Merge pull request #1002 from netbox-community/develop

Prepare 2.6.1

.dockerignore

@@ -1,10 +1,10 @@
-.git
-.github
-.travis.yml
+.git*
 *.md
-env
 build*
-docker-compose.override.yml
+docker-compose*
+env
+test-configuration
 .netbox/.git*
-.netbox/.travis.yml
+.netbox/contrib
 .netbox/scripts
+.netbox/upgrade.sh

.github/workflows/push.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           python-version: '3.9'
       - name: Lint Code Base
-        uses: github/super-linter@v4
+        uses: github/super-linter@v5
         env:
           DEFAULT_BRANCH: develop
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -31,6 +31,7 @@ jobs:
           LINTER_RULES_PATH: /
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_DOCKERFILE: false
+          VALIDATE_GITLEAKS: false
           FILTER_REGEX_EXCLUDE: (.*/)?(LICENSE|configuration/.*)
           EDITORCONFIG_FILE_NAME: .ecrc
           DOCKERFILE_HADOLINT_FILE_NAME: .hadolint.yaml
@@ -54,6 +55,7 @@ jobs:
       fail-fast: false
     env:
       GH_ACTION: enable
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       IMAGE_NAMES: docker.io/netboxcommunity/netbox
     runs-on: ubuntu-latest
     name: Builds new NetBox Docker Images
@@ -73,6 +75,11 @@ jobs:
         env:
           BUILDX_PLATFORM: ${{ matrix.platform }}
           BUILDX_BUILDER_NAME: ${{ steps.buildx-setup.outputs.name }}
+      - id: arm-time-limit
+        name: Set Netbox container start_period higher on ARM64
+        if: matrix.platform == 'linux/arm64'
+        run: |
+          echo "NETBOX_START_PERIOD=240s" >>"${GITHUB_ENV}"
       - id: docker-test
         name: Test the image
         run: IMAGE="${FINAL_DOCKER_TAG}" ./test.sh

.github/workflows/release.yml

@@ -25,6 +25,7 @@ jobs:
     name: Builds new NetBox Docker Images
     env:
       GH_ACTION: enable
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       IMAGE_NAMES: docker.io/netboxcommunity/netbox quay.io/netboxcommunity/netbox ghcr.io/netbox-community/netbox
     steps:
       - id: source-checkout
@@ -32,7 +33,7 @@ jobs:
         uses: actions/checkout@v3
       - id: set-netbox-docker-version
         name: Get Version of NetBox Docker
-        run: echo "::set-output name=version::$(cat VERSION)"
+        run: echo "version=$(cat VERSION)" >>"$GITHUB_OUTPUT"
         shell: bash
       - id: qemu-setup
         name: Set up QEMU

Dockerfile

@@ -13,6 +13,12 @@ RUN export DEBIAN_FRONTEND=noninteractive \
       libpq-dev \
       libsasl2-dev \
       libssl-dev \
+      libxml2-dev \
+      libxmlsec1 \
+      libxmlsec1-dev \
+      libxmlsec1-openssl \
+      libxslt-dev \
+      pkg-config \
       python3-dev \
       python3-pip \
       python3-venv \
@@ -24,7 +30,16 @@ RUN export DEBIAN_FRONTEND=noninteractive \
 
 ARG NETBOX_PATH
 COPY ${NETBOX_PATH}/requirements.txt requirements-container.txt /
-RUN /opt/netbox/venv/bin/pip install \
+RUN \
+    # We compile 'psycopg2' in the build process
+    sed -i -e '/psycopg2-binary/d' /requirements.txt && \
+    # Gunicorn is not needed because we use Nginx Unit
+    sed -i -e '/gunicorn/d' /requirements.txt && \
+    # We need 'social-auth-core[all]' in the Docker image. But if we put it in our own requirements-container.txt
+    # we have potential version conflicts and the build will fail.
+    # That's why we just replace it in the original requirements.txt.
+    sed -i -e 's/social-auth-core\[openidconnect\]/social-auth-core\[all\]/g' /requirements.txt && \
+    /opt/netbox/venv/bin/pip install \
       -r /requirements.txt \
       -r /requirements-container.txt
 
@@ -46,6 +61,7 @@ RUN export DEBIAN_FRONTEND=noninteractive \
       curl \
       libldap-common \
       libpq5 \
+      libxmlsec1-openssl \
       openssl \
       python3 \
       python3-distutils \
@@ -57,14 +73,16 @@ RUN export DEBIAN_FRONTEND=noninteractive \
     && apt-get update -qq \
     && apt-get install \
       --yes -qq --no-install-recommends \
-      unit=1.27.0-1~jammy \
-      unit-python3.10=1.27.0-1~jammy \
+      unit=1.29.1-1~jammy \
+      unit-python3.10=1.29.1-1~jammy \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /opt/netbox/venv /opt/netbox/venv
 
 ARG NETBOX_PATH
 COPY ${NETBOX_PATH} /opt/netbox
+# Copy the modified 'requirements*.txt' files, to have the files actually used during installation
+COPY --from=builder /requirements.txt /requirements-container.txt /opt/netbox/
 
 COPY docker/configuration.docker.py /opt/netbox/netbox/netbox/configuration.py
 COPY docker/ldap_config.docker.py /opt/netbox/netbox/netbox/ldap_config.py
@@ -79,13 +97,13 @@ WORKDIR /opt/netbox/netbox
 # Must set permissions for '/opt/netbox/netbox/media' directory
 # to g+w so that pictures can be uploaded to netbox.
 RUN mkdir -p static /opt/unit/state/ /opt/unit/tmp/ \
-      && chown -R unit:root media /opt/unit/ \
-      && chmod -R g+w media /opt/unit/ \
-      && cd /opt/netbox/ && SECRET_KEY="dummy" /opt/netbox/venv/bin/python -m mkdocs build \
+      && chown -R unit:root /opt/unit/ media reports scripts \
+      && chmod -R g+w /opt/unit/ media reports scripts \
+      && cd /opt/netbox/ && SECRET_KEY="dummyKeyWithMinimumLength-------------------------" /opt/netbox/venv/bin/python -m mkdocs build \
           --config-file /opt/netbox/mkdocs.yml --site-dir /opt/netbox/netbox/project-static/docs/ \
-      && SECRET_KEY="dummy" /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py collectstatic --no-input
+      && SECRET_KEY="dummyKeyWithMinimumLength-------------------------" /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py collectstatic --no-input
 
