Structured docs layout

docs/data-model/circuits.md

@@ -0,0 +1,34 @@
+The circuits component of NetBox deals with the management of long-haul Internet and private transit links and providers.
+
+[TOC]
+
+# Providers
+
+A provider is any entity which provides some form of connectivity. This obviously includes carriers which offer Internet and private transit service. However, it might also include Internet exchange (IX) points and even organizations with whom you peer directly.
+
+Each provider may be assigned an autonomous system number (ASN) for reference. Each provider can also be assigned account and contact information, as well as miscellaneous comments.
+
+---
+
+# Circuits
+
+A circuit represents a single physical data link connecting two endpoints. Each circuit belongs to a provider and must be assigned circuit ID which is unique to that provider. Each circuit must also be assigned to a site, and may optionally be connected to a specific interface on a specific device within that site.
+
+NetBox also tracks miscellaneous circuit attributes (most of which are optional), including:
+
+* Date of installation
+* Port speed
+* Commit rate
+* Cross-connect ID
+* Patch panel information
+
+### Circuit Types
+
+Circuits can be classified by type. For example:
+
+* Internet transit
+* Out-of-band connectivity
+* Peering
+* Private backhaul
+
+Each circuit must be assigned exactly one circuit type.

docs/data-model/dcim.md

@@ -0,0 +1,98 @@
+Data center infrastructure management (DCIM) entails all physical assets: sites, racks, devices, cabling, etc.
+
+[TOC]
+
+# Sites
+
+How you define sites will depend on the nature of your organization, but typically a site will equate a building or campus. For example, a chain of banks might create a site to represent each of its branches, a site for its corporate headquarters, and two additional sites for its presence in two colocation facilities.
+
+Sites can be assigned an optional facility ID to identify the actual facility housing colocated equipment.
+
+---
+
+# Racks
+
+Within each site exist one or more racks. Each rack within NetBox represents a physical two- or four-post equipment rack in which equipment is mounted. Rack height is measured in *rack units *(U); most racks are between 42U and 48U, but NetBox allows you to define racks of any height. Each rack has two faces (front and rear) on which devices can be mounted.
+
+Each rack is assigned a name and (optionally) a separate facility ID. This is helpful when leasing space in a data center your organization does not own: The facility will often assign a seemingly arbitrary ID to a rack (for example, M204.313) whereas internally you refer to is simply as "R113." The facility ID can alternatively be used to store a rack's serial number.
+
+### Rack Groups
+
+Racks can be arranged into groups. As with sites, how you choose to designate rack groups will depend on the nature of your organization. For example, if each site is a campus, each group might be a building. If each site is a building, each rack group might be a floor or room.
+
+Each group is assigned to a parent site for easy navigation. Hierarchical recursion of rack groups is not currently supported.
+
+---
+
+# Device Types
+
+A device type represents a particular manufacturer and model of equipment. Device types describe the physical attributes of a device (rack height and depth), its class (e.g. console server, PDU, etc.), and its individual components (console, power, and data).
+
+### Manufacturers
+
+Each device type belongs to one manufacturer; e.g. Cisco, Opengear, or APC. Manufacturers are used to group different models of device.
+
+### Component Templates
+
+Each device type is assigned a number of component templates which describe the console, power, and data ports a device has. These are:
+
+* Console port templates
+* Console server port templates
+* Power port templates
+* Power outlet templates
+* Interface templates
+* Device bay templates
+
+Whenever a new device is created, it is automatically assigned console, power, and interface components per the templates assigned to its device type. For example, suppose your network employs Juniper EX4300-48T switches. You would create a device type with a model name "EX4300-48T" and assign it to the manufacturer "Juniper." You might then also create the following templates for it:
+
+* One template for a console port ("Console")
+* Two templates for power ports ("PSU0" and "PSU1")
+* 48 templates for 1GE interfaces ("ge-0/0/0" through "ge-0/0/47")
+* Four templates for 10GE interfaces ("xe-0/2/0" through "xe-0/2/3")
+
+Once you've done this, every new device that you create as an instance of this type will automatically be assigned each of the components listed above.
+
+Note that assignment of components from templates occurs only at the time of device creation: If you modify the templates of a device type, it will not affect devices which have already been created. However, you always have the option of adding, modifying, or deleting components of existing devices individually.
+
+---
+
+# Devices
+
+Every piece of hardware which is installed within a rack exists in NetBox as a device. Devices are measured in rack units (U) and depth. 0U devices which can be installed in a rack but don't consume vertical rack space (such as a vertically-mounted power distribution unit) can also be defined.
+
+When assigning a multi-U device to a rack, it is considered to be mounted in the lowest-numbered rack unit which it occupies. For example, a 3U device which occupies U8 through U10 shows as being mounted in U8.
+
+A device is said to be "full depth" if its installation on one rack face prevents the installation of any other device on the opposite face within the same rack unit(s). This could be either because the device is physically too deep to allow a device behind it, or because the installation of an opposing device would impede air flow.
+
+### Roles
+
+NetBox allows for the definition of arbitrary device roles by which devices can be organized. For example, you might create roles for core switches, distribution switches, and access switches. In the interest of simplicity, device can only belong to one device role.
+
+### Platforms
+
+A device's platform is used to denote the type of software running on it. This can be helpful when it is necessary to distinguish between, for instance, different feature sets. Note that two devices of same type may be assigned different platforms: for example, one Juniper MX240 running Junos 14 and another running Junos 15.
+
+The assignment of platforms to devices is an entirely optional feature, and may be disregarded if not desired.
+
+### Modules
+
+A device can be assigned modules which represent internal components. Currently, these are used merely for inventory tracking, although future development might see their functionality expand.
+
+### Components
+
+There are six types of device components which comprise all of the interconnection logic with NetBox:
+
+* Console ports
+* Console server ports
+* Power ports
+* Power outlets
+* Interfaces
+* Device bays
+
+Console ports connect only to console server ports, and power ports connect only to power outlets. Interfaces connect to one another in a symmetric manner: If interface A connects to interface B, interface B therefore connects to interface A. (The relationship between two interfaces is actually represented in the database by an InterfaceConnection object, but this is transparent to the user.)
+
+Each type of connection can be classified as either *planned* or *connected*. This allows for easily denoting connections which have not yet been installed. In addition to a connecting peer, interfaces are also assigned a form factor and may be designated as management-only (for out-of-band management). Interfaces may also be assigned a short description.
+
+Device bays represent the ability of a device to house child devices. For example, you might install four blade servers into a 2U chassis. The chassis would appear in the rack elevation as a 2U device with four device bays. Each server within it would be defined as a 0U device installed in one of the device bays. Child devices do not appear on rack elevations, but they are included in the "Non-Racked Devices" list within the rack view.
+
+Note that child devices differ from modules in that they are still treated as independent devices, with their own console/power/data components, modules, and IP addresses. Modules, on the other hand, are parts within a device, such as a hard disk or power supply.

