NetBox

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for NetBox. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound port 80 from the network you will reach the web interface from. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes approximately one to two minutes after the instance state becomes Running and the status checks pass.

The command below launches an instance from the SecureAnyCloud NetBox Marketplace AMI into an existing subnet and security group. Replace these values first:

• <ami-id> with the AMI ID shown on the Marketplace listing.
• <key-name> with your EC2 key pair name.
• <subnet-id> with your subnet ID.
• <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=netbox}]'

Nothing secret is baked into the image. On the first boot, a one-shot service (netbox-firstboot.service) generates a fresh Django secret key, a fresh database password, a unique administrator account and a REST API token, all unique to your instance. It writes them to /root/netbox-credentials.txt, which only root can read.

Connect over SSH as ubuntu and read the file:

$
sudo cat /root/netbox-credentials.txt
# NetBox - generated on first boot by netbox-firstboot.service.
# These credentials are unique to THIS instance. Store them somewhere safe. netbox.url=http://203.0.113.42/ netbox.admin.user=admin netbox.admin.pass=<NETBOX_ADMIN_PASSWORD> netbox.api.token=<NETBOX_API_TOKEN>
# Canonical keys consumed by the sac smoke verifier + guide substitution: NETBOX_ADMIN_PASSWORD=<NETBOX_ADMIN_PASSWORD> NETBOX_API_TOKEN=<NETBOX_API_TOKEN>

The netbox-firstboot.service one-shot is ordered before the application services, so the web UI starts only after every per-instance secret has been generated. The values above are an example. Your instance has its own unique credentials.

Check that PostgreSQL, Redis, the NetBox application, the request queue worker and nginx are all active:

sudo systemctl is-active postgresql redis-server netbox netbox-rq nginx

All five report active. gunicorn binds to loopback only (127.0.0.1:8001) and nginx publishes the interface on port 80:

sudo ss -tlnp | grep -E ':80 |:8001 '

The sign-in page is public and returns 200. NetBox requires authentication for everything else, so the REST API returns 403 without a token. This is the secure default.

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/login/

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/api/dcim/devices/

Browse to http://<instance-public-ip>/. NetBox opens on the login page. Sign in as admin with the password from /root/netbox-credentials.txt.

After signing in, you land on your personal dashboard, with widgets summarising your organisation, IP space, devices, circuits and more.

The screenshots in this guide show NetBox populated with a small set of example objects. A freshly deployed instance starts empty and ready for you to model your own network.

Under IPAM > Prefixes, record your IP space: aggregates, prefixes, IP ranges and individual addresses, each with a status, VRF, tenant, role and description. NetBox validates hierarchy and utilisation automatically.

Under Devices, record your physical and virtual infrastructure: sites, racks, manufacturers, device types and the devices themselves, with roles, interfaces, cabling and console connections.

NetBox exposes a complete REST API under /api/. To call any endpoint, send the token from /root/netbox-credentials.txt in the Authorization: Token <token> header. Read the token into a shell variable and query your devices and prefixes:

TOKEN=$(sudo grep '^NETBOX_API_TOKEN=' /root/netbox-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'devices HTTP %{http_code}\n' -H "Authorization: Token $TOKEN" http://localhost/api/dcim/devices/

A GraphQL endpoint is also available at /graphql/. You can create additional scoped tokens from Admin > API Tokens in the web UI.

NetBox ships on plain HTTP on port 80 so it works immediately. For production, point a DNS record at the instance's public IP. Add the hostname to ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS in /opt/netbox/netbox/netbox/configuration.py, and terminate TLS with a certificate.

A common approach is to obtain a certificate with certbot and reverse proxy through nginx. Alternatively, place an Application Load Balancer with an ACM certificate in front of the instance.

Open port 443 in your security group, then restart the application after editing the configuration:

$
sudo systemctl restart netbox netbox-rq