-ENV LANG=C.UTF-8 PATH=/opt/netbox/venv/bin:$PATH
+ENV LANG=C.utf8 PATH=/opt/netbox/venv/bin:$PATH
 ENTRYPOINT [ "/usr/bin/tini", "--" ]
 
 CMD [ "/opt/netbox/docker-entrypoint.sh", "/opt/netbox/launch-netbox.sh" ]

README.md

@@ -3,7 +3,7 @@
 [![GitHub release (latest by date)](https://img.shields.io/github/v/release/netbox-community/netbox-docker)][github-release]
 [![GitHub stars](https://img.shields.io/github/stars/netbox-community/netbox-docker)][github-stargazers]
 ![GitHub closed pull requests](https://img.shields.io/github/issues-pr-closed-raw/netbox-community/netbox-docker)
-![Github release workflow](https://img.shields.io/github/workflow/status/netbox-community/netbox-docker/release)
+![Github release workflow](https://img.shields.io/github/actions/workflow/status/netbox-community/netbox-docker/release.yml?branch=release)
 ![Docker Pulls](https://img.shields.io/docker/pulls/netboxcommunity/netbox)
 [![GitHub license](https://img.shields.io/github/license/netbox-community/netbox-docker)][netbox-docker-license]
 
@@ -40,19 +40,21 @@ services:
     ports:
       - 8000:8080
 EOF
-docker-compose pull
-docker-compose up
+docker compose pull
+docker compose up
 ```
 
 The whole application will be available after a few minutes.
 Open the URL `http://0.0.0.0:8000/` in a web-browser.
 You should see the NetBox homepage.
-In the top-right corner you can login.
-The default credentials are:
 
-* Username: **admin**
-* Password: **admin**
-* API Token: **0123456789abcdef0123456789abcdef01234567**
+To create the first admin user run this command:
+
+```bash
+docker compose exec netbox /opt/netbox/netbox/manage.py createsuperuser
+```
+
+If you need to restart Netbox from an empty database often, you can also set the `SUPERUSER_*` variables in your `docker-compose.override.yml` as shown in the example.
 
 [wiki-getting-started]: https://github.com/netbox-community/netbox-docker/wiki/Getting-Started
 
@@ -97,7 +99,7 @@ For each of the above tag, there is an extra tag:
 ## Documentation
 
 Please refer [to our wiki on GitHub][netbox-docker-wiki] for further information on how to use the NetBox Docker image properly.
-The wiki covers advanced topics such as using files for secrets, configuring TLS, deployment to Kubernetes, monitoring and configuring NAPALM and LDAP.
+The wiki covers advanced topics such as using files for secrets, configuring TLS, deployment to Kubernetes, monitoring and configuring LDAP.
 
 Our wiki is a community effort.
 Feel free to correct errors, update outdated information or provide additional guides and insights.
@@ -123,7 +125,7 @@ This project relies only on _Docker_ and _docker-compose_ meeting these requirem
 * The _containerd version_ must be at least `1.5.6`.
 * The _docker-compose version_ must be at least `1.28.0`.
 
-To check the version installed on your system run `docker --version` and `docker-compose --version`.
+To check the version installed on your system run `docker --version` and `docker compose version`.
 
 ## Updating
 

VERSION

@@ -1 +1 @@
-2.3.0
+2.6.1

build-functions/check-commands.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+NEEDED_COMMANDS="curl jq docker skopeo"
+for c in $NEEDED_COMMANDS; do
+  if ! command -v "$c" &>/dev/null; then
+    echo "⚠️  '$c' is not installed. Can't proceed with build."
+    exit 1
+  fi
+done

build-functions/get-public-image-config.sh

@@ -1,82 +1,18 @@
 #!/bin/bash
-# Retrieves image configuration from public images in DockerHub
-# Functions from https://gist.github.com/cirocosta/17ea17be7ac11594cb0f290b0a3ac0d1
-# Optimised for our use case
+
+check_if_tags_exists() {
+  local image=$1
+  local tag=$2
+  skopeo list-tags "docker://$image" | jq -r ".Tags | contains([\"$tag\"])"
+}
 
 get_image_label() {
   local label=$1
   local image=$2
-  local tag=$3
-  local token
-  token=$(_get_token "$image")
-  local digest
-  digest=$(_get_digest "$image" "$tag" "$token")
-  local retval="null"
-  if [ "$digest" != "null" ]; then
-    retval=$(_get_image_configuration "$image" "$token" "$digest" "$label")
-  fi
-  echo "$retval"
-}
-
-get_image_layers() {
-  local image=$1
-  local tag=$2
-  local token
-  token=$(_get_token "$image")
-  _get_layers "$image" "$tag" "$token"
+  skopeo inspect "docker://$image" | jq -r ".Labels[\"$label\"]"
 }
 
 get_image_last_layer() {
   local image=$1
-  local tag=$2
-  local token
-  token=$(_get_token "$image")
-  local layers
-  mapfile -t layers < <(_get_layers "$image" "$tag" "$token")
-  echo "${layers[-1]}"
-}
-
-_get_image_configuration() {
-  local image=$1
-  local token=$2
-  local digest=$3
-  local label=$4
-  curl \
-    --silent \
-    --location \
-    --header "Authorization: Bearer $token" \
-    "https://registry-1.docker.io/v2/$image/blobs/$digest" |
-    jq -r ".config.Labels.\"$label\""
-}
-
-_get_token() {
-  local image=$1
-  curl \
-    --silent \
-    "https://auth.docker.io/token?scope=repository:$image:pull&service=registry.docker.io" |
-    jq -r '.token'
-}
-
-_get_digest() {
-  local image=$1
-  local tag=$2
-  local token=$3
-  curl \
-    --silent \