docs/data-model/extras.md

@@ -0,0 +1,74 @@
+This section entails features of NetBox which are not crucial to its primary functions, but that provide additional value.
+
+[TOC]
+
+# Export Templates
+
+NetBox allows users to define custom templates that can be used when exporting objects. To create an export template, navigate to Extras > Export Templates under the admin interface.
+
+Each export template is associated with a certain type of object. For instance, if you create an export template for VLANs, your custom template will appear under the "Export" button on the VLANs list.
+
+Export templates are written in [Django's template language](https://docs.djangoproject.com/en/1.9/ref/templates/language/), which is very similar to Jinja2. The list of objects returned from the database is stored in the `queryset` variable. Typically, you'll want to iterate through this list using a for loop.
+
+A MIME type and file extension can optionally be defined for each export template. The default MIME type is `text/plain`.
+
+## Example
+
+Here's an example device export template that will generate a simple Nagios configuration from a list of devices.
+
+```
+{% for d in queryset %}{% if d.status and d.primary_ip %}define host{
+        use                     generic-switch
+        host_name               {{ d.name }}
+        address                 {{ d.primary_ip.address.ip }}
+}
+{% endif %}{% endfor %}
+```
+
+The generated output will look something like this:
+
+```
+define host{
+        use                     generic-switch
+        host_name               switch1
+        address                 192.0.2.1
+}
+define host{
+        use                     generic-switch
+        host_name               switch2
+        address                 192.0.2.2
+}
+define host{
+        use                     generic-switch
+        host_name               switch3
+        address                 192.0.2.3
+}
+```
+
+# Graphs
+
+NetBox does not generate graphs itself. This feature allows you to embed contextual graphs from an external resources inside certain NetBox views. Each embedded graph must be defined with the following parameters:
+
+* **Type:** Interface, provider, or site. This determines where the graph will be displayed.
+* **Weight:** Determines the order in which graphs are displayed (lower weights are displayed first). Graphs with equal weights will be ordered alphabetically by name.
+* **Name:** The title to display above the graph.
+* **Source URL:** The source of the image to be embedded. The associated object will be available as a template variable named `obj`.
+* **Link URL (optional):** A URL to which the graph will be linked. The associated object will be available as a template variable named `obj`.
+
+# Topology Maps
+
+NetBox can generate simple topology maps from the physical network connections recorded in its database. First, you'll need to create a topology map definition under the admin UI at Extras > Topology Maps.
+
+Each topology map is associated with a site. A site can have multiple topology maps, which might each illustrate a different aspect of its infrastructure (for example, production versus backend connectivity).
+
+To define the scope of a topology map, decide which devices you want to include. The map will only include interface connections with both points terminated on an included device. Specify the devices to include in the **device patterns** field by entering a list of [regular expressions](https://en.wikipedia.org/wiki/Regular_expression) matching device names. For example, if you wanted to include "mgmt-switch1" through "mgmt-switch99", you might use the regex `mgmt-switch\d+`.
+
+Each line of the **device patterns** field represents a hierarchical layer within the topology map. For example, you might map a traditional network with core, distribution, and access tiers like this:
+
+```
+core-switch-[abcd]
+dist-switch\d
+access-switch\d+,oob-switch\d+
+```
+
+Note that you can combine multiple regexes onto one line using commas. (Commas can only be used for separating regexes; they will not be processed as part of a regex.) The order in which regexes are listed on a line is significant: devices matching the first regex will be rendered first, and subsequent groups will be rendered to the right of those.

