": 15,
  "address": "10.10.10.11/24",
  "status": "active",
  "dns_name": "nas-01.office.internal"
}
10.10.20.2/24 printer-01
10.10.20.3/24 printer-02

for i in 1 2 3 4 5; do
  curl -s "${H[@]}" -X POST "$NB/ipam/prefixes/$PFX/available-ips/" \
    --data "{\"status\":\"reserved\",\"description\":\"parallel-$i\"}" | jq -r .address &
done; wait

# 試験用に作った5件を一括削除する
curl -s "${H[@]}" "$NB/ipam/ip-addresses/?description__ic=parallel" | jq -c '[.results[] | {id}]' > ids.json
curl -s -o /dev/null -w '%{http_code}\n' "${H[@]}" -X DELETE "$NB/ipam/ip-addresses/" --data @ids.json

10.10.10.12/24
10.10.10.13/24
10.10.10.14/24
10.10.10.15/24
10.10.10.16/24
204

docker compose exec -T postgres pg_dump -U netbox -d netbox -Fc > netbox-$(date +%F).dump
ls -lh netbox-*.dump

# 復元テスト：別名のDBに戻して件数を数え、終わったら消す
docker compose exec -T postgres createdb -U netbox netbox_restore_test
docker compose exec -T postgres pg_restore -U netbox -d netbox_restore_test --no-owner < netbox-$(date +%F).dump
docker compose exec -T postgres psql -U netbox -d netbox_restore_test -Atc "select count(*) from ipam_ipaddress"
docker compose exec -T postgres dropdb -U netbox netbox_restore_test

  python /opt/netbox/netbox/generate_secret_key.py
[ Use DB_WAIT_DEBUG=1 in netbox.env to print full traceback for errors here ]
⏳ Waiting on DB... (27s / 30s)
❌ Waited 30s or more for the DB to become ready.

{"error": "API_TOKEN_PEPPERS is not defined", "exception": "ValueError", "netbox_version": "4.7.1-Docker-5.1.1", "python_version": "3.14.4"}

docker compose ps --format 'table {{.Service}}\t{{.Status}}'
curl -s -H "Authorization: Bearer $NETBOX_TOKEN" http://127.0.0.1:18000/api/status/ \
  | jq '{"netbox-version", "rq-workers-running"}'
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:18000/api/ipam/prefixes/

SERVICE         STATUS
netbox          Up 12 minutes (healthy)
netbox-worker   Up 13 minutes
postgres        Up 5 hours (healthy)
redis           Up 5 hours (healthy)
{
  "netbox-version": "4.7.1",
  "rq-workers-running": 1
}
403

curl -s -H "Authorization: Bearer $NETBOX_TOKEN" \
  "http://127.0.0.1:18000/api/ipam/ip-addresses/?parent=10.10.10.0/24" \
  | jq -r '.results[] | [.address, .status.value, (.assigned_object.device.name // "-"), (.dns_name | if . == "" then "-" else . end)] | @tsv'

curl -s -H "Authorization: Bearer $NETBOX_TOKEN" \
  "http://127.0.0.1:18000/api/ipam/ip-addresses/?parent=10.10.0.0/16&status=active&dns_name__empty=false&limit=0" \
  | jq -r '.results[] | "\(.address | split("/")[0])\t\(.dns_name)"'

10.10.10.1/24	active	sw-01	-
10.10.10.10/24	active	srv-01	srv-01.office.internal
10.10.10.11/24	active	-	nas-01.office.internal
10.10.10.10	srv-01.office.internal
10.10.10.11	nas-01.office.internal