-    --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
-    --header "Authorization: Bearer $token" \
-    "https://registry-1.docker.io/v2/$image/manifests/$tag" |
-    jq -r '.config.digest'
-}
-
-_get_layers() {
-  local image=$1
-  local tag=$2
-  local token=$3
-  curl \
-    --silent \
-    --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
-    --header "Authorization: Bearer $token" \
-    "https://registry-1.docker.io/v2/$image/manifests/$tag" |
-    jq -r '.layers[].digest'
+  skopeo inspect "docker://$image" | jq -r ".Layers | last"
 }

build-functions/gh-functions.sh

@@ -19,3 +19,14 @@ gh_env() {
     echo "${@}" >>"${GITHUB_ENV}"
   fi
 }
+
+###
+# Prints the output to the file defined in ${GITHUB_OUTPUT}.
+# Only executes if ${GH_ACTION} is defined.
+# Example Usage: gh_env "FOO_VAR=bar_value"
+###
+gh_out() {
+  if [ -n "${GH_ACTION}" ]; then
+    echo "${@}" >>"$GITHUB_OUTPUT"
+  fi
+}

build-latest.sh

@@ -1,26 +1,27 @@
 #!/bin/bash
 # Builds the latest released version
 
+# Check if we have everything needed for the build
+source ./build-functions/check-commands.sh
+
+source ./build-functions/gh-functions.sh
+
 echo "▶️ $0 $*"
 
-###
-# Check for the jq library needed for parsing JSON
-###
-if ! command -v jq; then
-  echo "⚠️  jq command missing from \$PATH!"
-  exit 1
-fi
+CURL_ARGS=(
+  --silent
+)
 
 ###
-# Checking for the presence of GITHUB_OAUTH_CLIENT_ID
-# and GITHUB_OAUTH_CLIENT_SECRET
+# Checking for the presence of GITHUB_TOKEN
 ###
-if [ -n "${GITHUB_OAUTH_CLIENT_ID}" ] && [ -n "${GITHUB_OAUTH_CLIENT_SECRET}" ]; then
+if [ -n "${GITHUB_TOKEN}" ]; then
   echo "🗝 Performing authenticated Github API calls."
-  GITHUB_OAUTH_PARAMS="client_id=${GITHUB_OAUTH_CLIENT_ID}&client_secret=${GITHUB_OAUTH_CLIENT_SECRET}"
+  CURL_ARGS+=(
+    --header "Authorization: Bearer ${GITHUB_TOKEN}"
+  )
 else
   echo "🕶 Performing unauthenticated Github API calls. This might result in lower Github rate limits!"
-  GITHUB_OAUTH_PARAMS=""
 fi
 
 ###
@@ -42,31 +43,27 @@ fi
 ###
 ORIGINAL_GITHUB_REPO="netbox-community/netbox"
 GITHUB_REPO="${GITHUB_REPO-$ORIGINAL_GITHUB_REPO}"
-URL_RELEASES="https://api.github.com/repos/${GITHUB_REPO}/releases?${GITHUB_OAUTH_PARAMS}"
+URL_RELEASES="https://api.github.com/repos/${GITHUB_REPO}/releases"
 
 # Composing the JQ commans to extract the most recent version number
 JQ_LATEST="group_by(.prerelease) | .[] | sort_by(.published_at) | reverse | .[0] | select(.prerelease==${PRERELEASE-false}) | .tag_name"
 
-CURL="curl -sS"
+CURL="curl"
 
 # Querying the Github API to fetch the most recent version number
-VERSION=$($CURL "${URL_RELEASES}" | jq -r "${JQ_LATEST}")
+VERSION=$($CURL "${CURL_ARGS[@]}" "${URL_RELEASES}" | jq -r "${JQ_LATEST}" 2>/dev/null)
 
 ###
 # Check if the prerelease version is actually higher than stable version
 ###
 if [ "${PRERELEASE}" == "true" ]; then
   JQ_STABLE="group_by(.prerelease) | .[] | sort_by(.published_at) | reverse | .[0] | select(.prerelease==false) | .tag_name"
-  STABLE_VERSION=$($CURL "${URL_RELEASES}" | jq -r "${JQ_STABLE}")
+  STABLE_VERSION=$($CURL "${CURL_ARGS[@]}" "${URL_RELEASES}" | jq -r "${JQ_STABLE}" 2>/dev/null)
 
-  # shellcheck disable=SC2003
-  MAJOR_STABLE=$(expr match "${STABLE_VERSION}" 'v\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MINOR_STABLE=$(expr match "${STABLE_VERSION}" 'v[0-9]\+\.\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MAJOR_UNSTABLE=$(expr match "${VERSION}" 'v\([0-9]\+\)')
-  # shellcheck disable=SC2003
-  MINOR_UNSTABLE=$(expr match "${VERSION}" 'v[0-9]\+\.\([0-9]\+\)')
+  MAJOR_STABLE=$(expr "${STABLE_VERSION}" : 'v\([0-9]\+\)')
+  MINOR_STABLE=$(expr "${STABLE_VERSION}" : 'v[0-9]\+\.\([0-9]\+\)')
+  MAJOR_UNSTABLE=$(expr "${VERSION}" : 'v\([0-9]\+\)')
+  MINOR_UNSTABLE=$(expr "${VERSION}" : 'v[0-9]\+\.\([0-9]\+\)')
 
   if {
     [ "${MAJOR_STABLE}" -eq "${MAJOR_UNSTABLE}" ] &&
@@ -75,10 +72,7 @@ if [ "${PRERELEASE}" == "true" ]; then
 
     echo "❎ Latest unstable version '${VERSION}' is not higher than the latest stable version '$STABLE_VERSION'."
     if [ -z "$DEBUG" ]; then
-      if [ -n "${GH_ACTION}" ]; then
-        echo "::set-output name=skipped::true"
-      fi
-
+      gh_out "skipped=true"
       exit 0
     else
       echo "⚠️ Would exit here with code '0', but DEBUG is enabled."

build.sh

@@ -137,6 +137,10 @@ END_OF_HELP
   fi
 fi
 
+# Check if we have everything needed for the build
+source ./build-functions/check-commands.sh
+# Load all build functions
+source ./build-functions/get-public-image-config.sh
 source ./build-functions/gh-functions.sh
 
 IMAGE_NAMES="${IMAGE_NAMES-docker.io/netboxcommunity/netbox}"
@@ -170,7 +174,7 @@ if [ "${2}" != "--push-only" ] && [ -z "${SKIP_GIT}" ]; then
   REMOTE_EXISTS=$(git ls-remote --heads --tags "${URL}" "${NETBOX_BRANCH}" | wc -l)
   if [ "${REMOTE_EXISTS}" == "0" ]; then
     echo "❌ Remote branch '${NETBOX_BRANCH}' not found in '${URL}'; Nothing to do"
-    gh_echo "::set-output name=skipped::true"
+    gh_out "skipped=true"
     exit 0
   fi
   echo "🌐 Checking out '${NETBOX_BRANCH}' of NetBox from the url '${URL}' into '${NETBOX_PATH}'"