docs/data-model/ipam.md

@@ -0,0 +1,90 @@
+IP address management (IPAM) entails the allocation of IP networks, addresses, and related numeric resources.
+
+[TOC]
+
+# VRFs
+
+A VRF object in NetBox represents a virtual routing and forwarding (VRF) domain within a network. Each VRF is essentially a separate routing table: the same IP prefix or address can exist in multiple VRFs. VRFs are commonly used to isolate customers or organizations from one another within a network.
+
+Each VRF is assigned a name and a unique route distinguisher (RD). VRFs are an optional feature of NetBox: Any IP prefix or address not assigned to a VRF is said to belong to the "global" table.
+
+---
+
+# Aggregates
+
+IPv4 address space is organized as a hierarchy, with more-specific (smaller) prefix arranged as child nodes under less-specific (larger) prefixes. For example:
+
+* 10.0.0.0/8
+    * 10.1.0.0/16
+        * 10.1.2.0/24
+
+The root of the IPv4 hierarchy is 0.0.0.0/0, which encompasses all possible IPv4 addresses (and similarly, ::/0 for IPv6). However, even the largest organizations use only a small fraction of the global address space. Therefore, it makes sense to track in NetBox only the address space which is of interest to your organization.
+
+Aggregates serve as arbitrary top-level nodes in the IP space hierarchy. They allow you to easily construct your IP scheme without any clutter of unused address space. For instance, most organizations utilize some portion of the RFC 1918 private IPv4 space. So, you might define three aggregates for this space:
+
+* 10.0.0.0/8
+* 172.16.0.0/12
+* 192.168.0.0/16
+
+Additionally, you might define an aggregate for each large swath of public IPv4 space your organization uses. You'd also create aggregates for both globally routable and unique local IPv6 space.
+
+Any prefixes you create in NetBox (discussed below) will be automatically organized under their respective aggregates. Any space within an aggregate which is not covered by an existing prefix will be annotated as available for allocation.
+
+Aggregates cannot overlap with one another; they can only exist in parallel. For instance, you cannot define both 10.0.0.0/8 and 10.16.0.0/16 as aggregates, because they overlap. 10.16.0.0/16 in this example would be created as a prefix.
+
+### RIRs
+
+Regional Internet Registries (RIRs) are responsible for the allocation of global address space. The five RIRs are ARIN, RIPE, APNIC, LACNIC, and AFRINIC. However, some address space has been set aside for private or internal use only, such as defined in RFCs 1918 and 6598. NetBox considers these RFCs as a sort of RIR as well; that is, an authority which "owns" certain address space.
+
+Each aggregate must be assigned to one RIR. You are free to define whichever RIRs you choose (or create your own).
+
+---
+
+# Prefixes
+
+A prefix is an IPv4 or IPv6 network and mask expressed in CIDR notation (e.g. 192.0.2.0/24). A prefix entails only the "network portion" of an IP address; all bits in the address not covered by the mask must be zero.
+
+Each prefix may be assigned to one VRF; prefixes not assigned to a VRF are assigned to the "global" table. Prefixes are also organized under their respective aggregates, irrespective of VRF assignment.
+
+A prefix may optionally be assigned to one VLAN; a VLAN may have multiple prefixes assigned to it. This can be helpful is replicating real-world IP assignments. Each prefix may also be assigned a short description.
+
+### Statuses
+
+Each prefix is assigned an operational status. This is one of the following:
+
+* Container - A summary of child prefixes
+* Active - Provisioned and in use
+* Reserved - Earmarked for future use
+* Deprecated - No longer in use
+
+### Roles
+
+Whereas a status describes a prefix's operational state, a role describes its function. For example, roles might include:
+
+* Access segment
+* Infrastructure
+* NAT
+* Lab
+* Out-of-band
+
+Role assignment is optional and you are free to create as many as you'd like.
+
+---
+
+# IP Addresses
+
+An IP address comprises a single address (either IPv4 or IPv6) and its mask. Its mask should match exactly how the IP address is configured on an interface in the real world.
+
+Like prefixes, an IP address can optionally be assigned to a VRF (or it will appear in the "global" table). IP addresses are automatically organized under parent prefixes within their respective VRFs. Each IP address can also be assigned a short description.
+
+Each IP address can optionally be assigned to a device's interface; an interface may have multiple IP addresses assigned to it. Further, each device may have one of its interface IPs designated as its primary IP address.
+
+One IP address can be designated as the network address translation (NAT) IP address for exactly one other IP address. This is useful primarily is denoting the public address for a private internal IP. Tracking one-to-many NAT (or PAT) assignments is not currently supported.
+
+---
+
+# VLANs
+
+A VLAN represents an isolated layer two domain, identified by a name and a numeric ID (1-4094). Note that while it is good practice, neither VLAN names nor IDs must be unique within a site. This is to accommodate the fact that many real-world network use less-than-optimal VLAN allocations and may have overlapping VLAN ID assignments in practice.
+
+Like prefixes, each VLAN is assigned an operational status and (optionally) a functional role.