@@ -215,7 +219,7 @@ fi
 # Determining the value for DOCKER_FROM
 ###
 if [ -z "$DOCKER_FROM" ]; then
-  DOCKER_FROM="ubuntu:22.04"
+  DOCKER_FROM="docker.io/ubuntu:22.04"
 fi
 
 ###
@@ -300,39 +304,37 @@ if [ -n "${TARGET_DOCKER_SHORT_TAG}" ]; then
   done
 fi
 
+FINAL_DOCKER_TAG="${IMAGE_NAME_TAGS[0]}"
 gh_env "FINAL_DOCKER_TAG=${IMAGE_NAME_TAGS[0]}"
 
 ###
 # Checking if the build is necessary,
 # meaning build only if one of those values changed:
+# - a new tag is beeing created
 # - base image digest
 # - netbox git ref (Label: netbox.git-ref)
 # - netbox-docker git ref (Label: org.opencontainers.image.revision)
 ###
-# Load information from registry (only for docker.io)
+# Load information from registry (only for first registry in "IMAGE_NAMES")
 SHOULD_BUILD="false"
 BUILD_REASON=""
 if [ -z "${GH_ACTION}" ]; then
   # Asuming non Github builds should always proceed
   SHOULD_BUILD="true"
   BUILD_REASON="${BUILD_REASON} interactive"
-elif [[ "${IMAGE_NAME_TAGS[0]}" = docker.io* ]]; then
-  source ./build-functions/get-public-image-config.sh
-  IFS=':' read -ra DOCKER_FROM_SPLIT <<<"${DOCKER_FROM}"
-  if ! [[ ${DOCKER_FROM_SPLIT[0]} =~ .*/.* ]]; then
-    # Need to use "library/..." for images the have no two part name
-    DOCKER_FROM_SPLIT[0]="library/${DOCKER_FROM_SPLIT[0]}"
-  fi
-  IFS='/' read -ra ORG_REPO <<<"${IMAGE_NAMES[0]}"
-  echo "Checking labels for '${ORG_REPO[1]}' and '${ORG_REPO[2]}'"
-  BASE_LAST_LAYER=$(get_image_last_layer "${DOCKER_FROM_SPLIT[0]}" "${DOCKER_FROM_SPLIT[1]}")
-  mapfile -t IMAGES_LAYERS_OLD < <(get_image_layers "${ORG_REPO[1]}"/"${ORG_REPO[2]}" "${TAG}")
-  NETBOX_GIT_REF_OLD=$(get_image_label netbox.git-ref "${ORG_REPO[1]}"/"${ORG_REPO[2]}" "${TAG}")
-  GIT_REF_OLD=$(get_image_label org.opencontainers.image.revision "${ORG_REPO[1]}"/"${ORG_REPO[2]}" "${TAG}")
+elif [ "false" == "$(check_if_tags_exists "${IMAGE_NAMES[0]}" "$TARGET_DOCKER_TAG")" ]; then
+  SHOULD_BUILD="true"
+  BUILD_REASON="${BUILD_REASON} newtag"
+else
+  echo "Checking labels for '${FINAL_DOCKER_TAG}'"
+  BASE_LAST_LAYER=$(get_image_last_layer "${DOCKER_FROM}")
+  OLD_BASE_LAST_LAYER=$(get_image_label netbox.last-base-image-layer "${FINAL_DOCKER_TAG}")
+  NETBOX_GIT_REF_OLD=$(get_image_label netbox.git-ref "${FINAL_DOCKER_TAG}")
+  GIT_REF_OLD=$(get_image_label org.opencontainers.image.revision "${FINAL_DOCKER_TAG}")
 
-  if ! printf '%s\n' "${IMAGES_LAYERS_OLD[@]}" | grep -q -P "^${BASE_LAST_LAYER}\$"; then
+  if [ "${BASE_LAST_LAYER}" != "${OLD_BASE_LAST_LAYER}" ]; then
     SHOULD_BUILD="true"
-    BUILD_REASON="${BUILD_REASON} debian"
+    BUILD_REASON="${BUILD_REASON} ubuntu"
   fi
   if [ "${NETBOX_GIT_REF}" != "${NETBOX_GIT_REF_OLD}" ]; then
     SHOULD_BUILD="true"
@@ -342,17 +344,14 @@ elif [[ "${IMAGE_NAME_TAGS[0]}" = docker.io* ]]; then
     SHOULD_BUILD="true"
     BUILD_REASON="${BUILD_REASON} netbox-docker"
   fi
-else
-  SHOULD_BUILD="true"
-  BUILD_REASON="${BUILD_REASON} no-check"
 fi
 
 if [ "${SHOULD_BUILD}" != "true" ]; then
   echo "Build skipped because sources didn't change"
-  echo "::set-output name=skipped::true"
+  gh_out "skipped=true"
   exit 0 # Nothing to do -> exit
 else
-  gh_echo "::set-output name=skipped::false"
+  gh_out "skipped=false"
 fi
 gh_echo "::endgroup::"
 
@@ -393,6 +392,7 @@ fi
 if [ -n "${BUILD_REASON}" ]; then
   BUILD_REASON=$(sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' <<<"$BUILD_REASON")
   DOCKER_BUILD_ARGS+=(--label "netbox.build-reason=${BUILD_REASON}")
+  DOCKER_BUILD_ARGS+=(--label "netbox.last-base-image-layer=${BASE_LAST_LAYER}")
 fi
 
 # --build-arg

configuration/configuration.py

@@ -58,6 +58,9 @@ _BASE_DIR = dirname(dirname(abspath(__file__)))
 #
 # Example: ALLOWED_HOSTS = ['netbox.example.com', 'netbox.internal.local']
 ALLOWED_HOSTS = environ.get('ALLOWED_HOSTS', '*').split(' ')
+# ensure that '*' or 'localhost' is always in ALLOWED_HOSTS (needed for health checks)
+if '*' not in ALLOWED_HOSTS and 'localhost' not in ALLOWED_HOSTS:
+    ALLOWED_HOSTS.append('localhost')
 
 # PostgreSQL database configuration. See the Django documentation for a complete list of available parameters:
 #   https://docs.djangoproject.com/en/stable/ref/settings/#databases
@@ -83,6 +86,7 @@ REDIS = {
     'tasks': {
         'HOST': environ.get('REDIS_HOST', 'localhost'),
         'PORT': _environ_get_and_map('REDIS_PORT', 6379, _AS_INT),
+        'USERNAME': environ.get('REDIS_USERNAME', ''),
         'PASSWORD': _read_secret('redis_password', environ.get('REDIS_PASSWORD', '')),
         'DATABASE': _environ_get_and_map('REDIS_DATABASE', 0, _AS_INT),
         'SSL': _environ_get_and_map('REDIS_SSL', 'False', _AS_BOOL),
@@ -91,6 +95,7 @@ REDIS = {
     'caching': {
         'HOST': environ.get('REDIS_CACHE_HOST', environ.get('REDIS_HOST', 'localhost')),
         'PORT': _environ_get_and_map('REDIS_CACHE_PORT', environ.get('REDIS_PORT', '6379'), _AS_INT),
+        'USERNAME': environ.get('REDIS_CACHE_USERNAME', environ.get('REDIS_USERNAME', '')),
         'PASSWORD': _read_secret('redis_cache_password', environ.get('REDIS_CACHE_PASSWORD', environ.get('REDIS_PASSWORD', ''))),
         'DATABASE': _environ_get_and_map('REDIS_CACHE_DATABASE', '1', _AS_INT),
         'SSL': _environ_get_and_map('REDIS_CACHE_SSL', environ.get('REDIS_SSL', 'False'), _AS_BOOL),
@@ -131,10 +136,6 @@ if 'BANNER_BOTTOM' in environ:
 if 'BANNER_LOGIN' in environ:
     BANNER_LOGIN = environ.get('BANNER_LOGIN', None)
 
-# Base URL path if accessing NetBox within a directory. For example, if installed at http://example.com/netbox/, set:
-# BASE_PATH = 'netbox/'
-BASE_PATH = environ.get('BASE_PATH', '')
-
 # Maximum number of days to retain logged changes. Set to 0 to retain changes indefinitely. (Default: 90)
 if 'CHANGELOG_RETENTION' in environ:
     CHANGELOG_RETENTION = _environ_get_and_map('CHANGELOG_RETENTION', None, _AS_INT)
@@ -234,20 +235,6 @@ MEDIA_ROOT = environ.get('MEDIA_ROOT', join(_BASE_DIR, 'media'))
 # Expose Prometheus monitoring metrics at the HTTP endpoint '/metrics'
 METRICS_ENABLED = _environ_get_and_map('METRICS_ENABLED', 'False', _AS_BOOL)
 
-# Credentials that NetBox will uses to authenticate to devices when connecting via NAPALM.
-if 'NAPALM_USERNAME' in environ:
-    NAPALM_USERNAME = environ.get('NAPALM_USERNAME', None)
-if 'NAPALM_PASSWORD' in environ:
-    NAPALM_PASSWORD = _read_secret('napalm_password', environ.get('NAPALM_PASSWORD', None))
-
-# NAPALM timeout (in seconds). (Default: 30)
-if 'NAPALM_TIMEOUT' in environ:
-    NAPALM_TIMEOUT = _environ_get_and_map('NAPALM_TIMEOUT', None, _AS_INT)
-
-# # NAPALM optional arguments (see http://napalm.readthedocs.io/en/latest/support/#optional-arguments). Arguments must
-# # be provided as a dictionary.
-# NAPALM_ARGS = None
-
 # Determine how many objects to display per page within a list. (Default: 50)
 if 'PAGINATE_COUNT' in environ:
     PAGINATE_COUNT = _environ_get_and_map('PAGINATE_COUNT', None, _AS_INT)
@@ -296,17 +283,9 @@ REMOTE_AUTH_DEFAULT_GROUPS = _environ_get_and_map('REMOTE_AUTH_DEFAULT_GROUPS',
 RELEASE_CHECK_URL = environ.get('RELEASE_CHECK_URL', None)
 # RELEASE_CHECK_URL = 'https://api.github.com/repos/netbox-community/netbox/releases'
 
-# The file path where custom reports will be stored. A trailing slash is not needed. Note that the default value of
-# this setting is derived from the installed location.
-REPORTS_ROOT = environ.get('REPORTS_ROOT', '/etc/netbox/reports')
-
 # Maximum execution time for background tasks, in seconds.
 RQ_DEFAULT_TIMEOUT = _environ_get_and_map('RQ_DEFAULT_TIMEOUT', 300, _AS_INT)
 
-# The file path where custom scripts will be stored. A trailing slash is not needed. Note that the default value of
-# this setting is derived from the installed location.
-SCRIPTS_ROOT = environ.get('SCRIPTS_ROOT', '/etc/netbox/scripts')
-
 # The name to use for the csrf token cookie.
 CSRF_COOKIE_NAME = environ.get('CSRF_COOKIE_NAME', 'csrftoken')
 

configuration/extra.py

@@ -15,12 +15,6 @@
 #     'file', 'ftp', 'ftps', 'http', 'https', 'irc', 'mailto', 'sftp', 'ssh', 'tel', 'telnet', 'tftp', 'vnc', 'xmpp',
 # )
 
-
-## NAPALM optional arguments (see http://napalm.readthedocs.io/en/latest/support/#optional-arguments). Arguments must
-## be provided as a dictionary.
-# NAPALM_ARGS = {}
-
-
 ## Enable installed plugins. Add the name of each plugin to the list.
 # from netbox.configuration.configuration import PLUGINS
 # PLUGINS.append('my_plugin')

configuration/ldap/ldap_config.py

@@ -49,20 +49,38 @@ AUTH_LDAP_START_TLS = environ.get('AUTH_LDAP_START_TLS', 'False').lower() == 'tr
 #     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
 LDAP_IGNORE_CERT_ERRORS = environ.get('LDAP_IGNORE_CERT_ERRORS', 'False').lower() == 'true'
 
+# Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
+# Note that this is a NetBox-specific setting which sets:
+#     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
+LDAP_CA_CERT_DIR = environ.get('LDAP_CA_CERT_DIR', None)
+
+# Include this setting if you want to validate the LDAP server certificates against your own CA.
+# Note that this is a NetBox-specific setting which sets:
+#     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
+LDAP_CA_CERT_FILE = environ.get('LDAP_CA_CERT_FILE', None)
+
 AUTH_LDAP_USER_SEARCH_BASEDN = environ.get('AUTH_LDAP_USER_SEARCH_BASEDN', '')
 AUTH_LDAP_USER_SEARCH_ATTR = environ.get('AUTH_LDAP_USER_SEARCH_ATTR', 'sAMAccountName')
+AUTH_LDAP_USER_SEARCH_FILTER: str = environ.get(
+    'AUTH_LDAP_USER_SEARCH_FILTER', f'({AUTH_LDAP_USER_SEARCH_ATTR}=%(user)s)'
+)
+
 AUTH_LDAP_USER_SEARCH = LDAPSearch(
-    AUTH_LDAP_USER_SEARCH_BASEDN,
-    ldap.SCOPE_SUBTREE,
-    "(" + AUTH_LDAP_USER_SEARCH_ATTR + "=%(user)s)"
+    AUTH_LDAP_USER_SEARCH_BASEDN, ldap.SCOPE_SUBTREE, AUTH_LDAP_USER_SEARCH_FILTER
 )
 
 # This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
 # heirarchy.
+
 AUTH_LDAP_GROUP_SEARCH_BASEDN = environ.get('AUTH_LDAP_GROUP_SEARCH_BASEDN', '')
 AUTH_LDAP_GROUP_SEARCH_CLASS = environ.get('AUTH_LDAP_GROUP_SEARCH_CLASS', 'group')
-AUTH_LDAP_GROUP_SEARCH = LDAPSearch(AUTH_LDAP_GROUP_SEARCH_BASEDN, ldap.SCOPE_SUBTREE,
-                                    "(objectClass=" + AUTH_LDAP_GROUP_SEARCH_CLASS + ")")
+
+AUTH_LDAP_GROUP_SEARCH_FILTER: str = environ.get(
+    'AUTH_LDAP_GROUP_SEARCH_FILTER', f'(objectclass={AUTH_LDAP_GROUP_SEARCH_CLASS})'
+)
+AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+    AUTH_LDAP_GROUP_SEARCH_BASEDN, ldap.SCOPE_SUBTREE, AUTH_LDAP_GROUP_SEARCH_FILTER
+)
 AUTH_LDAP_GROUP_TYPE = _import_group_type(environ.get('AUTH_LDAP_GROUP_TYPE', 'GroupOfNamesType'))
 
 # Define a group required to login.

docker-compose.override.yml.example

@@ -2,4 +2,22 @@ version: '3.4'
 services:
   netbox:
     ports:
-      - 8000:8080
+      - "8000:8080"
+    # If you want the Nginx unit status page visible from the
+    # outside of the container add the following port mapping:
+    # - "8001:8081"
+    # healthcheck:
+      # Time for which the health check can fail after the container is started.
+      # This depends mostly on the performance of your database. On the first start,
+      # when all tables need to be created the start_period should be higher than on
+      # subsequent starts. For the first start after major version upgrades of NetBox
+      # the start_period might also need to be set higher.
+      # Default value in our docker-compose.yml is 60s
+      # start_period: 90s
+    # environment:
+      # SKIP_SUPERUSER: "false"
+      # SUPERUSER_API_TOKEN: ""
+      # SUPERUSER_EMAIL: ""
+      # SUPERUSER_NAME: ""
+      # SUPERUSER_PASSWORD: ""
+

docker-compose.test.override.yml

@@ -0,0 +1,6 @@
+version: '3.4'
+services:
+  netbox:
+    ports:
+      - "127.0.0.1:8000:8080"
+

docker-compose.test.yml

@@ -1,37 +1,65 @@
 version: '3.4'
 services:
-  netbox:
+  netbox: &netbox
     image: ${IMAGE-netboxcommunity/netbox:latest}
     depends_on:
-    - postgres
-    - redis
-    - redis-cache
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      redis-cache:
+        condition: service_healthy
     env_file: env/netbox.env
-    environment:
-      SKIP_STARTUP_SCRIPTS: ${SKIP_STARTUP_SCRIPTS-false}
     user: 'unit:root'
     volumes:
-    - ./configuration:/etc/netbox/config:z,ro
     - ./test-configuration/logging.py:/etc/netbox/config/logging.py:z,ro
-    - ./reports:/etc/netbox/reports:z,ro
-    - ./scripts:/etc/netbox/scripts:z,ro
-    - netbox-media-files:/opt/netbox/netbox/media:z
+    healthcheck:
+      start_period: ${NETBOX_START_PERIOD-120s}
+      timeout: 3s
+      interval: 15s
+      test: "curl -f http://localhost:8080/api/ || exit 1"
+  netbox-worker:
+    <<: *netbox
+    command:
+    - /opt/netbox/venv/bin/python
+    - /opt/netbox/netbox/manage.py
+    - rqworker
+    healthcheck:
+      start_period: 40s
+      timeout: 3s
+      interval: 15s
+      test: "ps -aux | grep -v grep | grep -q rqworker || exit 1"
+  netbox-housekeeping:
+    <<: *netbox
+    command:
+    - /opt/netbox/housekeeping.sh
+    healthcheck:
+      start_period: 40s
+      timeout: 3s
+      interval: 15s
+      test: "ps -aux | grep -v grep | grep -q housekeeping || exit 1"
   postgres:
-    image: postgres:14-alpine
+    image: postgres:15-alpine
     env_file: env/postgres.env
-  redis:
+    healthcheck:
+      test: "pg_isready -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER" ## $$ because of docker-compose
+      interval: 10s
+      timeout: 5s
+      retries: 5
+  redis: &redis
     image: redis:7-alpine
     command:
     - sh
     - -c # this is to evaluate the $REDIS_PASSWORD from the env
     - redis-server --appendonly yes --requirepass $$REDIS_PASSWORD ## $$ because of docker-compose
     env_file: env/redis.env
+    healthcheck:
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      test: "timeout 2 redis-cli ping"
   redis-cache:
-    image: redis:7-alpine
-    command:
-    - sh
-    - -c # this is to evaluate the $REDIS_PASSWORD from the env
-    - redis-server --requirepass $$REDIS_PASSWORD ## $$ because of docker-compose
+    <<: *redis
     env_file: env/redis-cache.env
 volumes:
   netbox-media-files:

docker-compose.yml

@@ -1,46 +1,60 @@
 version: '3.4'
 services:
   netbox: &netbox
-    image: netboxcommunity/netbox:${VERSION-v3.3-2.3.0}
+    image: docker.io/netboxcommunity/netbox:${VERSION-v3.5-2.6.1}
     depends_on:
     - postgres
     - redis
     - redis-cache
-    - netbox-worker
     env_file: env/netbox.env
     user: 'unit:root'
+    healthcheck:
+      start_period: 60s
+      timeout: 3s
+      interval: 15s
+      test: "curl -f http://localhost:8080/api/ || exit 1"
     volumes:
     - ./configuration:/etc/netbox/config:z,ro
-    - ./reports:/etc/netbox/reports:z,ro
-    - ./scripts:/etc/netbox/scripts:z,ro
-    - netbox-media-files:/opt/netbox/netbox/media:z
+    - netbox-media-files:/opt/netbox/netbox/media:z,rw
+    - netbox-reports-files:/opt/netbox/netbox/reports:z,rw
+    - netbox-scripts-files:/opt/netbox/netbox/scripts:z,rw
   netbox-worker:
     <<: *netbox
     depends_on:
-    - redis
-    - postgres
+      netbox:
+        condition: service_healthy
     command:
     - /opt/netbox/venv/bin/python
     - /opt/netbox/netbox/manage.py
     - rqworker
+    healthcheck:
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      test: "ps -aux | grep -v grep | grep -q rqworker || exit 1"
   netbox-housekeeping:
     <<: *netbox
     depends_on:
-    - redis
-    - postgres
+      netbox:
+        condition: service_healthy
     command:
     - /opt/netbox/housekeeping.sh
+    healthcheck:
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      test: "ps -aux | grep -v grep | grep -q housekeeping || exit 1"
 
   # postgres
   postgres:
-    image: postgres:14-alpine
+    image: docker.io/postgres:15-alpine
     env_file: env/postgres.env
     volumes:
     - netbox-postgres-data:/var/lib/postgresql/data
 
   # redis
   redis:
-    image: redis:7-alpine
+    image: docker.io/redis:7-alpine
     command:
     - sh
     - -c # this is to evaluate the $REDIS_PASSWORD from the env
@@ -49,21 +63,25 @@ services:
     volumes:
     - netbox-redis-data:/data
   redis-cache:
-    image: redis:7-alpine
+    image: docker.io/redis:7-alpine
     command:
     - sh
     - -c # this is to evaluate the $REDIS_PASSWORD from the env
     - redis-server --requirepass $$REDIS_PASSWORD ## $$ because of docker-compose
     env_file: env/redis-cache.env
     volumes:
-    - netbox-redis-cache-data:/data    
+    - netbox-redis-cache-data:/data
 
 volumes:
   netbox-media-files:
     driver: local
   netbox-postgres-data:
     driver: local
+  netbox-redis-cache-data:
+    driver: local
   netbox-redis-data:
     driver: local
-  netbox-redis-cache-data:
-    driver: local    
+  netbox-reports-files:
+    driver: local
+  netbox-scripts-files:
+    driver: local

docker/docker-entrypoint.sh

@@ -46,6 +46,8 @@ if ! ./manage.py migrate --check >/dev/null 2>&1; then
   ./manage.py remove_stale_contenttypes --no-input
   echo "⚙️ Removing expired user sessions"
   ./manage.py clearsessions
+  echo "⚙️ Building search index (lazy)"
+  ./manage.py reindex --lazy
 fi
 
 # Create Superuser if required
@@ -80,14 +82,15 @@ END
   echo "💡 Superuser Username: ${SUPERUSER_NAME}, E-Mail: ${SUPERUSER_EMAIL}"
 fi
 
-# Print warning if startup scripts (and initializers) would've been run # Remove for next release
-if [ "$SKIP_STARTUP_SCRIPTS" == "true" ]; then
-  # Nothing to do
-  echo "" # Empty block not allowed
-else
-  echo "⚠️⚠️⚠️ WARNING: The initializers have been moved to a plugin. See release notes."
-  echo "⚠️⚠️⚠️ Set environment variable 'SKIP_STARTUP_SCRIPTS' to 'true' to remove this warning."
-fi
+./manage.py shell --interface python <<END
+from users.models import Token
+try:
+    old_default_token = Token.objects.get(key="0123456789abcdef0123456789abcdef01234567")
+    if old_default_token:
+        print("⚠️ Warning: You have the old default admin token in your database. This token is widely known; please remove it.")
+except Token.DoesNotExist:
+    pass
+END
 
 echo "✅ Initialisation is done."
 

docker/housekeeping.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
-SECONDS=${HOUSEKEEPING_INTERVAL:=86400}
-echo "Interval set to ${SECONDS} seconds"
+SLEEP_SECONDS=${HOUSEKEEPING_INTERVAL:=86400}
+echo "Interval set to ${SLEEP_SECONDS} seconds"
 while true; do
   date
   /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py housekeeping
-  sleep "${SECONDS}s"
+  sleep "${SLEEP_SECONDS}s"
 done

docker/launch-netbox.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 UNIT_CONFIG="${UNIT_CONFIG-/etc/unit/nginx-unit.json}"
+# Also used in "nginx-unit.json"
 UNIT_SOCKET="/opt/unit/unit.sock"
 
 load_configuration() {

docker/nginx-unit.json

@@ -1,27 +1,45 @@
 {
   "listeners": {
-    "*:8080": {
-      "pass": "routes"
+    "0.0.0.0:8080": {
+      "pass": "routes/main"
+    },
+    "[::]:8080": {
+      "pass": "routes/main"
+    },
+    "0.0.0.0:8081": {
+      "pass": "routes/status"
+    },
+    "[::]:8081": {
+      "pass": "routes/status"
     }
   },
-
-  "routes": [
-    {
-      "match": {
-        "uri": "/static/*"
+  "routes": {
+    "main": [
+      {
+        "match": {
+          "uri": "/static/*"
+        },
+        "action": {
+          "share": "/opt/netbox/netbox${uri}"
+        }
       },
-      "action": {
-        "share": "/opt/netbox/netbox${uri}"
+      {
+        "action": {
+          "pass": "applications/netbox"
+        }
       }
-    },
-
-    {
-      "action": {
-        "pass": "applications/netbox"
+    ],
+    "status": [
+      {
+        "match": {
+          "uri": "/status/*"
+        },
+        "action": {
+          "proxy": "http://unix:/opt/unit/unit.sock"
+        }
       }
-    }
-  ],
-
+    ]
+  },
   "applications": {
     "netbox": {
       "type": "python 3",
@@ -35,6 +53,5 @@
       }
     }
   },
-
   "access_log": "/dev/stdout"
 }

env/netbox.env

@@ -29,10 +29,6 @@ REDIS_INSECURE_SKIP_TLS_VERIFY=false
 REDIS_PASSWORD=H733Kdjndks81
 REDIS_SSL=false
 RELEASE_CHECK_URL=https://api.github.com/repos/netbox-community/netbox/releases
-SECRET_KEY=r8OwDznj!!dci#P9ghmRfdu1Ysxm0AiPeDCQhKE+N_rClfWNj
-SKIP_SUPERUSER=false
-SUPERUSER_API_TOKEN=0123456789abcdef0123456789abcdef01234567
-SUPERUSER_EMAIL=admin@example.com
-SUPERUSER_NAME=admin
-SUPERUSER_PASSWORD=admin
+SECRET_KEY=r(m)9nLGnz$(_q3N4z1k(EFsMCjjjzx08x9VhNVcfd%6RF#r!6DE@+V5Zk2X
+SKIP_SUPERUSER=true
 WEBHOOKS_ENABLED=true

reports/devices.py.example

@@ -1,46 +0,0 @@
-from dcim.choices import DeviceStatusChoices
-from dcim.models import ConsolePort, Device, PowerPort
-from extras.reports import Report
-
-
-class DeviceConnectionsReport(Report):
-    description = "Validate the minimum physical connections for each device"
-
-    def test_console_connection(self):
-
-        # Check that every console port for every active device has a connection defined.
-        active = DeviceStatusChoices.STATUS_ACTIVE
-        for console_port in ConsolePort.objects.prefetch_related('device').filter(device__status=active):
-            if console_port.connected_endpoint is None:
-                self.log_failure(
-                    console_port.device,
-                    "No console connection defined for {}".format(console_port.name)
-                )
-            elif not console_port.connection_status:
-                self.log_warning(
-                    console_port.device,
-                    "Console connection for {} marked as planned".format(console_port.name)
-                )
-            else:
-                self.log_success(console_port.device)
-
-    def test_power_connections(self):
-
-        # Check that every active device has at least two connected power supplies.
-        for device in Device.objects.filter(status=DeviceStatusChoices.STATUS_ACTIVE):
-            connected_ports = 0
-            for power_port in PowerPort.objects.filter(device=device):
-                if power_port.connected_endpoint is not None:
-                    connected_ports += 1
-                    if not power_port.connection_status:
-                        self.log_warning(
-                            device,
-                            "Power connection for {} marked as planned".format(power_port.name)
-                        )
-            if connected_ports < 2:
-                self.log_failure(
-                    device,
-                    "{} connected power supplies found (2 needed)".format(connected_ports)
-                )
-            else:
-                self.log_success(device)

requirements-container.txt

@@ -1,5 +1,4 @@
-django-auth-ldap==4.1.0
-django-storages[azure,boto3,dropbox,google,libcloud,sftp]==1.13.1
-napalm==4.0.0
-psycopg2==2.9.4
-social-auth-core[openidconnect]==4.3.0
+django-auth-ldap==4.3.0
+django-storages[azure,boto3,dropbox,google,libcloud,sftp]==1.13.2
+psycopg2==2.9.6
+python3-saml==1.15.0

test.sh

@@ -14,6 +14,8 @@
 # exit when a command exits with an exit code != 0
 set -e
 
+source ./build-functions/gh-functions.sh
+
 # IMAGE is used by `docker-compose.yml` do determine the tag
 # of the Docker Image that is to be used
 if [ "${1}x" != "x" ]; then
@@ -35,20 +37,72 @@ if [ -z "${IMAGE}" ]; then
 fi
 
 # The docker compose command to use
-doco="docker-compose --file docker-compose.test.yml --project-name netbox_docker_test_${1}"
+doco="docker compose --file docker-compose.test.yml --file docker-compose.test.override.yml --project-name netbox_docker_test"
 
 test_setup() {
+  gh_echo "::group:: Test setup"
   echo "🏗 Setup up test environment"
+  $doco up --detach --quiet-pull --wait --force-recreate --renew-anon-volumes --no-start
+  $doco start postgres
+  $doco start redis
+  $doco start redis-cache
+  gh_echo "::endgroup::"
 }
 
 test_netbox_unit_tests() {
+  gh_echo "::group:: Netbox unit tests"
   echo "⏱ Running NetBox Unit Tests"
   $doco run --rm netbox /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py test
+  gh_echo "::endgroup::"
+}
+
+test_compose_db_setup() {
+  gh_echo "::group:: Netbox DB migrations"
+  echo "⏱ Running NetBox DB migrations"
+  $doco run --rm netbox /opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py migrate
+  gh_echo "::endgroup::"
+}
+
+test_netbox_start() {
+  gh_echo "::group:: Start Netbox service"
+  echo "⏱ Starting NetBox services"
+  $doco up --detach --wait
+  gh_echo "::endgroup::"
+}
+
+test_netbox_web() {
+  gh_echo "::group:: Web service test"
+  echo "⏱ Starting web service test"
+  RESP_CODE=$(
+    curl \
+      --silent \
+      --output /dev/null \
+      --write-out '%{http_code}' \
+      --request GET \
+      --connect-timeout 5 \
+      --max-time 10 \
+      --retry 5 \
+      --retry-delay 0 \
+      --retry-max-time 40 \
+      http://127.0.0.1:8000/
+  )
+  if [ "$RESP_CODE" == "200" ]; then
+    echo "Webservice running"
+  else
+    echo "⚠️ Got response code '$RESP_CODE' but expected '200'"
+    exit 1
+  fi
+  gh_echo "::endgroup::"
 }
 
 test_cleanup() {
   echo "💣 Cleaning Up"
-  $doco down -v
+  gh_echo "::group:: Docker compose logs"
+  $doco logs --no-color
+  gh_echo "::endgroup::"
+  gh_echo "::group:: Docker compose down"
+  $doco down --volumes
+  gh_echo "::endgroup::"
 }
 
 echo "🐳🐳🐳 Start testing '${IMAGE}'"
@@ -58,5 +112,8 @@ trap test_cleanup EXIT ERR
 test_setup
 
 test_netbox_unit_tests
+test_compose_db_setup
+test_netbox_start
+test_netbox_web
 
 echo "🐳🐳🐳 Done testing '${IMAGE}'"