docs/data-model/secrets.md

@@ -0,0 +1,45 @@
+"Secrets" are small amounts of data that must be kept confidential; for example, passwords and SNMP community strings. NetBox provides encrypted storage of secret data.
+
+[TOC]
+
+# Secrets
+
+A secret represents a single credential or other string which must be stored securely. Each secret is assigned to a device within NetBox. The plaintext value of a secret is encrypted to a ciphertext immediately prior to storage within the database using a 256-bit AES master key. A SHA256 hash of the plaintext is also stored along with each ciphertext to validate the decrypted plaintext.
+
+Each secret can also store an optional name parameter, which is not encrypted. This may be useful for storing user names.
+
+### Roles
+
+Each secret is assigned a functional role which indicates what it is used for. Typical roles might include:
+
+* Login credentials
+* SNMP community strings
+* RADIUS/TACACS+ keys
+* IKE key strings
+* Routing protocol shared secrets
+
+Roles are also used to control access to secrets. Each role is assigned an arbitrary number of groups and/or users. Only the users associated with a role have permission to decrypt the secrets assigned to that role. (A superuser has permission to decrypt all secrets, provided they have an active user key.)
+
+---
+
+# User Keys
+
+Each user within NetBox can associate his or her account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data.
+
+User keys may be created by users individually, however they are of no use until they have been activated by a user who already has access to retrieve secret data.
+
+## Creating the First User Key
+
+When NetBox is first installed, it contains no encryption keys. Before it can store secrets, a user (typically the super user) must create a user key. This can be done by navigating to Profile > User Key.
+
+To create a user key, you can either generate a new RSA key pair, or upload the public key belonging to a pair you already have. If generating a new key pair, **you must save the private key** locally before saving your new user key. Once your user key has been created, its public key will be displayed under your profile.
+
+When the first user key is created in NetBox, a random master encryption key is generated automatically. This key is then encrypted using the public key provided and stored as part of your user key. **The master key cannot be recovered** without your private key.
+
+Once a user key has been assigned an encrypted copy of the master key, it is considered activated and can now be used to encrypt and decrypt secrets.
+
+## Creating Additional User Keys
+
+Any user can create his or her user key by generating or uploading a public RSA key. However, a user key cannot be used to encrypt or decrypt secrets until it has been activated with an encrypted copy of the master key.
+
+Only an administrator with an active user key can activate other user keys. To do so, access the NetBox admin UI and navigate to Secrets > User Keys. Select the user key(s) to be activated, and select "activate selected user keys" from the actions dropdown. You will need to provide your private key in order to decrypt the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated.