Merge pull request #5172 from netbox-community/develop

Release v2.9.4

.gitattributes

@@ -1 +1,5 @@
 *.sh text eol=lf
+# Treat minified or packed JS/CSS files as binary, as they're not meant to be human-readable
+*.min.* binary
+*.map binary
+*.pack.js binary

.github/ISSUE_TEMPLATE/bug_report.md

@@ -15,24 +15,24 @@ about: Report a reproducible bug in the current release of NetBox
 
     Please describe the environment in which you are running NetBox. Be sure
     that you are running an unmodified instance of the latest stable release
-    before submitting a bug report.
+    before submitting a bug report, and that any plugins have been disabled.
 -->
 ### Environment
-* Python version:  <!-- Example: 3.6.9 -->
-* NetBox version:  <!-- Example: 2.7.3 -->
+* Python version: 
+* NetBox version: 
 
 <!--
     Describe in detail the exact steps that someone else can take to reproduce
-    this bug using the current stable release of NetBox (or the current beta
-    release where applicable). Begin with the creation of any necessary
-    database objects and call out every operation being performed explicitly.
-    If reporting a bug in the REST API, be sure to reconstruct the raw HTTP
-    request(s) being made: Don't rely on a wrapper like pynetbox.
+    this bug using the current stable release of NetBox. Begin with the
+    creation of any necessary database objects and call out every operation
+    being performed explicitly. If reporting a bug in the REST API, be sure to
+    reconstruct the raw HTTP request(s) being made: Don't rely on a client
+    library such as pynetbox.
 -->
 ### Steps to Reproduce
-1.
-2.
-3.
+1. 
+2. 
+3. 
 
 <!-- What did you expect to happen? -->
 ### Expected Behavior

.github/stale.yml

@@ -4,19 +4,19 @@
 only: issues
 
 # Number of days of inactivity before an issue becomes stale
-daysUntilStale: 14
+daysUntilStale: 45
 
 # Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
+daysUntilClose: 15
 
 # Issues with these labels will never be considered stale
 exemptLabels:
   - "status: accepted"
-  - "status: gathering feedback"
   - "status: blocked"
+  - "status: needs milestone"
 
 # Label to use when marking an issue as stale
-staleLabel: wontfix
+staleLabel: "pending closure"
 
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >

.gitignore

@@ -9,6 +9,7 @@
 /netbox/static
 /venv/
 /*.sh
+local_requirements.txt
 !upgrade.sh
 fabfile.py
 gunicorn.py

.travis.yml

@@ -3,10 +3,9 @@ services:
   - postgresql
   - redis-server
 addons:
-  postgresql: "9.4"
+  postgresql: "9.6"
 language: python
 python:
-  - "3.5"
   - "3.6"
   - "3.7"
 install:

CONTRIBUTING.md

@@ -99,6 +99,10 @@ help prevent wasting time on something that might we might not be able to
 implement. When suggesting a new feature, also make sure it won't conflict with
 any work that's already in progress.
 
+* Once you've opened or identified an issue you'd like to work on, ask that it
+be assigned to you so that others are aware it's being worked on. A maintainer
+will then mark the issue as "accepted."
+
 * Any pull request which does _not_ relate to an accepted issue will be closed.
 
 * All major new functionality must include relevant tests where applicable.
@@ -132,18 +136,17 @@ accumulating a large backlog of work.
 The core maintainers group has chosen to make use of GitHub's [Stale bot](https://github.com/apps/stale)
 to aid in issue management.
 
-* Issues will be marked as stale after 14 days of no activity.
-* Then after 7 more days of inactivity, the issue will be closed.
+* Issues will be marked as stale after 45 days of no activity.
+* Then after 15 more days of inactivity, the issue will be closed.
 * Any issue bearing one of the following labels will be exempt from all Stale
   bot actions:
   * `status: accepted`
-  * `status: gathering feedback`
   * `status: blocked`
+  * `status: needs milestone`
 
-It is natural that some new issues get more attention than others. Often this
-is a metric of an issues's overall value to the project. In other cases in
-which issues merely get lost in the shuffle, notifications from Stale bot can
-bring renewed attention to potentially meaningful issues.
+It is natural that some new issues get more attention than others. Stale bot
+helps bring renewed attention to potentially valuable issues that may have been
+overlooked.
 
 ## Maintainer Guidance
 

README.md

@@ -1,7 +1,5 @@
 ![NetBox](docs/netbox_logo.svg "NetBox logo")
 
-**The [2020 NetBox user survey](https://docs.google.com/forms/d/1OVZuC4kQ-6kJbVf0bDB6vgkL9H96xF6phvYzby23elk/edit) is open!** Your feedback helps guide the project's long-term development.
-
 NetBox is an IP address management (IPAM) and data center infrastructure
 management (DCIM) tool. Initially conceived by the network engineering team at
 [DigitalOcean](https://www.digitalocean.com/), NetBox was developed specifically

base_requirements.txt

@@ -42,10 +42,6 @@ django-tables2
 # https://github.com/alex/django-taggit
 django-taggit
 
-# A Django REST Framework serializer which represents tags
-# https://github.com/glemmaPaul/django-taggit-serializer
-django-taggit-serializer
-
 # A Django field for representing time zones
 # https://github.com/mfogel/django-timezone-field/
 django-timezone-field
@@ -68,8 +64,7 @@ Jinja2
 
 # Simple markup language for rendering HTML
 # https://github.com/Python-Markdown/markdown
-# py-gfm requires Markdown<3.0
-Markdown<3.0
+Markdown
 
 # Library for manipulating IP prefixes and addresses
 # https://github.com/drkjam/netaddr

contrib/apache.conf

@@ -0,0 +1,26 @@
+<VirtualHost *:443>
+    ProxyPreserveHost On
+
+    # CHANGE THIS TO YOUR SERVER'S NAME
+    ServerName netbox.example.com
+
+    SSLEngine on
+    SSLCertificateFile /etc/ssl/certs/netbox.crt
+    SSLCertificateKeyFile /etc/ssl/private/netbox.key
+
+    Alias /static /opt/netbox/netbox/static
+
+    <Directory /opt/netbox/netbox/static>
+        Options Indexes FollowSymLinks MultiViews
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Location /static>
+        ProxyPass !
+    </Location>
+
+    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+    ProxyPass / http://127.0.0.1:8001/
+    ProxyPassReverse / http://127.0.0.1:8001/
+</VirtualHost>

contrib/nginx.conf

@@ -0,0 +1,29 @@
+server {
+    listen 443 ssl;
+
+    # CHANGE THIS TO YOUR SERVER'S NAME
+    server_name netbox.example.com;
+
+    ssl_certificate /etc/ssl/certs/netbox.crt;
+    ssl_certificate_key /etc/ssl/private/netbox.key;
+
+    client_max_body_size 25m;
+
+    location /static/ {
+        alias /opt/netbox/netbox/static/;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8001;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    # Redirect HTTP traffic to HTTPS
+    listen 80;
+    server_name _;
+    return 301 https://$host$request_uri;
+}

docs/additional-features/caching.md

@@ -1,21 +1,25 @@
 # Caching
 
-To improve performance, NetBox supports caching for most object and list views. Caching is implemented using Redis,
-and [django-cacheops](https://github.com/Suor/django-cacheops)
+NetBox supports database query caching using [django-cacheops](https://github.com/Suor/django-cacheops) and Redis. When a query is made, the results are cached in Redis for a short period of time, as defined by the [CACHE_TIMEOUT](../../configuration/optional-settings/#cache_timeout) parameter (15 minutes by default). Within that time, all recurrences of that specific query will return the pre-fetched results from the cache.
 
-Several management commands are avaliable for administrators to manually invalidate cache entries in extenuating circumstances.
+If a change is made to any of the objects returned by the query within that time, or if the timeout expires, the results are automatically invalidated and the next request for those results will be sent to the database.
 
-To invalidate a specifc model instance (for example a Device with ID 34):
-```
-python netbox/manage.py invalidate dcim.Device.34
+## Invalidating Cached Data
+
+Although caching is performed automatically and rarely requires administrative intervention, NetBox provides the `invalidate` management command to force invalidation of cached results. This command can reference a specific object my its type and numeric ID:
+
+```no-highlight
+$ python netbox/manage.py invalidate dcim.Device.34
 ```
 
-To invalidate all instance of a model:
-```
-python netbox/manage.py invalidate dcim.Device
+Alternatively, it can also delete all cached results for an object type:
+
+```no-highlight
+$ python netbox/manage.py invalidate dcim.Device
 ```
 
-To flush the entire cache database:
-```
-python netbox/manage.py invalidate all
+Finally, calling it with the `all` argument will force invalidation of the entire cache database:
+
+```no-highlight
+$ python netbox/manage.py invalidate all
 ```

docs/additional-features/change-logging.md

@@ -1,9 +1,9 @@
 # Change Logging
 
-Every time an object in NetBox is created, updated, or deleted, a serialized copy of that object is saved to the database, along with meta data including the current time and the user associated with the change. These records form a running changelog both for each individual object as well as NetBox as a whole (Organization > Changelog).
+Every time an object in NetBox is created, updated, or deleted, a serialized copy of that object is saved to the database, along with meta data including the current time and the user associated with the change. These records form a persistent record of changes both for each individual object as well as NetBox as a whole. The global change log can be viewed by navigating to Other > Change Log.
 
-A serialized representation is included for each object in JSON format. This is similar to how objects are conveyed within the REST API, but does not include any nested representations. For instance, the `tenant` field of a site will record only the tenant's ID, not a representation of the tenant.
+A serialized representation of the instance being modified is included in JSON format. This is similar to how objects are conveyed within the REST API, but does not include any nested representations. For instance, the `tenant` field of a site will record only the tenant's ID, not a representation of the tenant.
 
-When a request is made, a random request ID is generated and attached to any change records resulting from the request. For example, editing multiple objects in bulk will create a change record for each object, and each of those objects will be assigned the same request ID. This makes it easy to identify all the change records associated with a particular request.
+When a request is made, a UUID is generated and attached to any change records resulting from that request. For example, editing three objects in bulk will create a separate change record for each  (three in total), and each of those objects will be associated with the same UUID. This makes it easy to identify all the change records resulting from a particular request.
 
-Change records are exposed in the API via the read-only endpoint `/api/extras/object-changes/`. They may also be exported in CSV format.
+Change records are exposed in the API via the read-only endpoint `/api/extras/object-changes/`. They may also be exported via the web UI in CSV format.

docs/additional-features/context-data.md

@@ -1,3 +0,0 @@
-# Context Data
-
-{!docs/models/extras/configcontext.md!}

docs/additional-features/custom-links.md

@@ -1,6 +1,6 @@
 # Custom Links
 
-Custom links allow users to place arbitrary hyperlinks within NetBox views. These are helpful for cross-referencing related records in external systems. For example, you might create a custom link on the device view which links to the current device in a network monitoring system.
+Custom links allow users to display arbitrary hyperlinks to external content within NetBox object views. These are helpful for cross-referencing related records in systems outside of NetBox. For example, you might create a custom link on the device view which links to the current device in a network monitoring system.
 
 Custom links are created under the admin UI. Each link is associated with a particular NetBox object type (site, device, prefix, etc.) and will be displayed on relevant views. Each link is assigned text and a URL, both of which support Jinja2 templating. The text and URL are rendered with the context variable `obj` representing the current object.
 
@@ -11,7 +11,7 @@ For example, you might define a link like this:
 
 When viewing a device named Router4, this link would render as:
 
-```
+```no-highlight
 <a href="https://nms.example.com/nodes/?name=Router4">View NMS</a>
 ```
 
@@ -23,21 +23,20 @@ Only links which render with non-empty text are included on the page. You can em
 
 For example, if you only want to display a link for active devices, you could set the link text to
 
-```
-{% if obj.status == 1 %}View NMS{% endif %}
+```jinja2
+{% if obj.status == 'active' %}View NMS{% endif %}
 ```
 
 The link will not appear when viewing a device with any status other than "active."
 
-Another example, if you want to only show an object of a certain manufacturer, you could set the link text to:
+As another example, if you wanted to show only devices belonging to a certain manufacturer, you could do something like this:
 
-```
-{% if obj.device_type.manufacturer.name == 'Cisco' %}View NMS {% endif %}
+```jinja2
+{% if obj.device_type.manufacturer.name == 'Cisco' %}View NMS{% endif %}
 ```
 
 The link will only appear when viewing a device with a manufacturer name of "Cisco."
 
 ## Link Groups
 
-You can specify a group name to organize links into related sets. Grouped links will render as a dropdown menu beneath a
-single button bearing the name of the group.
+Group names can be specified to organize links into groups. Links with the same group name will render as a dropdown menu beneath a single button bearing the name of the group.

docs/additional-features/custom-scripts.md

@@ -6,22 +6,24 @@ Custom scripting was introduced to provide a way for users to execute custom log
 * Create a range of new reserved prefixes or IP addresses
 * Fetch data from an external source and import it to NetBox
 
-Custom scripts are Python code and exist outside of the official NetBox code base, so they can be updated and changed without interfering with the core NetBox installation. And because they're written from scratch, a custom script can be used to accomplish just about anything.
+Custom scripts are Python code and exist outside of the official NetBox code base, so they can be updated and changed without interfering with the core NetBox installation. And because they're completely custom, there is no inherent limitation on what a script can accomplish.
 
 ## Writing Custom Scripts
 
 All custom scripts must inherit from the `extras.scripts.Script` base class. This class provides the functionality necessary to generate forms and log activity.
 
-```
+```python
 from extras.scripts import Script
 
 class MyScript(Script):
-    ..
+    ...
 ```
 
-Scripts comprise two core components: variables and a `run()` method. Variables allow your script to accept user input via the NetBox UI. The `run()` method is where your script's execution logic lives. (Note that your script can have as many methods as needed: this is merely the point of invocation for NetBox.)
+Scripts comprise two core components: a set of variables and a `run()` method. Variables allow your script to accept user input via the NetBox UI, but they are optional: If your script does not require any user input, there is no need to define any variables.
 
-```
+The `run()` method is where your script's execution logic lives. (Note that your script can have as many methods as needed: this is merely the point of invocation for NetBox.)
+
+```python
 class MyScript(Script):
     var1 = StringVar(...)
     var2 = IntegerVar(...)
@@ -37,17 +39,17 @@ The `run()` method should accept two arguments:
 * `commit` - A boolean indicating whether database changes will be committed.
 
 !!! note
-    The `commit` argument was introduced in NetBox v2.7.8. Backward compatibility is maintained for scripts which accept only the `data` argument, however moving forward scripts should accept both arguments.
+    The `commit` argument was introduced in NetBox v2.7.8. Backward compatibility is maintained for scripts which accept only the `data` argument, however beginning with v2.10 NetBox will require the `run()` method of every script to accept both arguments. (Either argument may still be ignored within the method.)
 
-Defining variables is optional: You may create a script with only a `run()` method if no user input is needed.
+Defining script variables is optional: You may create a script with only a `run()` method if no user input is needed.
 
-Returning output from your script is optional. Any raw output generated by the script will be displayed under the "output" tab in the UI.
+Any output generated by the script during its execution will be displayed under the "output" tab in the UI.
 
 ## Module Attributes
 
 ### `name`
 
-You can define `name` within a script module (the Python file which contains one or more scripts) to set the module name. If `name` is not defined, the filename will be used.
+You can define `name` within a script module (the Python file which contains one or more scripts) to set the module name. If `name` is not defined, the module's file name will be used.
 
 ## Script Attributes
 
@@ -61,19 +63,11 @@ This is the human-friendly names of your script. If omitted, the class name will
 
 A human-friendly description of what your script does.
 
-### `field_order`
-
-A list of field names indicating the order in which the form fields should appear. This is optional, however on Python 3.5 and earlier the fields will appear in random order. (Declarative ordering is preserved on Python 3.6 and above.) For example:
-
-```
-field_order = ['var1', 'var2', 'var3']
-```
-
 ### `commit_default`
 
 The checkbox to commit database changes when executing a script is checked by default. Set `commit_default` to False under the script's Meta class to leave this option unchecked by default.
 
-```
+```python
 commit_default = False
 ```
 
@@ -83,8 +77,9 @@ Details of the current HTTP request (the one being made to execute the script) a
 
 ```python
 username = self.request.user.username
-ip_address = self.request.META.get('HTTP_X_FORWARDED_FOR') or self.request.META.get('REMOTE_ADDR')
-self.log_info("Running as user {} (IP: {})...".format(username, ip_address))
+ip_address = self.request.META.get('HTTP_X_FORWARDED_FOR') or \
+    self.request.META.get('REMOTE_ADDR')
+self.log_info(f"Running as user {username} (IP: {ip_address})...")
 ```
 
 For a complete list of available request parameters, please see the [Django documentation](https://docs.djangoproject.com/en/stable/ref/request-response/).
@@ -112,30 +107,40 @@ Log messages are returned to the user upon execution of the script. Markdown ren
 
 ## Variable Reference
 
+### Default Options
+
+All custom script variables support the following default options:
+
+* `default` - The field's default value
+* `description` - A brief user-friendly description of the field
+* `label` - The field name to be displayed in the rendered form
+* `required` - Indicates whether the field is mandatory (all fields are required by default)
+* `widget` - The class of form widget to use (see the [Django documentation](https://docs.djangoproject.com/en/stable/ref/forms/widgets/))
+
 ### StringVar
 
-Stores a string of characters (i.e. a line of text). Options include:
+Stores a string of characters (i.e. text). Options include:
 
 * `min_length` - Minimum number of characters
 * `max_length` - Maximum number of characters
 * `regex` - A regular expression against which the provided value must match
 
-Note: `min_length` and `max_length` can be set to the same number to effect a fixed-length field.
+Note that `min_length` and `max_length` can be set to the same number to effect a fixed-length field.
 
 ### TextVar
 
-Arbitrary text of any length. Renders as multi-line text input field.
+Arbitrary text of any length. Renders as a multi-line text input field.
 
 ### IntegerVar
 
-Stored a numeric integer. Options include:
+Stores a numeric integer. Options include:
 
 * `min_value` - Minimum value
 * `max_value` - Maximum value
 
 ### BooleanVar
 
-A true/false flag. This field has no options beyond the defaults.
+A true/false flag. This field has no options beyond the defaults listed above.
 
 ### ChoiceVar
 
@@ -154,15 +159,62 @@ CHOICES = (
 direction = ChoiceVar(choices=CHOICES)
 ```
 
+In the example above, selecting the choice labeled "North" will submit the value `n`.
+
+### MultiChoiceVar
+
+Similar to `ChoiceVar`, but allows for the selection of multiple choices.
+
 ### ObjectVar
 
-A NetBox object. The list of available objects is defined by the queryset parameter. Each instance of this variable is limited to a single object type.
+A particular object within NetBox. Each ObjectVar must specify a particular model, and allows the user to select one of the available instances. ObjectVar accepts several arguments, listed below.
 
-* `queryset` - A [Django queryset](https://docs.djangoproject.com/en/stable/topics/db/queries/)
+* `model` - The model class
+* `display_field` - The name of the REST API object field to display in the selection list (default: `'name'`)
+* `query_params` - A dictionary of query parameters to use when retrieving available options (optional)
+* `null_option` - A label representing a "null" or empty choice (optional)
+
+The `display_field` argument is useful when referencing a model which does not have a `name` field. For example, when displaying a list of device types, you would likely use the `model` field:
+
+```python
+device_type = ObjectVar(
+    model=DeviceType,
+    display_field='model'
+)
+```
+
+To limit the selections available within the list, additional query parameters can be passed as the `query_params` dictionary. For example, to show only devices with an "active" status:
+
+```python
+device = ObjectVar(
+    model=Device,
+    query_params={
+        'status': 'active'
+    }
+)
+```
+
+Multiple values can be specified by assigning a list to the dictionary key. It is also possible to reference the value of other fields in the form by prepending a dollar sign (`$`) to the variable's name.
+
+```python
+region = ObjectVar(
+    model=Region
+)
+site = ObjectVar(
+    model=Site,
+    query_params={
+        'region_id': '$region'
+    }
+)
+```
+
+### MultiObjectVar
+
+Similar to `ObjectVar`, but allows for the selection of multiple objects.
 
 ### FileVar
 
-An uploaded file. Note that uploaded files are present in memory only for the duration of the script's execution: They will not be save for future use.
+An uploaded file. Note that uploaded files are present in memory only for the duration of the script's execution: They will not be automatically saved for future use. The script is responsible for writing file contents to disk where necessary.
 
 ### IPAddressVar
 
@@ -176,18 +228,8 @@ An IPv4 or IPv6 address with a mask. Returns a `netaddr.IPNetwork` object which
 
 An IPv4 or IPv6 network with a mask. Returns a `netaddr.IPNetwork` object. Two attributes are available to validate the provided mask:
 
-* `min_prefix_length` - Minimum length of the mask (default: none)
-* `max_prefix_length` - Maximum length of the mask (default: none)
-
-### Default Options
-
-All variables support the following default options:
-
-* `default` - The field's default value
-* `description` - A brief description of the field
-* `label` - The name of the form field
-* `required` - Indicates whether the field is mandatory (default: true)
-* `widget` - The class of form widget to use (see the [Django documentation](https://docs.djangoproject.com/en/stable/ref/forms/widgets/))
+* `min_prefix_length` - Minimum length of the mask
+* `max_prefix_length` - Maximum length of the mask
 
 ## Example
 
@@ -199,11 +241,11 @@ Below is an example script that creates new objects for a planned site. The user
 
 These variables are presented as a web form to be completed by the user. Once submitted, the script's `run()` method is called to create the appropriate objects.
 
-```
+```python
 from django.utils.text import slugify
 
 from dcim.choices import DeviceStatusChoices, SiteStatusChoices
-from dcim.models import Device, DeviceRole, DeviceType, Site
+from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
 from extras.scripts import *
 
 
@@ -220,12 +262,17 @@ class NewBranchScript(Script):
     switch_count = IntegerVar(
         description="Number of access switches to create"
     )
+    manufacturer = ObjectVar(
+        model=Manufacturer,
+        required=False
+    )
     switch_model = ObjectVar(
         description="Access switch model",
-        queryset = DeviceType.objects.filter(
-            manufacturer__name='Cisco',
-            model__in=['Catalyst 3560X-48T', 'Catalyst 3750X-48T']
-        )
+        model=DeviceType,
+        display_field='model',
+        query_params={
+            'manufacturer_id': '$manufacturer'
+        }
     )
 
     def run(self, data, commit):
@@ -237,20 +284,20 @@ class NewBranchScript(Script):
             status=SiteStatusChoices.STATUS_PLANNED
         )
         site.save()
-        self.log_success("Created new site: {}".format(site))
+        self.log_success(f"Created new site: {site}")
 
         # Create access switches
         switch_role = DeviceRole.objects.get(name='Access Switch')
         for i in range(1, data['switch_count'] + 1):
             switch = Device(
                 device_type=data['switch_model'],
-                name='{}-switch{}'.format(site.slug, i),
+                name=f'{site.slug}-switch{i}',
                 site=site,
                 status=DeviceStatusChoices.STATUS_PLANNED,
                 device_role=switch_role
             )
             switch.save()
-            self.log_success("Created new switch: {}".format(switch))
+            self.log_success(f"Created new switch: {switch}")
 
         # Generate a CSV table of new devices
         output = [

docs/additional-features/export-templates.md

@@ -4,9 +4,14 @@ NetBox allows users to define custom templates that can be used when exporting o
 
 Each export template is associated with a certain type of object. For instance, if you create an export template for VLANs, your custom template will appear under the "Export" button on the VLANs list.
 
-Export templates are written in [Django's template language](https://docs.djangoproject.com/en/stable/ref/templates/language/), which is very similar to Jinja2. The list of objects returned from the database is stored in the `queryset` variable, which you'll typically want to iterate through using a `for` loop. Object properties can be access by name. For example:
+Export templates may be written in Jinja2 or [Django's template language](https://docs.djangoproject.com/en/stable/ref/templates/language/), which is very similar to Jinja2.
 
-```
+!!! warning
+    Support for Django's native templating logic will be removed in NetBox v2.10.
+
+The list of objects returned from the database when rendering an export template is stored in the `queryset` variable, which you'll typically want to iterate through using a `for` loop. Object properties can be access by name. For example:
+
+```jinja2
 {% for rack in queryset %}
 Rack: {{ rack.name }}
 Site: {{ rack.site.name }}

docs/additional-features/graphs.md

@@ -1,5 +1,8 @@
 # Graphs
 
+!!! warning
+    Native support for embedded graphs is due to be removed in NetBox v2.10. It will likely be superseded by a plugin providing similar functionality.
+
 NetBox does not have the ability to generate graphs natively, but this feature allows you to embed contextual graphs from an external resources (such as a monitoring system) inside the site, provider, and interface views. Each embedded graph must be defined with the following parameters:
 
 * **Type:** Site, device, provider, or interface. This determines in which view the graph will be displayed.
@@ -8,10 +11,7 @@ NetBox does not have the ability to generate graphs natively, but this feature a
 * **Source URL:** The source of the image to be embedded. The associated object will be available as a template variable named `obj`.
 * **Link URL (optional):** A URL to which the graph will be linked. The associated object will be available as a template variable named `obj`.
 
-Graph names and links can be rendered using the Django or Jinja2 template languages.
-
-!!! warning
-    Support for the Django templating language will be removed in NetBox v2.8. Jinja2 is recommended.
+Graph names and links can be rendered using Jinja2 or [Django's template language](https://docs.djangoproject.com/en/stable/ref/templates/language/).
 
 ## Examples
 

docs/additional-features/napalm.md

@@ -1,11 +1,13 @@
 # NAPALM
 
-NetBox supports integration with the [NAPALM automation](https://napalm-automation.net/) library. NAPALM allows NetBox to fetch live data from devices and return it to a requester via its REST API.
+NetBox supports integration with the [NAPALM automation](https://napalm-automation.net/) library. NAPALM allows NetBox to serve a proxy for operational data, fetching live data from network devices and returning it to a requester via its REST API. Note that NetBox does not store any NAPALM data locally.
 
-!!! info
-    To enable the integration, the NAPALM library must be installed. See [installation steps](../../installation/3-netbox/#napalm-automation-optional) for more information.
+!!! note
+    To enable this integration, the NAPALM library must be installed. See [installation steps](../../installation/3-netbox/#napalm) for more information.
 
-```
+Below is an example REST API request and response:
+
+```no-highlight
 GET /api/dcim/devices/1/napalm/?method=get_environment
 
 {
@@ -15,13 +17,16 @@ GET /api/dcim/devices/1/napalm/?method=get_environment
 }
 ```
 
+!!! note
+    To make NAPALM requests via the NetBox REST API, a NetBox user must have assigned a permission granting the `napalm_read` action for the device object type.
+
 ## Authentication
 
-By default, the [`NAPALM_USERNAME`](../../configuration/optional-settings/#napalm_username) and [`NAPALM_PASSWORD`](../../configuration/optional-settings/#napalm_password) are used for NAPALM authentication. They can be overridden for an individual API call through the `X-NAPALM-Username` and `X-NAPALM-Password` headers.
+By default, the [`NAPALM_USERNAME`](../../configuration/optional-settings/#napalm_username) and [`NAPALM_PASSWORD`](../../configuration/optional-settings/#napalm_password) configuration parameters are used for NAPALM authentication. They can be overridden for an individual API call by specifying the `X-NAPALM-Username` and `X-NAPALM-Password` headers.
 
 ```
 $ curl "http://localhost/api/dcim/devices/1/napalm/?method=get_environment" \
--H "Authorization: Token f4b378553dacfcfd44c5a0b9ae49b57e29c552b5" \
+-H "Authorization: Token $TOKEN" \
 -H "Content-Type: application/json" \
 -H "Accept: application/json; indent=4" \
 -H "X-NAPALM-Username: foo" \
@@ -30,13 +35,13 @@ $ curl "http://localhost/api/dcim/devices/1/napalm/?method=get_environment" \
 
 ## Method Support
 
-The list of supported NAPALM methods depends on the [NAPALM driver](https://napalm.readthedocs.io/en/latest/support/index.html#general-support-matrix) configured for the platform of a device. NetBox only supports [get](https://napalm.readthedocs.io/en/latest/support/index.html#getters-support-matrix) methods.
+The list of supported NAPALM methods depends on the [NAPALM driver](https://napalm.readthedocs.io/en/latest/support/index.html#general-support-matrix) configured for the platform of a device. Because there is no granular mechanism in place for limiting potentially disruptive requests, NetBox supports only read-only [get](https://napalm.readthedocs.io/en/latest/support/index.html#getters-support-matrix) methods.
 
 ## Multiple Methods
 
-More than one method in an API call can be invoked by adding multiple `method` parameters. For example:
+It is possible to request the output of multiple NAPALM methods in a single API request by passing multiple `method` parameters. For example:
 
-```
+```no-highlight
 GET /api/dcim/devices/1/napalm/?method=get_ntp_servers&method=get_ntp_peers
 
 {
@@ -51,14 +56,11 @@ GET /api/dcim/devices/1/napalm/?method=get_ntp_servers&method=get_ntp_peers
 
 ## Optional Arguments
 
-The behavior of NAPALM drivers can be adjusted according to the [optional arguments](https://napalm.readthedocs.io/en/latest/support/index.html#optional-arguments). NetBox exposes those arguments using headers prefixed with `X-NAPALM-`.
-
-
-For instance, the SSH port is changed to 2222 in this API call:
+The behavior of NAPALM drivers can be adjusted according to the [optional arguments](https://napalm.readthedocs.io/en/latest/support/index.html#optional-arguments). NetBox exposes those arguments using headers prefixed with `X-NAPALM-`. For example, the SSH port is changed to 2222 in this API call:
 
 ```
 $ curl "http://localhost/api/dcim/devices/1/napalm/?method=get_environment" \
--H "Authorization: Token f4b378553dacfcfd44c5a0b9ae49b57e29c552b5" \
+-H "Authorization: Token $TOKEN" \
 -H "Content-Type: application/json" \
 -H "Accept: application/json; indent=4" \
 -H "X-NAPALM-port: 2222"

docs/additional-features/prometheus-metrics.md

@@ -23,12 +23,7 @@ For the exhaustive list of exposed metrics, visit the `/metrics` endpoint on you
 
 ## Multi Processing Notes
 
-When deploying NetBox in a multiprocess mannor--such as using Gunicorn as recomented in the installation docs--the Prometheus client library requires the use of a shared directory
-to collect metrics from all the worker processes. This can be any arbitrary directory to which the processes have read/write access. This directory is then made available by use of the
-`prometheus_multiproc_dir` environment variable.
+When deploying NetBox in a multiprocess manner (e.g. running multiple Gunicorn workers) the Prometheus client library requires the use of a shared directory to collect metrics from all worker processes. To configure this, first create or designate a local directory to which the worker processes have read and write access, and then configure your WSGI service (e.g. Gunicorn) to define this path as the `prometheus_multiproc_dir` environment variable.
 
-This can be setup by first creating a shared directory and then adding this line (with the appropriate directory) to the `[program:netbox]` section of the supervisor config file.
-
-```
-environment=prometheus_multiproc_dir=/tmp/prometheus_metrics
-```
+!!! warning
+    If having accurate long-term metrics in a multiprocess environment is crucial to your deployment, it's recommended you use the `uwsgi` library instead of `gunicorn`. The issue lies in the way `gunicorn` tracks worker processes (vs `uwsgi`) which helps manage the metrics files created by the above configurations. If you're using Netbox with gunicorn in a containerized enviroment following the one-process-per-container methodology, then you will likely not need to change to `uwsgi`. More details can be found in  [issue #3779](https://github.com/netbox-community/netbox/issues/3779#issuecomment-590547562).

docs/additional-features/reports.md

@@ -33,7 +33,6 @@ Within each report class, we'll create a number of test methods to execute our r
 
 ```
 from dcim.choices import DeviceStatusChoices
-from dcim.constants import CONNECTION_STATUS_PLANNED
 from dcim.models import ConsolePort, Device, PowerPort
 from extras.reports import Report
 
@@ -51,7 +50,7 @@ class DeviceConnectionsReport(Report):
                     console_port.device,
                     "No console connection defined for {}".format(console_port.name)
                 )
-            elif console_port.connection_status == CONNECTION_STATUS_PLANNED:
+            elif not console_port.connection_status:
                 self.log_warning(
                     console_port.device,
                     "Console connection for {} marked as planned".format(console_port.name)
@@ -67,7 +66,7 @@ class DeviceConnectionsReport(Report):
             for power_port in PowerPort.objects.filter(device=device):
                 if power_port.connected_endpoint is not None:
                     connected_ports += 1
-                    if power_port.connection_status == CONNECTION_STATUS_PLANNED:
+                    if not power_port.connection_status:
                         self.log_warning(
                             device,
                             "Power connection for {} marked as planned".format(power_port.name)

docs/additional-features/tags.md

@@ -1,3 +0,0 @@
-# Tagging
-
-{!docs/models/extras/tag.md!}

docs/additional-features/webhooks.md

@@ -1,6 +1,6 @@
 # Webhooks
 
-A webhook is a mechanism for conveying to some external system a change that took place in NetBox. For example, you may want to notify a monitoring system whenever a device status is changed in NetBox. This can be done by creating a webhook for the device model in NetBox. When NetBox detects a change to a device, an HTTP request containing the details of the change and who made it be sent to the specified receiver. Webhooks are configured in the admin UI under Extras > Webhooks.
+A webhook is a mechanism for conveying to some external system a change that took place in NetBox. For example, you may want to notify a monitoring system whenever the status of a device is updated in NetBox. This can be done by creating a webhook for the device model in NetBox and identifying the webhook receiver. When NetBox detects a change to a device, an HTTP request containing the details of the change and who made it be sent to the specified receiver. Webhooks are configured in the admin UI under Extras > Webhooks.
 
 ## Configuration
 
@@ -8,7 +8,7 @@ A webhook is a mechanism for conveying to some external system a change that too
 * **Object type(s)** - The type or types of NetBox object that will trigger the webhook.
 * **Enabled** - If unchecked, the webhook will be inactive.
 * **Events** - A webhook may trigger on any combination of create, update, and delete events. At least one event type must be selected.
-* **HTTP method** - The type of HTTP request to send. Options include GET, POST, PUT, PATCH, and DELETE.
+* **HTTP method** - The type of HTTP request to send. Options include `GET`, `POST`, `PUT`, `PATCH`, and `DELETE`.
 * **URL** - The fuly-qualified URL of the request to be sent. This may specify a destination port number if needed.
 * **HTTP content type** - The value of the request's `Content-Type` header. (Defaults to `application/json`)
 * **Additional headers** - Any additional headers to include with the request (optional). Add one header per line in the format `Name: Value`. Jinja2 templating is supported for this field (see below).
@@ -19,13 +19,13 @@ A webhook is a mechanism for conveying to some external system a change that too
 
 ## Jinja2 Template Support
 
-[Jinja2 templating](https://jinja.palletsprojects.com/) is supported for the `additional_headers` and `body_template` fields. This enables the user to convey change data in the request headers as well as to craft a customized request body. Request content can be crafted to enable the direct interaction with external systems by ensuring the outgoing message is in a format the receiver expects and understands.
+[Jinja2 templating](https://jinja.palletsprojects.com/) is supported for the `additional_headers` and `body_template` fields. This enables the user to convey object data in the request headers as well as to craft a customized request body. Request content can be crafted to enable the direct interaction with external systems by ensuring the outgoing message is in a format the receiver expects and understands.
 
 For example, you might create a NetBox webhook to [trigger a Slack message](https://api.slack.com/messaging/webhooks) any time an IP address is created. You can accomplish this using the following configuration:
 
 * Object type: IPAM > IP address
-* HTTP method: POST
-* URL: <Slack incoming webhook URL>
+* HTTP method: `POST`
+* URL: Slack incoming webhook URL
 * HTTP content type: `application/json`
 * Body template: `{"text": "IP address {{ data['address'] }} was created by {{ username }}!"}`
 
@@ -71,3 +71,36 @@ If no body template is specified, the request body will be populated with a JSON
 When a change is detected, any resulting webhooks are placed into a Redis queue for processing. This allows the user's request to complete without needing to wait for the outgoing webhook(s) to be processed. The webhooks are then extracted from the queue by the `rqworker` process and HTTP requests are sent to their respective destinations. The current webhook queue and any failed webhooks can be inspected in the admin UI under Django RQ > Queues.
 
 A request is considered successful if the response has a 2XX status code; otherwise, the request is marked as having failed. Failed requests may be retried manually via the admin UI.
+
+## Troubleshooting
+
+To assist with verifying that the content of outgoing webhooks is rendered correctly, NetBox provides a simple HTTP listener that can be run locally to receive and display webhook requests. First, modify the target URL of the desired webhook to `http://localhost:9000/`. This will instruct NetBox to send the request to the local server on TCP port 9000. Then, start the webhook receiver service from the NetBox root directory:
+
+```no-highlight
+$ python netbox/manage.py webhook_receiver
+Listening on port http://localhost:9000. Stop with CONTROL-C.
+```
+
+You can test the receiver itself by sending any HTTP request to it. For example:
+
+```no-highlight
+$ curl -X POST http://localhost:9000 --data '{"foo": "bar"}'
+```
+
+The server will print output similar to the following:
+
+```no-highlight
+[1] Tue, 07 Apr 2020 17:44:02 GMT 127.0.0.1 "POST / HTTP/1.1" 200 -
+Host: localhost:9000
+User-Agent: curl/7.58.0
+Accept: */*
+Content-Length: 14
+Content-Type: application/x-www-form-urlencoded
+
+{"foo": "bar"}
+------------
+```
+
+Note that `webhook_receiver` does not actually _do_ anything with the information received: It merely prints the request headers and body for inspection.
+
+Now, when the NetBox webhook is triggered and processed, you should see its headers and content appear in the terminal where the webhook receiver is listening. If you don't, check that the `rqworker` process is running and that webhook events are being placed into the queue (visible under the NetBox admin UI).

docs/administration/netbox-shell.md

@@ -1,17 +1,17 @@
 # The NetBox Python Shell
 
-NetBox includes a Python shell within which objects can be directly queried, created, modified, and deleted. To enter the shell, run the following command:
+NetBox includes a Python management shell within which objects can be directly queried, created, modified, and deleted. To enter the shell, run the following command:
 
 ```
 ./manage.py nbshell
 ```
 
-This will launch a customized version of [the built-in Django shell](https://docs.djangoproject.com/en/stable/ref/django-admin/#shell) with all relevant NetBox models pre-loaded. (If desired, the stock Django shell is also available by executing `./manage.py shell`.)
+This will launch a lightly customized version of [the built-in Django shell](https://docs.djangoproject.com/en/stable/ref/django-admin/#shell) with all relevant NetBox models pre-loaded. (If desired, the stock Django shell is also available by executing `./manage.py shell`.)
 
 ```
 $ ./manage.py nbshell
-### NetBox interactive shell (jstretch-laptop)
-### Python 3.5.2 | Django 2.0.8 | NetBox 2.4.3
+### NetBox interactive shell (localhost)
+### Python 3.6.9 | Django 2.2.11 | NetBox 2.7.10
 ### lsmodels() will show available models. Use help(<model>) for more info.
 ```
 
@@ -28,13 +28,17 @@ DCIM:
   ...
 ```
 
+!!! warning
+    The NetBox shell affords direct access to NetBox data and function with very little validation in place. As such, it is crucial to ensure that only authorized, knowledgeable users are ever granted access to it. Never perform any action in the management shell without having a full backup in place.
+
 ## Querying Objects
 
-Objects are retrieved by forming a [Django queryset](https://docs.djangoproject.com/en/stable/topics/db/queries/#retrieving-objects). The base queryset for an object takes the form `<model>.objects.all()`, which will return a (truncated) list of all objects of that type.
+Objects are retrieved from the database using a [Django queryset](https://docs.djangoproject.com/en/stable/topics/db/queries/#retrieving-objects). The base queryset for an object takes the form `<model>.objects.all()`, which will return a (truncated) list of all objects of that type.
 
 ```
 >>> Device.objects.all()
-<QuerySet [<Device: TestDevice1>, <Device: TestDevice2>, <Device: TestDevice3>, <Device: TestDevice4>, <Device: TestDevice5>, '...(remaining elements truncated)...']>
+<QuerySet [<Device: TestDevice1>, <Device: TestDevice2>, <Device: TestDevice3>,
+<Device: TestDevice4>, <Device: TestDevice5>, '...(remaining elements truncated)...']>
 ```
 
 Use a `for` loop to cycle through all objects in the list:
@@ -43,11 +47,11 @@ Use a `for` loop to cycle through all objects in the list:
 >>> for device in Device.objects.all():
 ...   print(device.name, device.device_type)
 ...
-(u'TestDevice1', <DeviceType: PacketThingy 9000>)
-(u'TestDevice2', <DeviceType: PacketThingy 9000>)
-(u'TestDevice3', <DeviceType: PacketThingy 9000>)
-(u'TestDevice4', <DeviceType: PacketThingy 9000>)
-(u'TestDevice5', <DeviceType: PacketThingy 9000>)
+('TestDevice1', <DeviceType: PacketThingy 9000>)
+('TestDevice2', <DeviceType: PacketThingy 9000>)
+('TestDevice3', <DeviceType: PacketThingy 9000>)
+('TestDevice4', <DeviceType: PacketThingy 9000>)
+('TestDevice5', <DeviceType: PacketThingy 9000>)
 ...
 ```
 
@@ -67,52 +71,53 @@ To retrieve a particular object (typically by its primary key or other unique fi
 
 ### Filtering Querysets
 
-In most cases, you want to retrieve only a specific subset of objects. To filter a queryset, replace `all()` with `filter()` and pass one or more keyword arguments. For example:
+In most cases, you will want to retrieve only a specific subset of objects. To filter a queryset, replace `all()` with `filter()` and pass one or more keyword arguments. For example:
 
 ```
->>> Device.objects.filter(status=STATUS_ACTIVE)
-<QuerySet [<Device: TestDevice1>, <Device: TestDevice2>, <Device: TestDevice3>, <Device: TestDevice8>, <Device: TestDevice9>, '...(remaining elements truncated)...']>
+>>> Device.objects.filter(status="active")
+<QuerySet [<Device: TestDevice1>, <Device: TestDevice2>, <Device: TestDevice3>,
+<Device: TestDevice8>, <Device: TestDevice9>, '...(remaining elements truncated)...']>
 ```
 
 Querysets support slicing to return a specific range of objects.
 
 ```
->>> Device.objects.filter(status=STATUS_ACTIVE)[:3]
+>>> Device.objects.filter(status="active")[:3]
 <QuerySet [<Device: TestDevice1>, <Device: TestDevice2>, <Device: TestDevice3>]>
 ```
 
 The `count()` method can be appended to the queryset to return a count of objects rather than the full list.
 
 ```
->>> Device.objects.filter(status=STATUS_ACTIVE).count()
+>>> Device.objects.filter(status="active").count()
 982
 ```
 
-Relationships with other models can be traversed by concatenating field names with a double-underscore. For example, the following will return all devices assigned to the tenant named "Pied Piper."
+Relationships with other models can be traversed by concatenating attribute names with a double-underscore. For example, the following will return all devices assigned to the tenant named "Pied Piper."
 
 ```
->>> Device.objects.filter(tenant__name='Pied Piper')
+>>> Device.objects.filter(tenant__name="Pied Piper")
 ```
 
 This approach can span multiple levels of relations. For example, the following will return all IP addresses assigned to a device in North America:
 
 ```
->>> IPAddress.objects.filter(interface__device__site__region__slug='north-america')
+>>> IPAddress.objects.filter(interface__device__site__region__slug="north-america")
 ```
 
 !!! note
-    While the above query is functional, it is very inefficient. There are ways to optimize such requests, however they are out of the scope of this document. For more information, see the [Django queryset method reference](https://docs.djangoproject.com/en/stable/ref/models/querysets/) documentation.
+    While the above query is functional, it's not very efficient. There are ways to optimize such requests, however they are out of scope for this document. For more information, see the [Django queryset method reference](https://docs.djangoproject.com/en/stable/ref/models/querysets/) documentation.
 
 Reverse relationships can be traversed as well. For example, the following will find all devices with an interface named "em0":
 
 ```
->>> Device.objects.filter(interfaces__name='em0')
+>>> Device.objects.filter(interfaces__name="em0")
 ```
 
 Character fields can be filtered against partial matches using the `contains` or `icontains` field lookup (the later of which is case-insensitive).
 
 ```
->>> Device.objects.filter(name__icontains='testdevice')
+>>> Device.objects.filter(name__icontains="testdevice")
 ```
 
 Similarly, numeric fields can be filtered by values less than, greater than, and/or equal to a given value.
@@ -124,7 +129,7 @@ Similarly, numeric fields can be filtered by values less than, greater than, and
 Multiple filters can be combined to further refine a queryset.
 
 ```
->>> VLAN.objects.filter(vid__gt=2000, name__icontains='engineering')
+>>> VLAN.objects.filter(vid__gt=2000, name__icontains="engineering")
 ```
 
 To return the inverse of a filtered queryset, use `exclude()` instead of `filter()`.
@@ -132,18 +137,18 @@ To return the inverse of a filtered queryset, use `exclude()` instead of `filter
 ```
 >>> Device.objects.count()
 4479
->>> Device.objects.filter(status=STATUS_ACTIVE).count()
+>>> Device.objects.filter(status="active").count()
 4133
->>> Device.objects.exclude(status=STATUS_ACTIVE).count()
+>>> Device.objects.exclude(status="active").count()
 346
 ```
 
 !!! info
-    The examples above are intended only to provide a cursory introduction to queryset filtering. For an exhaustive list of the available filters, please consult the [Django queryset API docs](https://docs.djangoproject.com/en/stable/ref/models/querysets/).
+    The examples above are intended only to provide a cursory introduction to queryset filtering. For an exhaustive list of the available filters, please consult the [Django queryset API documentation](https://docs.djangoproject.com/en/stable/ref/models/querysets/).
 
 ## Creating and Updating Objects
 
-New objects can be created by instantiating the desired model, defining values for all required attributes, and calling `save()` on the instance.
+New objects can be created by instantiating the desired model, defining values for all required attributes, and calling `save()` on the instance. For example, we can create a new VLAN by specifying its numeric ID, name, and assigned site:
 
 ```
 >>> lab1 = Site.objects.get(pk=7)
@@ -151,22 +156,22 @@ New objects can be created by instantiating the desired model, defining values f
 >>> myvlan.save()
 ```
 
-Alternatively, the above can be performed as a single operation:
+Alternatively, the above can be performed as a single operation. (Note, however, that `save()` does _not_ return the new instance for reuse.)
 
 ```
 >>> VLAN(vid=123, name='MyNewVLAN', site=Site.objects.get(pk=7)).save()
 ```
 
-To modify an object, retrieve it, update the desired field(s), and call `save()` again.
+To modify an existing object, we retrieve it, update the desired field(s), and call `save()` again.
 
 ```
 >>> vlan = VLAN.objects.get(pk=1280)
 >>> vlan.name
-u'MyNewVLAN'
+'MyNewVLAN'
 >>> vlan.name = 'BetterName'
 >>> vlan.save()
 >>> VLAN.objects.get(pk=1280).name
-u'BetterName'
+'BetterName'
 ```
 
 !!! warning
@@ -180,7 +185,7 @@ To delete an object, simply call `delete()` on its instance. This will return a
 >>> vlan
 <VLAN: 123 (BetterName)>
 >>> vlan.delete()
-(1, {u'extras.CustomFieldValue': 0, u'ipam.VLAN': 1})
+(1, {'extras.CustomFieldValue': 0, 'ipam.VLAN': 1})
 ```
 
 To delete multiple objects at once, call `delete()` on a filtered queryset. It's a good idea to always sanity-check the count of selected objects _before_ deleting them.
@@ -189,8 +194,10 @@ To delete multiple objects at once, call `delete()` on a filtered queryset. It's
 >>> Device.objects.filter(name__icontains='test').count()
 27
 >>> Device.objects.filter(name__icontains='test').delete()
-(35, {u'extras.CustomFieldValue': 0, u'dcim.DeviceBay': 0, u'secrets.Secret': 0, u'dcim.InterfaceConnection': 4, u'extras.ImageAttachment': 0, u'dcim.Device': 27, u'dcim.Interface': 4, u'dcim.ConsolePort': 0, u'dcim.PowerPort': 0})
+(35, {'extras.CustomFieldValue': 0, 'dcim.DeviceBay': 0, 'secrets.Secret': 0,
+'dcim.InterfaceConnection': 4, 'extras.ImageAttachment': 0, 'dcim.Device': 27,
+'dcim.Interface': 4, 'dcim.ConsolePort': 0, 'dcim.PowerPort': 0})
 ```
 
 !!! warning
-    Deletions are immediate and irreversible. Always think very carefully before calling `delete()` on an instance or queryset.
+    Deletions are immediate and irreversible. Always consider the impact of deleting objects carefully before calling `delete()` on an instance or queryset.

docs/administration/permissions.md

@@ -0,0 +1,45 @@
+# Permissions
+
+NetBox v2.9 introduced a new object-based permissions framework, which replace's Django's built-in permissions model. Object-based permissions enable an administrator to grant users or groups the ability to perform an action on arbitrary subsets of objects in NetBox, rather than all objects of a certain type. For example, it is possible to grant a user permission to view only sites within a particular region, or to modify only VLANs with a numeric ID within a certain range.
+
+{!docs/models/users/objectpermission.md!}
+
+### Example Constraint Definitions
+
+| Constraints | Description |
+| ----------- | ----------- |
+| `{"status": "active"}` | Status is active |
+| `{"status__in": ["planned", "reserved"]}` | Status is active **OR** reserved |
+| `{"status": "active", "role": "testing"}` | Status is active **OR** role is testing |
+| `{"name__startswith": "Foo"}` | Name starts with "Foo" (case-sensitive) |
+| `{"name__iendswith": "bar"}` | Name ends with "bar" (case-insensitive) |
+| `{"vid__gte": 100, "vid__lt": 200}` | VLAN ID is greater than or equal to 100 **AND** less than 200 |
+| `[{"vid__lt": 200}, {"status": "reserved"}]` | VLAN ID is less than 200 **OR** status is reserved |
+
+## Permissions Enforcement
+
+### Viewing Objects
+
+Object-based permissions work by filtering the database query generated by a user's request to restrict the set of objects returned. When a request is received, NetBox first determines whether the user is authenticated and has been granted to perform the requested action. For example, if the requested URL is `/dcim/devices/`, NetBox will check for the `dcim.view_device` permission. If the user has not been assigned this permission (either directly or via a group assignment), NetBox will return a 403 (forbidden) HTTP response.
+
+If the permission _has_ been granted, NetBox will compile any specified constraints for the model and action. For example, suppose two permissions have been assigned to the user granting view access to the device model, with the following constraints:
+
+```json
+[
+    {"site__name__in":  ["NYC1", "NYC2"]},
+    {"status":  "offline", "tenant__isnull":  true}
+]
+```
+
+This grants the user access to view any device that is assigned to a site named NYC1 or NYC2, **or** which has a status of "offline" and has no tenant assigned. These constraints are equivalent to the following ORM query:
+
+```no-highlight
+Site.objects.filter(
+    Q(site__name__in=['NYC1', 'NYC2']),
+    Q(status='active', tenant__isnull=True)
+)
+```
+
+### Creating and Modifying Objects
+
+The same sort of logic is in play when a user attempts to create or modify an object in NetBox, with a twist. Once validation has completed, NetBox starts an atomic database transaction to facilitate the change, and the object is created or saved normally. Next, still within the transaction, NetBox issues a second query to retrieve the newly created/updated object, filtering the restricted queryset with the object's primary key. If this query fails to return the object, NetBox knows that the new revision does not match the constraints imposed by the permission. The transaction is then rolled back, leaving the database in its original state prior to the change, and the user is informed of the violation.

docs/administration/replicating-netbox.md

@@ -2,7 +2,7 @@
 
 ## Replicating the Database
 
-NetBox uses [PostgreSQL](https://www.postgresql.org/) for its database, so general PostgreSQL best practices will apply to NetBox. You can dump and restore the database using the `pg_dump` and `psql` utilities, respectively.
+NetBox employs a [PostgreSQL](https://www.postgresql.org/) database, so general PostgreSQL best practices apply here. The database can be written to a file and restored using the `pg_dump` and `psql` utilities, respectively.
 
 !!! note
     The examples below assume that your database is named `netbox`.
@@ -23,8 +23,10 @@ pg_dump --exclude-table-data=extras_objectchange netbox > netbox.sql
 
 ### Load an Exported Database
 
+When restoring a database from a file, it's recommended to delete any existing database first to avoid potential conflicts.
+
 !!! warning
-    This will destroy and replace any existing instance of the database.
+    The following will destroy and replace any existing instance of the database.
 
 ```no-highlight
 psql -c 'drop database netbox'
@@ -41,17 +43,15 @@ If you want to export only the database schema, and not the data itself (e.g. fo
 ```no-highlight
 pg_dump -s netbox > netbox_schema.sql
 ```
-If you are migrating your instance of NetBox to a different machine, please make sure you invalidate the cache by performing this command:
-
-```no-highlight
-python3 manage.py invalidate all
-```
 
 ---
 
-## Replicating Media
+## Replicating Uploaded Media
 
-NetBox stored uploaded files (such as image attachments) in its media directory. To fully replicate an instance of NetBox, you'll need to copy both the database and the media files.
+By default, NetBox stores uploaded files (such as image attachments) in its media directory. To fully replicate an instance of NetBox, you'll need to copy both the database and the media files.
+
+!!! note
+    These operations are not necessary if your installation is utilizing a [remote storage backend](../../configuration/optional-settings/#storage_backend).
 
 ### Archive the Media Directory
 
@@ -68,3 +68,13 @@ To extract the saved archive into a new installation, run the following from the
 ```no-highlight
 tar -xf netbox_media.tar.gz
 ```
+
+---
+
+## Cache Invalidation
+
+If you are migrating your instance of NetBox to a different machine, be sure to first invalidate the cache by performing this command:
+
+```no-highlight
+python3 manage.py invalidate all
+```

docs/api/authentication.md

@@ -1,53 +0,0 @@
-# REST API Authentication
-
-The NetBox API employs token-based authentication. For convenience, cookie authentication can also be used when navigating the browsable API.
-
-## Tokens
-
-A token is a unique identifier that identifies a user to the API. Each user in NetBox may have one or more tokens which he or she can use to authenticate to the API. To create a token, navigate to the API tokens page at `/user/api-tokens/`.
-
-!!! note
-    The creation and modification of API tokens can be restricted per user by an administrator. If you don't see an option to create an API token, ask an administrator to grant you access.
-
-Each token contains a 160-bit key represented as 40 hexadecimal characters. When creating a token, you'll typically leave the key field blank so that a random key will be automatically generated. However, NetBox allows you to specify a key in case you need to restore a previously deleted token to operation.
-
-By default, a token can be used for all operations available via the API. Deselecting the "write enabled" option will restrict API requests made with the token to read operations (e.g. GET) only.
-
-Additionally, a token can be set to expire at a specific time. This can be useful if an external client needs to be granted temporary access to NetBox.
-
-## Authenticating to the API
-
-By default, read operations will be available without authentication. In this case, a token may be included in the request, but is not necessary.
-
-```
-$ curl -H "Accept: application/json; indent=4" http://localhost/api/dcim/sites/
-{
-    "count": 10,
-    "next": null,
-    "previous": null,
-    "results": [...]
-}
-```
-
-However, if the [`LOGIN_REQUIRED`](../../configuration/optional-settings/#login_required) configuration setting has been set to `True`, all requests must be authenticated.
-
-```
-$ curl -H "Accept: application/json; indent=4" http://localhost/api/dcim/sites/
-{
-    "detail": "Authentication credentials were not provided."
-}
-```
-
-To authenticate to the API, set the HTTP `Authorization` header to the string `Token ` (note the trailing space) followed by the token key.
-
-```
-$ curl -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0" -H "Accept: application/json; indent=4" http://localhost/api/dcim/sites/
-{
-    "count": 10,
-    "next": null,
-    "previous": null,
-    "results": [...]
-}
-```
-
-Additionally, the browsable interface to the API (which can be seen by navigating to the API root `/api/` in a web browser) will attempt to authenticate requests using the same cookie that the normal NetBox front end uses. Thus, if you have logged into NetBox, you will be logged into the browsable API as well.

docs/api/examples.md

@@ -1,147 +0,0 @@
-# API Examples
-
-Supported HTTP methods:
-
-* `GET`: Retrieve an object or list of objects
-* `POST`: Create a new object
-* `PUT`: Update an existing object, all mandatory fields must be specified
-* `PATCH`: Updates an existing object, only specifying the field to be changed
-* `DELETE`: Delete an existing object
-
-To authenticate a request, attach your token in an `Authorization` header:
-
-```
-curl -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0"
-```
-
-## Retrieving a list of sites
-
-Send a `GET` request to the object list endpoint. The response contains a paginated list of JSON objects.
-
-```
-$ curl -H "Accept: application/json; indent=4" http://localhost/api/dcim/sites/
-{
-    "count": 14,
-    "next": null,
-    "previous": null,
-    "results": [
-        {
-            "id": 6,
-            "name": "Corporate HQ",
-            "slug": "corporate-hq",
-            "region": null,
-            "tenant": null,
-            "facility": "",
-            "asn": null,
-            "physical_address": "742 Evergreen Terrace, Springfield, USA",
-            "shipping_address": "",
-            "contact_name": "",
-            "contact_phone": "",
-            "contact_email": "",
-            "comments": "",
-            "custom_fields": {},
-            "count_prefixes": 108,
-            "count_vlans": 46,
-            "count_racks": 8,
-            "count_devices": 254,
-            "count_circuits": 6
-        },
-        ...
-    ]
-}
-```
-
-## Retrieving a single site by ID
-
-Send a `GET` request to the object detail endpoint. The response contains a single JSON object.
-
-```
-$ curl -H "Accept: application/json; indent=4" http://localhost/api/dcim/sites/6/
-{
-    "id": 6,
-    "name": "Corporate HQ",
-    "slug": "corporate-hq",
-    "region": null,
-    "tenant": null,
-    "facility": "",
-    "asn": null,
-    "physical_address": "742 Evergreen Terrace, Springfield, USA",
-    "shipping_address": "",
-    "contact_name": "",
-    "contact_phone": "",
-    "contact_email": "",
-    "comments": "",
-    "custom_fields": {},
-    "count_prefixes": 108,
-    "count_vlans": 46,
-    "count_racks": 8,
-    "count_devices": 254,
-    "count_circuits": 6
-}
-```
-
-## Creating a new site
-
-Send a `POST` request to the site list endpoint with token authentication and JSON-formatted data. Only mandatory fields are required. This example includes one non required field, "region."
-
-```
-$ curl -X POST -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0" -H "Content-Type: application/json" -H "Accept: application/json; indent=4" http://localhost:8000/api/dcim/sites/ --data '{"name": "My New Site", "slug": "my-new-site", "region": 5}'
-{
-    "id": 16,
-    "name": "My New Site",
-    "slug": "my-new-site",
-    "region": 5,
-    "tenant": null,
-    "facility": "",
-    "asn": null,
-    "physical_address": "",
-    "shipping_address": "",
-    "contact_name": "",
-    "contact_phone": "",
-    "contact_email": "",
-    "comments": ""
-}
-```
-Note that in this example we are creating a site bound to a region with the ID of 5. For write API actions (`POST`, `PUT`, and `PATCH`) the integer ID value is used for `ForeignKey` (related model) relationships, instead of the nested representation that is used in the `GET` (list) action.
-
-## Modify an existing site
-
-Make an authenticated `PUT` request to the site detail endpoint. As with a create (`POST`) request, all mandatory fields must be included.
-
-```
-$ curl -X PUT -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0" -H "Content-Type: application/json" -H "Accept: application/json; indent=4" http://localhost:8000/api/dcim/sites/16/ --data '{"name": "Renamed Site", "slug": "renamed-site"}'
-```
-
-## Modify an object by changing a field
-
-Make an authenticated `PATCH` request to the device endpoint. With `PATCH`, unlike `POST` and `PUT`, we only specify the field that is being changed. In this example, we add a serial number to a device.
-```
-$ curl -X PATCH -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0" -H "Content-Type: application/json" -H "Accept: application/json; indent=4" http://localhost:8000/api/dcim/devices/2549/ --data '{"serial": "FTX1123A090"}'
-```
-
-## Delete an existing site
-
-Send an authenticated `DELETE` request to the site detail endpoint.
-
-```
-$ curl -v -X DELETE -H "Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0" -H "Content-Type: application/json" -H "Accept: application/json; indent=4" http://localhost:8000/api/dcim/sites/16/
-* Connected to localhost (127.0.0.1) port 8000 (#0)
-> DELETE /api/dcim/sites/16/ HTTP/1.1
-> User-Agent: curl/7.35.0
-> Host: localhost:8000
-> Authorization: Token d2f763479f703d80de0ec15254237bc651f9cdc0
-> Content-Type: application/json
-> Accept: application/json; indent=4
->
-* HTTP 1.0, assume close after body
-< HTTP/1.0 204 No Content
-< Date: Mon, 20 Mar 2017 16:13:08 GMT
-< Server: WSGIServer/0.1 Python/2.7.6
-< Vary: Accept, Cookie
-< X-Frame-Options: SAMEORIGIN
-< Allow: GET, PUT, PATCH, DELETE, OPTIONS
-<
-* Closing connection 0
-```
-
-The response to a successful `DELETE` request will have code 204 (No Content); the body of the response will be empty.

docs/api/filtering.md

@@ -1,71 +0,0 @@
-# API Filtering
-
-The NetBox API supports robust filtering of results based on the fields of each model.
-Generally speaking you are able to filter based on the attributes (fields) present in
-the response body. Please note however that certain read-only or metadata fields are not
-filterable.
-
-Filtering is achieved by passing HTTP query parameters and the parameter name is the
-name of the field you wish to filter on and the value is the field value.
-
-E.g. filtering based on a device's name:
-```
-/api/dcim/devices/?name=DC-SPINE-1
-```
-
-## Multi Value Logic
-
-While you are able to filter based on an arbitrary number of fields, you are also able to
-pass multiple values for the same field. In most cases filtering on multiple values is
-implemented as a logical OR operation. A notible exception is the `tag` filter which
-is a logical AND. Passing multiple values for one field, can be combined with other fields.
-
-For example, filtering for devices with either the name of DC-SPINE-1 _or_ DC-LEAF-4:
-```
-/api/dcim/devices/?name=DC-SPINE-1&name=DC-LEAF-4
-```
-
-Filtering for devices with tag `router` and `customer-a` will return only devices with
-_both_ of those tags applied:
-```
-/api/dcim/devices/?tag=router&tag=customer-a
-```
-
-## Lookup Expressions
-
-Certain model fields also support filtering using additonal lookup expressions. This allows
-for negation and other context specific filtering.
-
-These lookup expressions can be applied by adding a suffix to the desired field's name.
-E.g. `mac_address__n`. In this case, the filter expression is for negation and it is seperated
-by two underscores. Below are the lookup expressions that are supported across different field
-types.
-
-### Numeric Fields
-
-Numeric based fields (ASN, VLAN ID, etc) support these lookup expressions:
-
-- `n` - not equal (negation)
-- `lt` - less than
-- `lte` - less than or equal
-- `gt` - greater than
-- `gte` - greater than or equal
-
-### String Fields
-
-String based (char) fields (Name, Address, etc) support these lookup expressions:
-
-- `n` - not equal (negation)
-- `ic` - case insensitive contains
-- `nic` - negated case insensitive contains
-- `isw` - case insensitive starts with
-- `nisw` - negated case insensitive starts with
-- `iew` - case insensitive ends with
-- `niew` - negated case insensitive ends with
-- `ie` - case sensitive exact match
-- `nie` - negated case sensitive exact match
-
-### Foreign Keys & Other Fields
-
-Certain other fields, namely foreign key relationships support just the negation
-expression: `n`.

docs/api/overview.md

@@ -1,317 +0,0 @@
-# The NetBox REST API
-
-## What is a REST API?
-
-REST stands for [representational state transfer](https://en.wikipedia.org/wiki/Representational_state_transfer). It's a particular type of API which employs HTTP to create, retrieve, update, and delete objects from a database. (This set of operations is commonly referred to as CRUD.) Each type of operation is associated with a particular HTTP verb:
-
-* `GET`: Retrieve an object or list of objects
-* `POST`: Create an object
-* `PUT` / `PATCH`: Modify an existing object. `PUT` requires all mandatory fields to be specified, while `PATCH` only expects the field that is being modified to be specified.
-* `DELETE`: Delete an existing object
-
-The NetBox API represents all objects in [JavaScript Object Notation (JSON)](http://www.json.org/). This makes it very easy to interact with NetBox data on the command line with common tools. For example, we can request an IP address from NetBox and output the JSON using `curl` and `jq`. (Piping the output through `jq` isn't strictly required but makes it much easier to read.)
-
-```
-$ curl -s http://localhost:8000/api/ipam/ip-addresses/2954/ | jq '.'
-{
-  "custom_fields": {},
-  "nat_outside": null,
-  "nat_inside": null,
-  "description": "An example IP address",
-  "id": 2954,
-  "family": 4,
-  "address": "5.101.108.132/26",
-  "vrf": null,
-  "tenant": null,
-  "status": {
-    "label": "Active",
-    "value": 1
-  },
-  "role": null,
-  "interface": null
-}
-```
-
-Each attribute of the NetBox object is expressed as a field in the dictionary. Fields may include their own nested objects, as in the case of the `status` field above. Every object includes a primary key named `id` which uniquely identifies it in the database.
-
-## Interactive Documentation
-
-Comprehensive, interactive documentation of all API endpoints is available on a running NetBox instance at `/api/docs/`. This interface provides a convenient sandbox for researching and experimenting with NetBox's various API endpoints and different request types.
-
-## URL Hierarchy
-
-NetBox's entire API is housed under the API root at `https://<hostname>/api/`. The URL structure is divided at the root level by application: circuits, DCIM, extras, IPAM, secrets, and tenancy. Within each application, each model has its own path. For example, the provider and circuit objects are located under the "circuits" application:
-
-* /api/circuits/providers/
-* /api/circuits/circuits/
-
-Likewise, the site, rack, and device objects are located under the "DCIM" application:
-
-* /api/dcim/sites/
-* /api/dcim/racks/
-* /api/dcim/devices/
-
-The full hierarchy of available endpoints can be viewed by navigating to the API root in a web browser.
-
-Each model generally has two views associated with it: a list view and a detail view. The list view is used to request a list of multiple objects or to create a new object. The detail view is used to retrieve, update, or delete an existing object. All objects are referenced by their numeric primary key (`id`).
-
-* /api/dcim/devices/ - List devices or create a new device
-* /api/dcim/devices/123/ - Retrieve, update, or delete the device with ID 123
-
-Lists of objects can be filtered using a set of query parameters. For example, to find all interfaces belonging to the device with ID 123:
-
-```
-GET /api/dcim/interfaces/?device_id=123
-```
-
-See [filtering](filtering.md) for more details.
-
-## Serialization
-
-The NetBox API employs three types of serializers to represent model data:
-
-* Base serializer
-* Nested serializer
-* Writable serializer
-
-The base serializer is used to represent the default view of a model. This includes all database table fields which comprise the model, and may include additional metadata. A base serializer includes relationships to parent objects, but **does not** include child objects. For example, the `VLANSerializer` includes a nested representation its parent VLANGroup (if any), but does not include any assigned Prefixes.
-
-```
-{
-    "id": 1048,
-    "site": {
-        "id": 7,
-        "url": "http://localhost:8000/api/dcim/sites/7/",
-        "name": "Corporate HQ",
-        "slug": "corporate-hq"
-    },
-    "group": {
-        "id": 4,
-        "url": "http://localhost:8000/api/ipam/vlan-groups/4/",
-        "name": "Production",
-        "slug": "production"
-    },
-    "vid": 101,
-    "name": "Users-Floor1",
-    "tenant": null,
-    "status": {
-        "value": 1,
-        "label": "Active"
-    },
-    "role": {
-        "id": 9,
-        "url": "http://localhost:8000/api/ipam/roles/9/",
-        "name": "User Access",
-        "slug": "user-access"
-    },
-    "description": "",
-    "display_name": "101 (Users-Floor1)",
-    "custom_fields": {}
-}
-```
-
-### Related Objects
-
-Related objects (e.g. `ForeignKey` fields) are represented using a nested serializer. A nested serializer provides a minimal representation of an object, including only its URL and enough information to display the object to a user. When performing write API actions (`POST`, `PUT`, and `PATCH`), related objects may be specified by either numeric ID (primary key), or by a set of attributes sufficiently unique to return the desired object.
-
-For example, when creating a new device, its rack can be specified by NetBox ID (PK):
-
-```
-{
-    "name": "MyNewDevice",
-    "rack": 123,
-    ...
-}
-```
-
-Or by a set of nested attributes used to identify the rack:
-
-```
-{
-    "name": "MyNewDevice",
-    "rack": {
-        "site": {
-            "name": "Equinix DC6"
-        },
-        "name": "R204"
-    },
-    ...
-}
-```
-
-Note that if the provided parameters do not return exactly one object, a validation error is raised.
-
-### Brief Format
-
-Most API endpoints support an optional "brief" format, which returns only a minimal representation of each object in the response. This is useful when you need only a list of the objects themselves without any related data, such as when populating a drop-down list in a form.
-
-For example, the default (complete) format of an IP address looks like this:
-
-```
-GET /api/ipam/prefixes/13980/
-
-{
-    "id": 13980,
-    "family": 4,
-    "prefix": "192.0.2.0/24",
-    "site": null,
-    "vrf": null,
-    "tenant": null,
-    "vlan": null,
-    "status": {
-        "value": 1,
-        "label": "Active"
-    },
-    "role": null,
-    "is_pool": false,
-    "description": "",
-    "tags": [],
-    "custom_fields": {},
-    "created": "2018-12-11",
-    "last_updated": "2018-12-11T16:27:55.073174-05:00"
-}
-```
-
-The brief format is much more terse, but includes a link to the object's full representation:
-
-```
-GET /api/ipam/prefixes/13980/?brief=1
-
-{
-    "id": 13980,
-    "url": "https://netbox/api/ipam/prefixes/13980/",
-    "family": 4,
-    "prefix": "192.0.2.0/24"
-}
-```
-
-The brief format is supported for both lists and individual objects.
-
-### Static Choice Fields
-
-Some model fields, such as the `status` field in the above example, utilize static integers corresponding to static choices. The available choices can be retrieved from the read-only `_choices` endpoint within each app. A specific `model:field` tuple may optionally be specified in the URL.
-
-Each choice includes a human-friendly label and its corresponding numeric value. For example, `GET /api/ipam/_choices/prefix:status/` will return:
-
-```
-[
-    {
-        "value": 0,
-        "label": "Container"
-    },
-    {
-        "value": 1,
-        "label": "Active"
-    },
-    {
-        "value": 2,
-        "label": "Reserved"
-    },
-    {
-        "value": 3,
-        "label": "Deprecated"
-    }
-]
-```
-
-Thus, to set a prefix's status to "Reserved," it would be assigned the integer `2`.
-
-A request for `GET /api/ipam/_choices/` will return choices for _all_ fields belonging to models within the IPAM app.
-
-## Pagination
-
-API responses which contain a list of objects (for example, a request to `/api/dcim/devices/`) will be paginated to avoid unnecessary overhead. The root JSON object will contain the following attributes:
-
-* `count`: The total count of all objects matching the query
-* `next`: A hyperlink to the next page of results (if applicable)
-* `previous`: A hyperlink to the previous page of results (if applicable)
-* `results`: The list of returned objects
-
-Here is an example of a paginated response:
-
-```
-HTTP 200 OK
-Allow: GET, POST, OPTIONS
-Content-Type: application/json
-Vary: Accept
-
-{
-    "count": 2861,
-    "next": "http://localhost:8000/api/dcim/devices/?limit=50&offset=50",
-    "previous": null,
-    "results": [
-        {
-            "id": 123,
-            "name": "DeviceName123",
-            ...
-        },
-        ...
-    ]
-}
-```
-
-The default page size derives from the [`PAGINATE_COUNT`](../../configuration/optional-settings/#paginate_count) configuration setting, which defaults to 50. However, this can be overridden per request by specifying the desired `offset` and `limit` query parameters. For example, if you wish to retrieve a hundred devices at a time, you would make a request for:
-
-```
-http://localhost:8000/api/dcim/devices/?limit=100
-```
-
-The response will return devices 1 through 100. The URL provided in the `next` attribute of the response will return devices 101 through 200:
-
-```
-{
-    "count": 2861,
-    "next": "http://localhost:8000/api/dcim/devices/?limit=100&offset=100",
-    "previous": null,
-    "results": [...]
-}
-```
-
-The maximum number of objects that can be returned is limited by the [`MAX_PAGE_SIZE`](../../configuration/optional-settings/#max_page_size) setting, which is 1000 by default. Setting this to `0` or `None` will remove the maximum limit. An API consumer can then pass `?limit=0` to retrieve _all_ matching objects with a single request.
-
-!!! warning
-    Disabling the page size limit introduces a potential for very resource-intensive requests, since one API request can effectively retrieve an entire table from the database.
-
-## Filtering
-
-A list of objects retrieved via the API can be filtered by passing one or more query parameters. The same parameters used by the web UI work for the API as well. For example, to return only prefixes with a status of "Active" (`1`):
-
-```
-GET /api/ipam/prefixes/?status=1
-```
-
-The choices available for fixed choice fields such as `status` are exposed in the API under a special `_choices` endpoint for each NetBox app. For example, the available choices for `Prefix.status` are listed at `/api/ipam/_choices/` under the key `prefix:status`:
-
-```
-"prefix:status": [
-    {
-        "label": "Container",
-        "value": 0
-    },
-    {
-        "label": "Active",
-        "value": 1
-    },
-    {
-        "label": "Reserved",
-        "value": 2
-    },
-    {
-        "label": "Deprecated",
-        "value": 3
-    }
-],
-```
-
-For most fields, when a filter is passed multiple times, objects matching _any_ of the provided values will be returned. For example, `GET /api/dcim/sites/?name=Foo&name=Bar` will return all sites named "Foo" _or_ "Bar". The exception to this rule is ManyToManyFields which may have multiple values assigned. Tags are the most common example of a ManyToManyField. For example, `GET /api/dcim/sites/?tag=foo&tag=bar` will return only sites tagged with both "foo" _and_ "bar".
-
-### Custom Fields
-
-To filter on a custom field, prepend `cf_` to the field name. For example, the following query will return only sites where a custom field named `foo` is equal to 123:
-
-```
-GET /api/dcim/sites/?cf_foo=123
-```
-
-!!! note
-    Full versus partial matching when filtering is configurable per custom field. Filtering can be toggled (or disabled) for a custom field in the admin UI.

docs/configuration/index.md

@@ -1,6 +1,6 @@
 # NetBox Configuration
 
-NetBox's local configuration is stored in `netbox/netbox/configuration.py`. An example configuration is provided at `netbox/netbox/configuration.example.py`. You may copy or rename the example configuration and make changes as appropriate. NetBox will not run without a configuration file.
+NetBox's local configuration is stored in `$INSTALL_ROOT/netbox/netbox/configuration.py`. An example configuration is provided as `configuration.example.py`. You may copy or rename the example configuration and make changes as appropriate. NetBox will not run without a configuration file.
 
 While NetBox has many configuration settings, only a few of them must be defined at the time of installation.
 
@@ -11,8 +11,8 @@ While NetBox has many configuration settings, only a few of them must be defined
 
 ## Changing the Configuration
 
-Configuration settings may be changed at any time. However, the NetBox service must be restarted before the changes will take effect:
+Configuration settings may be changed at any time. However, the WSGI service (e.g. Gunicorn) must be restarted before the changes will take effect:
 
 ```no-highlight
-# sudo supervisorctl restart netbox
+$ sudo systemctl restart netbox
 ```

docs/configuration/optional-settings.md

@@ -4,7 +4,7 @@
 
 NetBox will email details about critical errors to the administrators listed here. This should be a list of (name, email) tuples. For example:
 
-```
+```python
 ADMINS = [
     ['Hank Hill', 'hhill@example.com'],
     ['Dale Gribble', 'dgribble@example.com'],
@@ -13,13 +13,21 @@ ADMINS = [
 
 ---
 
+## ALLOWED_URL_SCHEMES
+
+Default: `('file', 'ftp', 'ftps', 'http', 'https', 'irc', 'mailto', 'sftp', 'ssh', 'tel', 'telnet', 'tftp', 'vnc', 'xmpp')`
+
+A list of permitted URL schemes referenced when rendering links within NetBox. Note that only the schemes specified in this list will be accepted: If adding your own, be sure to replicate all of the default values as well (excluding those schemes which are not desirable).
+
+---
+
 ## BANNER_TOP
 
 ## BANNER_BOTTOM
 
-Setting these variables will display content in a banner at the top and/or bottom of the page, respectively. HTML is allowed. To replicate the content of the top banner in the bottom banner, set:
+Setting these variables will display custom content in a banner at the top and/or bottom of the page, respectively. HTML is allowed. To replicate the content of the top banner in the bottom banner, set:
 
-```
+```python
 BANNER_TOP = 'Your banner text'
 BANNER_BOTTOM = BANNER_TOP
 ```
@@ -28,7 +36,7 @@ BANNER_BOTTOM = BANNER_TOP
 
 ## BANNER_LOGIN
 
-The value of this variable will be displayed on the login page above the login form. HTML is allowed.
+This defines custom content to be displayed on the login page above the login form. HTML is allowed.
 
 ---
 
@@ -38,7 +46,7 @@ Default: None
 
 The base URL path to use when accessing NetBox. Do not include the scheme or domain name. For example, if installed at http://example.com/netbox/, set:
 
-```
+```python
 BASE_PATH = 'netbox/'
 ```
 
@@ -48,7 +56,7 @@ BASE_PATH = 'netbox/'
 
 Default: 900
 
-The number of seconds to retain cache entries before automatically invalidating them.
+The number of seconds to cache entries will be retained before expiring.
 
 ---
 
@@ -56,7 +64,11 @@ The number of seconds to retain cache entries before automatically invalidating
 
 Default: 90
 
-The number of days to retain logged changes (object creations, updates, and deletions). Set this to `0` to retain changes in the database indefinitely. (Warning: This will greatly increase database size over time.)
+The number of days to retain logged changes (object creations, updates, and deletions). Set this to `0` to retain
+changes in the database indefinitely.
+
+!!! warning
+    If enabling indefinite changelog retention, it is recommended to periodically delete old entries. Otherwise, the database may eventually exceed capacity.
 
 ---
 
@@ -72,9 +84,11 @@ If True, cross-origin resource sharing (CORS) requests will be accepted from all
 
 ## CORS_ORIGIN_REGEX_WHITELIST
 
-These settings specify a list of origins that are authorized to make cross-site API requests. Use `CORS_ORIGIN_WHITELIST` to define a list of exact hostnames, or `CORS_ORIGIN_REGEX_WHITELIST` to define a set of regular expressions. (These settings have no effect if `CORS_ORIGIN_ALLOW_ALL` is True.) For example:
+These settings specify a list of origins that are authorized to make cross-site API requests. Use
+`CORS_ORIGIN_WHITELIST` to define a list of exact hostnames, or `CORS_ORIGIN_REGEX_WHITELIST` to define a set of regular 
+expressions. (These settings have no effect if `CORS_ORIGIN_ALLOW_ALL` is True.) For example:
 
-```
+```python
 CORS_ORIGIN_WHITELIST = [
     'https://example.com',
 ]
@@ -86,7 +100,13 @@ CORS_ORIGIN_WHITELIST = [
 
 Default: False
 
-This setting enables debugging. This should be done only during development or troubleshooting. Never enable debugging on a production system, as it can expose sensitive data to unauthenticated users.
+This setting enables debugging. Debugging should be enabled only during development or troubleshooting. Note that only
+clients which access NetBox from a recognized [internal IP address](#internal_ips) will see debugging tools in the user
+interface.
+
+!!! warning
+    Never enable debugging on a production system, as it can expose sensitive data to unauthenticated users and impose a
+    substantial performance penalty.
 
 ---
 
@@ -100,26 +120,33 @@ This parameter serves as a safeguard to prevent some potentially dangerous behav
 
 ## DOCS_ROOT
 
-Default: `$INSTALL_DIR/docs/`
+Default: `$INSTALL_ROOT/docs/`
 
-The file path to NetBox's documentation. This is used when presenting context-sensitive documentation in the web UI. by default, this will be the `docs/` directory within the root NetBox installation path. (Set this to `None` to disable the embedded documentation.)
+The filesystem path to NetBox's documentation. This is used when presenting context-sensitive documentation in the web UI. By default, this will be the `docs/` directory within the root NetBox installation path. (Set this to `None` to disable the embedded documentation.)
 
 ---
 
 ## EMAIL
 
-In order to send email, NetBox needs an email server configured. The following items can be defined within the `EMAIL` setting:
+In order to send email, NetBox needs an email server configured. The following items can be defined within the `EMAIL` configuration parameter:
 
-* SERVER - Host name or IP address of the email server (use `localhost` if running locally)
-* PORT - TCP port to use for the connection (default: 25)
-* USERNAME - Username with which to authenticate
-* PASSSWORD - Password with which to authenticate
-* TIMEOUT - Amount of time to wait for a connection (seconds)
-* FROM_EMAIL - Sender address for emails sent by NetBox
+* `SERVER` - Hostname or IP address of the email server (use `localhost` if running locally)
+* `PORT` - TCP port to use for the connection (default: `25`)
+* `USERNAME` - Username with which to authenticate
+* `PASSSWORD` - Password with which to authenticate
+* `USE_SSL` - Use SSL when connecting to the server (default: `False`)
+* `USE_TLS` - Use TLS when connecting to the server (default: `False`)
+* `SSL_CERTFILE` - Path to the PEM-formatted SSL certificate file (optional)
+* `SSL_KEYFILE` - Path to the PEM-formatted SSL private key file (optional)
+* `TIMEOUT` - Amount of time to wait for a connection, in seconds (default: `10`)
+* `FROM_EMAIL` - Sender address for emails sent by NetBox
 
-Email is sent from NetBox only for critical events. If you would like to test the email server configuration please use the django function [send_mail()](https://docs.djangoproject.com/en/stable/topics/email/#send-mail):
+!!! note
+    The `USE_SSL` and `USE_TLS` parameters are mutually exclusive.
 
-```
+Email is sent from NetBox only for critical events or if configured for [logging](#logging). If you would like to test the email server configuration, Django provides a convenient [send_mail()](https://docs.djangoproject.com/en/stable/topics/email/#send-mail) fuction accessible within the NetBox shell:
+
+```no-highlight
 # python ./manage.py nbshell
 >>> from django.core.mail import send_mail
 >>> send_mail(
@@ -133,15 +160,23 @@ Email is sent from NetBox only for critical events. If you would like to test th
 
 ---
 
+## ENFORCE_GLOBAL_UNIQUE
+
+Default: False
+
+By default, NetBox will permit users to create duplicate prefixes and IP addresses in the global table (that is, those which are not assigned to any VRF). This behavior can be disabled by setting `ENFORCE_GLOBAL_UNIQUE` to True.
+
+---
+
 ## EXEMPT_VIEW_PERMISSIONS
 
 Default: Empty list
 
-A list of models to exempt from the enforcement of view permissions. Models listed here will be viewable by all users and by anonymous users.
+A list of NetBox models to exempt from the enforcement of view permissions. Models listed here will be viewable by all users, both authenticated and anonymous.
 
 List models in the form `<app>.<model>`. For example:
 
-```
+```python
 EXEMPT_VIEW_PERMISSIONS = [
     'dcim.site',
     'dcim.region',
@@ -151,27 +186,47 @@ EXEMPT_VIEW_PERMISSIONS = [
 
 To exempt _all_ models from view permission enforcement, set the following. (Note that `EXEMPT_VIEW_PERMISSIONS` must be an iterable.)
 
-```
+```python
 EXEMPT_VIEW_PERMISSIONS = ['*']
 ```
 
+!!! note
+    Using a wildcard will not affect certain potentially sensitive models, such as user permissions. If there is a need to exempt these models, they must be specified individually.
+
+---
+
+## HTTP_PROXIES
+
+Default: None
+
+A dictionary of HTTP proxies to use for outbound requests originating from NetBox (e.g. when sending webhook requests). Proxies should be specified by schema (HTTP and HTTPS) as per the [Python requests library documentation](https://2.python-requests.org/en/master/user/advanced/). For example:
+
+```python
+HTTP_PROXIES = {
+    'http': 'http://10.10.1.10:3128',
+    'https': 'http://10.10.1.10:1080',
+}
+```
+
 ---
 
-## ENFORCE_GLOBAL_UNIQUE
+## INTERNAL_IPS
 
-Default: False
+Default: `('127.0.0.1', '::1')`
 
-Enforcement of unique IP space can be toggled on a per-VRF basis. To enforce unique IP space within the global table (all prefixes and IP addresses not assigned to a VRF), set `ENFORCE_GLOBAL_UNIQUE` to True.
+A list of IP addresses recognized as internal to the system, used to control the display of debugging output. For
+example, the debugging toolbar will be viewable only when a client is accessing NetBox from one of the listed IP
+addresses (and [`DEBUG`](#debug) is true).
 
 ---
 
 ## LOGGING
 
-By default, all messages of INFO severity or higher will be logged to the console. Additionally, if `DEBUG` is False and email access has been configured, ERROR and CRITICAL messages will be emailed to the users defined in `ADMINS`.
+By default, all messages of INFO severity or higher will be logged to the console. Additionally, if [`DEBUG`](#debug) is False and email access has been configured, ERROR and CRITICAL messages will be emailed to the users defined in [`ADMINS`](#admins).
 
-The Django framework on which NetBox runs allows for the customization of logging, e.g. to write logs to file. Please consult the [Django logging documentation](https://docs.djangoproject.com/en/stable/topics/logging/) for more information on configuring this setting. Below is an example which will write all INFO and higher messages to a file:
+The Django framework on which NetBox runs allows for the customization of logging format and destination. Please consult the [Django logging documentation](https://docs.djangoproject.com/en/stable/topics/logging/) for more information on configuring this setting. Below is an example which will write all INFO and higher messages to a local file:
 
-```
+```python
 LOGGING = {
     'version': 1,
     'disable_existing_loggers': False,
@@ -191,6 +246,15 @@ LOGGING = {
 }
 ```
 
+### Available Loggers
+
+* `netbox.<app>.<model>` - Generic form for model-specific log messages
+* `netbox.auth.*` - Authentication events
+* `netbox.api.views.*` - Views which handle business logic for the REST API
+* `netbox.reports.*` - Report execution (`module.name`)
+* `netbox.scripts.*` - Custom script execution (`module.name`)
+* `netbox.views.*` - Views which handle business logic for the web UI
+
 ---
 
 ## LOGIN_REQUIRED
@@ -205,7 +269,7 @@ Setting this to True will permit only authenticated users to access any part of
 
 Default: 1209600 seconds (14 days)
 
-The liftetime (in seconds) of the authentication cookie issued to a NetBox user upon login.
+The lifetime (in seconds) of the authentication cookie issued to a NetBox user upon login.
 
 ---
 
@@ -221,13 +285,13 @@ Setting this to True will display a "maintenance mode" banner at the top of ever
 
 Default: 1000
 
-An API consumer can request an arbitrary number of objects by appending the "limit" parameter to the URL (e.g. `?limit=1000`). This setting defines the maximum limit. Setting it to `0` or `None` will allow an API consumer to request all objects by specifying `?limit=0`.
+A web user or API consumer can request an arbitrary number of objects by appending the "limit" parameter to the URL (e.g. `?limit=1000`). This parameter defines the maximum acceptable limit. Setting this to `0` or `None` will allow a client to retrieve _all_ matching objects at once with no limit by specifying `?limit=0`.
 
 ---
 
 ## MEDIA_ROOT
 
-Default: $BASE_DIR/netbox/media/
+Default: $INSTALL_ROOT/netbox/media/
 
 The file path to the location where media files (such as image attachments) are stored. By default, this is the `netbox/media/` directory within the base NetBox installation path.
 
@@ -237,7 +301,7 @@ The file path to the location where media files (such as image attachments) are
 
 Default: False
 
-Toggle exposing Prometheus metrics at `/metrics`. See the [Prometheus Metrics](../../additional-features/prometheus-metrics/) documentation for more details.
+Toggle the availability Prometheus-compatible metrics at `/metrics`. See the [Prometheus Metrics](../../additional-features/prometheus-metrics/) documentation for more details.
 
 ---
 
@@ -247,7 +311,8 @@ Toggle exposing Prometheus metrics at `/metrics`. See the [Prometheus Metrics](.
 
 NetBox will use these credentials when authenticating to remote devices via the [NAPALM library](https://napalm-automation.net/), if installed. Both parameters are optional.
 
-Note: If SSH public key authentication has been set up for the system account under which NetBox runs, these parameters are not needed.
+!!! note
+    If SSH public key authentication has been set up on the remote device(s) for the system account under which NetBox runs, these parameters are not needed.
 
 ---
 
@@ -255,16 +320,16 @@ Note: If SSH public key authentication has been set up for the system account un
 
 A dictionary of optional arguments to pass to NAPALM when instantiating a network driver. See the NAPALM documentation for a [complete list of optional arguments](http://napalm.readthedocs.io/en/latest/support/#optional-arguments). An example:
 
-```
+```python
 NAPALM_ARGS = {
     'api_key': '472071a93b60a1bd1fafb401d9f8ef41',
     'port': 2222,
 }
 ```
 
-Note: Some platforms (e.g. Cisco IOS) require an argument named `secret` to be passed in addition to the normal password. If desired, you can use the configured `NAPALM_PASSWORD` as the value for this argument:
+Some platforms (e.g. Cisco IOS) require an argument named `secret` to be passed in addition to the normal password. If desired, you can use the configured `NAPALM_PASSWORD` as the value for this argument:
 
-```
+```python
 NAPALM_USERNAME = 'username'
 NAPALM_PASSWORD = 'MySecretPassword'
 NAPALM_ARGS = {
@@ -287,7 +352,40 @@ The amount of time (in seconds) to wait for NAPALM to connect to a device.
 
 Default: 50
 
-Determine how many objects to display per page within each list of objects.
+The default maximum number of objects to display per page within each list of objects.
+
+---
+
+## PLUGINS
+
+Default: Empty
+
+A list of installed [NetBox plugins](../../plugins/) to enable. Plugins will not take effect unless they are listed here.
+
+!!! warning
+    Plugins extend NetBox by allowing external code to run with the same access and privileges as NetBox itself. Only install plugins from trusted sources. The NetBox maintainers make absolutely no guarantees about the integrity or security of your installation with plugins enabled.
+
+---
+
+## PLUGINS_CONFIG
+
+Default: Empty
+
+This parameter holds configuration settings for individual NetBox plugins. It is defined as a dictionary, with each key using the name of an installed plugin. The specific parameters supported are unique to each plugin: Reference the plugin's documentation to determine the supported parameters. An example configuration is shown below:
+
+```python
+PLUGINS_CONFIG = {
+    'plugin1': {
+        'foo': 123,
+        'bar': True
+    },
+    'plugin2': {
+        'foo': 456,
+    },
+}
+```
+
+Note that a plugin must be listed in `PLUGINS` for its configuration to take effect.
 
 ---
 
@@ -299,17 +397,111 @@ When determining the primary IP address for a device, IPv6 is preferred over IPv
 
 ---
 
+## RACK_ELEVATION_DEFAULT_UNIT_HEIGHT
+
+Default: 22
+
+Default height (in pixels) of a unit within a rack elevation. For best results, this should be approximately one tenth of `RACK_ELEVATION_DEFAULT_UNIT_WIDTH`.
+
+---
+
+## RACK_ELEVATION_DEFAULT_UNIT_WIDTH
+
+Default: 220
+
+Default width (in pixels) of a unit within a rack elevation.
+
+---
+
+## REMOTE_AUTH_AUTO_CREATE_USER
+
+Default: `False`
+
+If true, NetBox will automatically create local accounts for users authenticated via a remote service. (Requires `REMOTE_AUTH_ENABLED`.)
+
+---
+
+## REMOTE_AUTH_BACKEND
+
+Default: `'netbox.authentication.RemoteUserBackend'`
+
+This is the Python path to the custom [Django authentication backend](https://docs.djangoproject.com/en/stable/topics/auth/customizing/) to use for external user authentication. NetBox provides two built-in backends (listed below), though custom authentication backends may also be provided by other packages or plugins.
+
+* `netbox.authentication.RemoteUserBackend`
+* `netbox.authentication.LDAPBackend`
+
+---
+
+## REMOTE_AUTH_DEFAULT_GROUPS
+
+Default: `[]` (Empty list)
+
+The list of groups to assign a new user account when created using remote authentication. (Requires `REMOTE_AUTH_ENABLED`.)
+
+---
+
+## REMOTE_AUTH_DEFAULT_PERMISSIONS
+
+Default: `{}` (Empty dictionary)
+
+A mapping of permissions to assign a new user account when created using remote authentication. Each key in the dictionary should be set to a dictionary of the attributes to be applied to the permission, or `None` to allow all objects. (Requires `REMOTE_AUTH_ENABLED`.)
+
+---
+
+## REMOTE_AUTH_ENABLED
+
+Default: `False`
+
+NetBox can be configured to support remote user authentication by inferring user authentication from an HTTP header set by the HTTP reverse proxy (e.g. nginx or Apache). Set this to `True` to enable this functionality. (Local authentication will still take effect as a fallback.)
+
+---
+
+## REMOTE_AUTH_HEADER
+
+Default: `'HTTP_REMOTE_USER'`
+
+When remote user authentication is in use, this is the name of the HTTP header which informs NetBox of the currently authenticated user. (Requires `REMOTE_AUTH_ENABLED`.)
+
+---
+
+## RELEASE_CHECK_TIMEOUT
+
+Default: 86,400 (24 hours)
+
+The number of seconds to retain the latest version that is fetched from the GitHub API before automatically invalidating it and fetching it from the API again. This must be set to at least one hour (3600 seconds).
+
+---
+
+## RELEASE_CHECK_URL
+
+Default: None (disabled)
+
+This parameter defines the URL of the repository that will be checked periodically for new NetBox releases. When a new release is detected, a message will be displayed to administrative users on the home page. This can be set to the official repository (`'https://api.github.com/repos/netbox-community/netbox/releases'`) or a custom fork. Set this to `None` to disable automatic update checks.
+
+!!! note
+    The URL provided **must** be compatible with the [GitHub REST API](https://docs.github.com/en/rest).
+
+---
+
 ## REPORTS_ROOT
 
-Default: $BASE_DIR/netbox/reports/
+Default: `$INSTALL_ROOT/netbox/reports/`
 
 The file path to the location where custom reports will be kept. By default, this is the `netbox/reports/` directory within the base NetBox installation path.
 
 ---
 
+## RQ_DEFAULT_TIMEOUT
+
+Default: `300`
+
+The maximum execution time of a background task (such as running a custom script), in seconds.
+
+---
+
 ## SCRIPTS_ROOT
 
-Default: $BASE_DIR/netbox/scripts/
+Default: `$INSTALL_ROOT/netbox/scripts/`
 
 The file path to the location where custom scripts will be kept. By default, this is the `netbox/scripts/` directory within the base NetBox installation path.
 
@@ -319,7 +511,7 @@ The file path to the location where custom scripts will be kept. By default, thi
 
 Default: None
 
-Session data is used to track authenticated users when they access NetBox. By default, NetBox stores session data in the PostgreSQL database. However, this inhibits authentication to a standby instance of NetBox without write access to the database. Alternatively, a local file path may be specified here and NetBox will store session data as files instead of using the database. Note that the user as which NetBox runs must have read and write permissions to this path.
+HTTP session data is used to track authenticated users when they access NetBox. By default, NetBox stores session data in its PostgreSQL database. However, this inhibits authentication to a standby instance of NetBox without write access to the database. Alternatively, a local file path may be specified here and NetBox will store session data as files instead of using the database. Note that the NetBox system user must have read and write permissions to this path.
 
 ---
 
@@ -347,21 +539,19 @@ If `STORAGE_BACKEND` is not defined, this setting will be ignored.
 
 Default: UTC
 
-The time zone NetBox will use when dealing with dates and times. It is recommended to use UTC time unless you have a specific need to use a local time zone. [List of available time zones](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
+The time zone NetBox will use when dealing with dates and times. It is recommended to use UTC time unless you have a specific need to use a local time zone. Please see the [list of available time zones](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
 
 ---
 
 ## Date and Time Formatting
 
-You may define custom formatting for date and times. For detailed instructions on writing format strings, please see [the Django documentation](https://docs.djangoproject.com/en/stable/ref/templates/builtins/#date).
+You may define custom formatting for date and times. For detailed instructions on writing format strings, please see [the Django documentation](https://docs.djangoproject.com/en/stable/ref/templates/builtins/#date). Default formats are listed below.
 
-Defaults:
-
-```
+```python
 DATE_FORMAT = 'N j, Y'               # June 26, 2016
-SHORT_DATE_FORMAT = 'Y-m-d'          # 2016-06-27
+SHORT_DATE_FORMAT = 'Y-m-d'          # 2016-06-26
 TIME_FORMAT = 'g:i a'                # 1:23 p.m.
 SHORT_TIME_FORMAT = 'H:i:s'          # 13:23:00
 DATETIME_FORMAT = 'N j, Y g:i a'     # June 26, 2016 1:23 p.m.
-SHORT_DATETIME_FORMAT = 'Y-m-d H:i'  # 2016-06-27 13:23
+SHORT_DATETIME_FORMAT = 'Y-m-d H:i'  # 2016-06-26 13:23
 ```

docs/configuration/required-settings.md

@@ -2,7 +2,12 @@
 
 ## ALLOWED_HOSTS
 
-This is a list of valid fully-qualified domain names (FQDNs) that is used to reach the NetBox service. Usually this is the same as the hostname for the NetBox server, but can also be different (e.g. when using a reverse proxy serving the NetBox website under a different FQDN than the hostname of the NetBox server). NetBox will not permit access to the server via any other hostnames (or IPs). The value of this option is also used to set `CSRF_TRUSTED_ORIGINS`, which restricts `HTTP POST` to the same set of hosts (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-CSRF_TRUSTED_ORIGINS)). Keep in mind that NetBox, by default, has `USE_X_FORWARDED_HOST = True` (in `netbox/netbox/settings.py`) which means that if you're using a reverse proxy, it's the FQDN used to reach that reverse proxy which needs to be in this list (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#allowed-hosts)).
+This is a list of valid fully-qualified domain names (FQDNs) and/or IP addresses that can be used to reach the NetBox service. Usually this is the same as the hostname for the NetBox server, but can also be different; for example, when using a reverse proxy serving the NetBox website under a different FQDN than the hostname of the NetBox server. To help guard against [HTTP Host header attackes](https://docs.djangoproject.com/en/3.0/topics/security/#host-headers-virtual-hosting), NetBox will not permit access to the server via any other hostnames (or IPs).
+
+!!! note
+    This parameter must always be defined as a list or tuple, even if only value is provided.
+
+The value of this option is also used to set `CSRF_TRUSTED_ORIGINS`, which restricts POST requests to the same set of hosts (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-CSRF_TRUSTED_ORIGINS)). Keep in mind that NetBox, by default, sets `USE_X_FORWARDED_HOST` to true, which means that if you're using a reverse proxy, it's the FQDN used to reach that reverse proxy which needs to be in this list (more about this [here](https://docs.djangoproject.com/en/stable/ref/settings/#allowed-hosts)).
 
 Example:
 
@@ -10,18 +15,24 @@ Example:
 ALLOWED_HOSTS = ['netbox.example.com', '192.0.2.123']
 ```
 
+If you are not yet sure what the domain name and/or IP address of the NetBox installation will be, and are comfortable accepting the risks in doing so, you can set this to a wildcard (asterisk) to allow all host values:
+
+```
+ALLOWED_HOSTS = ['*']
+```
+
 ---
 
 ## DATABASE
 
-NetBox requires access to a PostgreSQL database service to store data. This service can run locally or on a remote system. The following parameters must be defined within the `DATABASE` dictionary:
+NetBox requires access to a PostgreSQL 9.6 or later database service to store data. This service can run locally on the NetBox server or on a remote system. The following parameters must be defined within the `DATABASE` dictionary:
 
 * `NAME` - Database name
 * `USER` - PostgreSQL username
 * `PASSWORD` - PostgreSQL password
 * `HOST` - Name or IP address of the database server (use `localhost` if running locally)
-* `PORT` - TCP port of the PostgreSQL service; leave blank for default port (5432)
-* `CONN_MAX_AGE` - Lifetime of a [persistent database connection](https://docs.djangoproject.com/en/stable/ref/databases/#persistent-connections), in seconds (150-300 is recommended)
+* `PORT` - TCP port of the PostgreSQL service; leave blank for default port (TCP/5432)
+* `CONN_MAX_AGE` - Lifetime of a [persistent database connection](https://docs.djangoproject.com/en/stable/ref/databases/#persistent-connections), in seconds (300 is the default)
 
 Example:
 
@@ -46,27 +57,25 @@ DATABASE = {
 [Redis](https://redis.io/) is an in-memory data store similar to memcached. While Redis has been an optional component of
 NetBox since the introduction of webhooks in version 2.4, it is required starting in 2.6 to support NetBox's caching
 functionality (as well as other planned features). In 2.7, the connection settings were broken down into two sections for
-webhooks and caching, allowing the user to connect to different Redis instances/databases per feature.
+task queuing and caching, allowing the user to connect to different Redis instances/databases per feature.
 
-Redis is configured using a configuration setting similar to `DATABASE` and these settings are the same for both of the `webhooks` and `caching` subsections:
+Redis is configured using a configuration setting similar to `DATABASE` and these settings are the same for both of the `tasks` and `caching` subsections:
 
 * `HOST` - Name or IP address of the Redis server (use `localhost` if running locally)
 * `PORT` - TCP port of the Redis service; leave blank for default port (6379)
 * `PASSWORD` - Redis password (if set)
 * `DATABASE` - Numeric database ID
-* `DEFAULT_TIMEOUT` - Connection timeout in seconds
 * `SSL` - Use SSL connection to Redis
 
-Example:
+An example configuration is provided below:
 
 ```python
 REDIS = {
-    'webhooks': {
+    'tasks': {
         'HOST': 'redis.example.com',
         'PORT': 1234,
         'PASSWORD': 'foobar',
         'DATABASE': 0,
-        'DEFAULT_TIMEOUT': 300,
         'SSL': False,
     },
     'caching': {
@@ -74,19 +83,19 @@ REDIS = {
         'PORT': 6379,
         'PASSWORD': '',
         'DATABASE': 1,
-        'DEFAULT_TIMEOUT': 300,
         'SSL': False,
     }
 }
 ```
 
 !!! note
-    If you are upgrading from a version prior to v2.7, please note that the Redis connection configuration settings have
-    changed. Manual modification to bring the `REDIS` section inline with the above specification is necessary
+    If you are upgrading from a NetBox release older than v2.7.0, please note that the Redis connection configuration
+    settings have changed. Manual modification to bring the `REDIS` section inline with the above specification is
+    necessary
 
-!!! note
-    It is highly recommended to keep the webhook and cache databases separate. Using the same database number on the
-    same Redis instance for both may result in webhook processing data being lost during cache flushing events.
+!!! warning
+    It is highly recommended to keep the task and cache databases separate. Using the same database number on the
+    same Redis instance for both may result in queued background tasks being lost during cache flushing events.
 
 ### Using Redis Sentinel
 
@@ -97,17 +106,18 @@ above and the addition of two new keys.
 * `SENTINELS`: List of tuples or tuple of tuples with each inner tuple containing the name or IP address 
 of the Redis server and port for each sentinel instance to connect to
 * `SENTINEL_SERVICE`: Name of the master / service to connect to
+* `SENTINEL_TIMEOUT`: Connection timeout, in seconds
 
 Example:
 
 ```python
 REDIS = {
-    'webhooks': {
+    'tasks': {
         'SENTINELS': [('mysentinel.redis.example.com', 6379)],
         'SENTINEL_SERVICE': 'netbox',
+        'SENTINEL_TIMEOUT': 10,
         'PASSWORD': '',
         'DATABASE': 0,
-        'DEFAULT_TIMEOUT': 300,
         'SSL': False,
     },
     'caching': {
@@ -118,24 +128,20 @@ REDIS = {
         'SENTINEL_SERVICE': 'netbox',
         'PASSWORD': '',
         'DATABASE': 1,
-        'DEFAULT_TIMEOUT': 300,
         'SSL': False,
     }
 }
 ```
 
 !!! note
-    It is possible to have only one or the other Redis configurations to use Sentinel functionality. It is possible
-    for example to have the webhook use sentinel via `HOST`/`PORT` and for caching to use Sentinel via 
-    `SENTINELS`/`SENTINEL_SERVICE`.
-
+    It is permissible to use Sentinel for only one database and not the other.
 
 ---
 
 ## SECRET_KEY
 
-This is a secret cryptographic key is used to improve the security of cookies and password resets. The key defined here should not be shared outside of the configuration file. `SECRET_KEY` can be changed at any time, however be aware that doing so will invalidate all existing sessions.
+This is a secret, random string used to assist in the creation new cryptographic hashes for passwords and HTTP cookies. The key defined here should not be shared outside of the configuration file. `SECRET_KEY` can be changed at any time, however be aware that doing so will invalidate all existing sessions.
 
-Please note that this key is **not** used for hashing user passwords or for the encrypted storage of secret data in NetBox.
+Please note that this key is **not** used directly for hashing user passwords or for the encrypted storage of secret data in NetBox.
 
-`SECRET_KEY` should be at least 50 characters in length and contain a random mix of letters, digits, and symbols. The script located at `netbox/generate_secret_key.py` may be used to generate a suitable key.
+`SECRET_KEY` should be at least 50 characters in length and contain a random mix of letters, digits, and symbols. The script located at `$INSTALL_ROOT/netbox/generate_secret_key.py` may be used to generate a suitable key.

docs/core-functionality/ipam.md

@@ -6,6 +6,7 @@
 ---
 
 {!docs/models/ipam/prefix.md!}
+{!docs/models/ipam/role.md!}
 
 ---
 

docs/core-functionality/power.md

@@ -5,34 +5,4 @@
 
 # Example Power Topology
 
-Below is a simple diagram demonstrating how power is modeled in NetBox.
-
-!!! note
-    The power feeds are connected to the same power panel for illustrative purposes; usually, you would have such feeds diversely connected to panels to avoid the single point of failure.
-
-```
-          +---------------+
-          | Power panel 1 |
-          +---------------+
-            |           |
-            |           |
-+--------------+     +--------------+
-| Power feed 1 |     | Power feed 2 |
-+--------------+     +--------------+
-       |                     |
-       |                     |
-       |                     |    <-- Power ports
-     +---------+     +---------+
-     |  PDU 1  |     |  PDU 2  |
-     +---------+     +---------+
-       |       \     /       |    <-- Power outlets
-       |        \   /        |
-       |         \ /         |
-       |          X          |
-       |         / \         |
-       |        /   \        |
-       |       /     \       |    <-- Power ports
-      +--------+     +--------+
-      | Server |     | Router |
-      +--------+     +--------+
-```
+![Power distribution model](../../media/power_distribution.png)

docs/core-functionality/virtualization.md

@@ -1,4 +1,4 @@
-# Virtual Machines and Clusters
+# Virtualization
 
 {!docs/models/virtualization/cluster.md!}
 {!docs/models/virtualization/clustertype.md!}
@@ -7,3 +7,4 @@
 ---
 
 {!docs/models/virtualization/virtualmachine.md!}
+{!docs/models/virtualization/vminterface.md!}

docs/development/application-registry.md

@@ -0,0 +1,55 @@
+# Application Registry
+
+The registry is an in-memory data structure which houses various miscellaneous application-wide parameters, such as installed plugins. It is not exposed to the user and is not intended to be modified by any code outside of NetBox core.
+
+The registry behaves essentially like a Python dictionary, with the notable exception that once a store (key) has been declared, it cannot be deleted or overwritten. The value of a store can, however, me modified; e.g. by appending a value to a list. Store values generally do not change once the application has been initialized.
+
+## Stores
+
+### `model_features`
+
+A dictionary of particular features (e.g. custom fields) mapped to the NetBox models which support them, arranged by app. For example:
+
+```python
+{
+    'custom_fields': {
+        'circuits': ['provider', 'circuit'],
+        'dcim': ['site', 'rack', 'devicetype', ...],
+        ...
+    },
+    'webhooks': {
+        ...
+    },
+    ...
+}
+```
+
+### `plugin_menu_items`
+
+Navigation menu items provided by NetBox plugins. Each plugin is registered as a key with the list of menu items it provides. An example:
+
+```python
+{
+    'Plugin A': (
+        <MenuItem>, <MenuItem>, <MenuItem>,
+    ),
+    'Plugin B': (
+        <MenuItem>, <MenuItem>, <MenuItem>,
+    ),
+}
+```
+
+### `plugin_template_extensions`
+
+Plugin content that gets embedded into core NetBox templates. The store comprises NetBox models registered as dictionary keys, each pointing to a list of applicable template extension classes that exist. An example:
+
+```python
+{
+    'dcim.site': [
+        <TemplateExtension>, <TemplateExtension>, <TemplateExtension>,
+    ],
+    'dcim.rack': [
+        <TemplateExtension>, <TemplateExtension>,
+    ],
+}
+```

docs/development/extending-models.md

@@ -44,11 +44,7 @@ If you're adding a relational field (e.g. `ForeignKey`) and intend to include th
 
 Extend the model's API serializer in `<app>.api.serializers` to include the new field. In most cases, it will not be necessary to also extend the nested serializer, which produces a minimal represenation of the model.
 
-## 6. Add choices to API view
-
-If the new field has static choices, add it to the `FieldChoicesViewSet` for the app.
-
-## 7. Add field to forms
+## 6. Add field to forms
 
 Extend any forms to include the new field as appropriate. Common forms include:
 
@@ -57,19 +53,19 @@ Extend any forms to include the new field as appropriate. Common forms include:
 * **CSV import** - The form used when bulk importing objects in CSV format
 * **Filter** - Displays the options available for filtering a list of objects (both UI and API)
 
-## 8. Extend object filter set
+## 7. Extend object filter set
 
 If the new field should be filterable, add it to the `FilterSet` for the model. If the field should be searchable, remember to reference it in the FilterSet's `search()` method.
 
-## 9. Add column to object table
+## 8. Add column to object table
 
 If the new field will be included in the object list view, add a column to the model's table. For simple fields, adding the field name to `Meta.fields` will be sufficient. More complex fields may require explicitly declaring a new column.
 
-## 10. Update the UI templates
+## 9. Update the UI templates
 
 Edit the object's view template to display the new field. There may also be a custom add/edit form template that needs to be updated.
 
-## 11. Create/extend test cases
+## 10. Create/extend test cases
 
 Create or extend the relevant test cases to verify that the new field and any accompanying validation logic perform as expected. This is especially important for relational fields. NetBox incorporates various test suites, including:
 

docs/development/release-checklist.md

@@ -35,17 +35,20 @@ Update the following static libraries to their most recent stable release:
 * jQuery
 * jQuery UI
 
-### Squash Schema Migrations
-
-Database schema migrations should be squashed for each new minor release. See the [squashing guide](squashing-migrations.md) for the detailed process.
-
 ### Create a new Release Notes Page
 
-Create a file at `/docs/release-notes/X.Y.md` to establish the release notes for the new release. Add the file to the table of contents within `mkdocs.yml`.
+Create a file at `/docs/release-notes/X.Y.md` to establish the release notes for the new release. Add the file to the table of contents within `mkdocs.yml`, and point `index.md` to the new file.
 
 ### Manually Perform a New Install
 
-Create a new installation of NetBox by following [the current documentation](http://netbox.readthedocs.io/en/latest/). This should be a manual process, so that issues with the documentation can be identified and corrected.
+Install `mkdocs` in your local environment, then start the documentation server:
+
+```no-highlight
+$ pip install -r docs/requirements.txt
+$ mkdocs serve
+```
+
+Follow these instructions to perform a new installation of NetBox. This process must _not_ be automated: The goal of this step is to catch any errors or omissions in the documentation, and ensure that it is kept up-to-date for each release. Make any necessary changes to the documentation before proceeding with the release.
 
 ### Close the Release Milestone
 

docs/development/squashing-migrations.md

@@ -1,168 +0,0 @@
-# Squashing Database Schema Migrations
-
-## What are Squashed Migrations?
-
-The Django framework on which NetBox is built utilizes [migration files](https://docs.djangoproject.com/en/stable/topics/migrations/) to keep track of changes to the PostgreSQL database schema. Each time a model is altered, the resulting schema change is captured in a migration file, which can then be applied to effect the new schema.
-
-As changes are made over time, more and more migration files are created. Although not necessarily problematic, it can be beneficial to merge and compress these files occasionally to reduce the total number of migrations that need to be applied upon installation of NetBox. This merging process is called _squashing_ in Django vernacular, and results in two parallel migration paths: individual and squashed.
-
-Below is an example showing both individual and squashed migration files within an app:
-
-| Individual | Squashed |
-|------------|----------|
-| 0001_initial       | 0001_initial_squashed_0004_add_field |
-| 0002_alter_field   |                   .                  |
-| 0003_remove_field  |                   .                  |
-| 0004_add_field     |                   .                  |
-| 0005_another_field | 0005_another_field                   |
-
-In the example above, a new installation can leverage the squashed migrations to apply only two migrations:
-
-* `0001_initial_squashed_0004_add_field`
-* `0005_another_field`
-
-This is because the squash file contains all of the operations performed by files `0001` through `0004`.
-
-However, an existing installation that has already applied some of the individual migrations contained within the squash file must continue applying individual migrations. For instance, an installation which currently has up to `0002_alter_field` applied must apply the following migrations to become current:
-
-* `0003_remove_field`
-* `0004_add_field`
-* `0005_another_field`
-
-Squashed migrations are opportunistic: They are used only if applicable to the current environment. Django will fall back to using individual migrations if the squashed migrations do not agree with the current database schema at any point.
-
-## Squashing Migrations
-
-During every minor (i.e. 2.x) release, migrations should be squashed to help simplify the migration process for new installations. The process below describes how to squash migrations efficiently and with minimal room for error.
-
-### 1. Create a New Branch
-
-Create a new branch off of the `develop-2.x` branch. (Migrations should be squashed _only_ in preparation for a new minor release.)
-
-```
-git checkout -B squash-migrations
-```
-
-### 2. Delete Existing Squash Files
-
-Delete the most recent squash file within each NetBox app. This allows us to extend squash files where the opportunity exists. For example, we might be able to replace `0005_to_0008` with `0005_to_0011`.
-
-### 3. Generate the Current Migration Plan
-
-Use Django's `showmigrations` utility to display the order in which all migrations would be applied for a new installation.
-
-```
-manage.py showmigrations --plan
-```
-
-From the resulting output, delete all lines which reference an external migration. Any migrations imposed by Django itself on an external package are not relevant.
-
-### 4. Create Squash Files
-
-Begin iterating through the migration plan, looking for successive sets of migrations within an app. These are candidates for squashing. For example:
-
-```
-[X]  extras.0014_configcontexts
-[X]  extras.0015_remove_useraction
-[X]  extras.0016_exporttemplate_add_cable
-[X]  extras.0017_exporttemplate_mime_type_length
-[ ]  extras.0018_exporttemplate_add_jinja2
-[ ]  extras.0019_tag_taggeditem
-[X]  dcim.0062_interface_mtu
-[X]  dcim.0063_device_local_context_data
-[X]  dcim.0064_remove_platform_rpc_client
-[ ]  dcim.0065_front_rear_ports
-[X]  circuits.0001_initial_squashed_0010_circuit_status
-[ ]  dcim.0066_cables
-...
-```
-
-Migrations `0014` through `0019` in `extras` can be squashed, as can migrations `0062` through `0065` in `dcim`. Migration `0066` cannot be included in the same squash file, because the `circuits` migration must be applied before it. (Note that whether or not each migration is currently applied to the database does not matter.)
-
-Squash files are created using Django's `squashmigrations` utility:
-
-```
-manage.py squashmigrations <app> <start> <end>
-```
-
-For example, our first step in the example would be to run `manage.py squashmigrations extras 0014 0019`.
-
-!!! note
-    Specifying a migration file's numeric index is enough to uniquely identify it within an app. There is no need to specify the full filename.
-
-This will create a new squash file within the app's `migrations` directory, named as a concatenation of its beginning and ending migration. Some manual editing is necessary for each new squash file for housekeeping purposes:
-
-* Remove the "automatically generated" comment at top (to indicate that a human has reviewed the file).
-* Reorder `import` statements as necessary per PEP8.
-* It may be necessary to copy over custom functions from the original migration files (this will be indicated by a comment near the top of the squash file). It is safe to remove any functions that exist solely to accomodate reverse migrations (which we no longer support).
-
-Repeat this process for each candidate set of migrations until you reach the end of the migration plan.
-
-### 5. Check for Missing Migrations
-
-If everything went well, at this point we should have a completed squashed path. Perform a dry run to check for any missing migrations:
-
-```
-manage.py migrate --dry-run
-```
-
-### 5. Run Migrations
-
-Next, we'll apply the entire migration path to an empty database. Begin by dropping and creating your development database.
-
-!!! warning
-    Obviously, first back up any data you don't want to lose.
-
-```
-sudo -u postgres psql -c 'drop database netbox'
-sudo -u postgres psql -c 'create database netbox'
-```
-
-Apply the migrations with the `migrate` management command. It is not necessary to specify a particular migration path; Django will detect and use the squashed migrations automatically. You can verify the exact migrations being applied by enabling verboes output with `-v 2`.
-
-```
-manage.py migrate -v 2
-```
-
-### 6. Commit the New Migrations
-
-If everything is successful to this point, commit your changes to the `squash-migrations` branch.
-
-### 7. Validate Resulting Schema
-
-To ensure our new squashed migrations do not result in a deviation from the original schema, we'll compare the two. With the new migration file safely commit, check out the `develop-2.x` branch, which still contains only the individual migrations.
-
-```
-git checkout develop-2.x
-```
-
-Temporarily install the [django-extensions](https://django-extensions.readthedocs.io/) package, which provides the `sqldiff utility`:
-
-```
-pip install django-extensions
-```
-
-Also add `django_extensions` to `INSTALLED_APPS` in `netbox/netbox/settings.py`.
-
-At this point, our database schema has been defined by using the squashed migrations. We can run `sqldiff` to see if it differs any from what the current (non-squashed) migrations would generate. `sqldiff` accepts a list of apps against which to run:
-
-```
-manage.py sqldiff circuits dcim extras ipam secrets tenancy users virtualization
-```
-
-It is safe to ignore errors indicating an "unknown database type" for the following fields:
-
-* `dcim_interface.mac_address`
-* `ipam_aggregate.prefix`
-* `ipam_prefix.prefix`
-
-It is also safe to ignore the message "Table missing: extras_script".
-
-Resolve any differences by correcting migration files in the `squash-migrations` branch.
-
-!!! warning
-    Don't forget to remove `django_extension` from `INSTALLED_APPS` before committing your changes.
-
-### 8. Merge the Squashed Migrations
-
-Once all squashed migrations have been validated and all tests run successfully, merge the `squash-migrations` branch into `develop-2.x`. This completes the squashing process.

docs/development/user-preferences.md

@@ -0,0 +1,11 @@
+# User Preferences
+
+The `users.UserConfig` model holds individual preferences for each user in the form of JSON data. This page serves as a manifest of all recognized user preferences in NetBox.
+
+## Available Preferences
+
+| Name | Description |
+| ---- | ----------- |
+| extras.configcontext.format | Preferred format when rendering config context data (JSON or YAML) |
+| pagination.per_page | The number of items to display per page of a paginated table |
+| tables.${table_name}.columns | The ordered list of columns to display when viewing the table |

docs/development/utility-views.md

@@ -4,6 +4,10 @@ Utility views are reusable views that handle common CRUD tasks, such as listing
 
 ## Individual Views
 
+### ObjectView
+
+Retrieve and display a single object.
+
 ### ObjectListView
 
 Generates a paginated table of objects from a given queryset, which may optionally be filtered.

docs/extra.css

@@ -0,0 +1,19 @@
+/* Images */
+img {
+    display: block;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+/* Tables */
+table {
+    margin-bottom: 24px;
+    width: 100%;
+}
+th {
+    background-color: #f0f0f0;
+    padding: 6px;
+}
+td {
+    padding: 6px;
+}

docs/index.md

@@ -49,13 +49,13 @@ NetBox is built on the [Django](https://djangoproject.com/) Python framework and
 | HTTP service       | nginx or Apache   |
 | WSGI service       | gunicorn or uWSGI |
 | Application        | Django/Python     |
-| Database           | PostgreSQL 9.4+   |
+| Database           | PostgreSQL 9.6+   |
 | Task queuing       | Redis/django-rq   |
 | Live device access | NAPALM            |
 
 ## Supported Python Versions
 
-NetBox supports Python 3.5, 3.6, and 3.7 environments currently. Python 3.5 is scheduled to be unsupported in NetBox v2.8.
+NetBox supports Python 3.6 and 3.7 environments currently. (Support for Python 3.5 was removed in NetBox v2.8.)
 
 ## Getting Started
 

docs/installation/1-postgresql.md

@@ -3,7 +3,7 @@
 This section entails the installation and configuration of a local PostgreSQL database. If you already have a PostgreSQL database service in place, skip to [the next section](2-redis.md).
 
 !!! warning
-    NetBox requires PostgreSQL 9.4 or higher. Please note that MySQL and other relational databases are **not** supported.
+    NetBox requires PostgreSQL 9.6 or higher. Please note that MySQL and other relational databases are **not** currently supported.
 
 The installation instructions provided here have been tested to work on Ubuntu 18.04 and CentOS 7.5. The particular commands needed to install dependencies on other distributions may vary significantly. Unfortunately, this is outside the control of the NetBox maintainers. Please consult your distribution's documentation for assistance with any errors.
 
@@ -20,10 +20,10 @@ If a recent enough version of PostgreSQL is not available through your distribut
 
 #### CentOS
 
-CentOS 7.5 does not ship with a recent enough version of PostgreSQL, so it will need to be installed from an external repository. The instructions below show the installation of PostgreSQL 9.6.
+CentOS 7 does not ship with a recent enough version of PostgreSQL, so it will need to be installed from an external repository. The instructions below show the installation of PostgreSQL 9.6, however you may opt to install a more recent version.
 
 ```no-highlight
-# yum install -y https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm
+# yum install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-7-x86_64/pgdg-redhat-repo-latest.noarch.rpm
 # yum install -y postgresql96 postgresql96-server postgresql96-devel
 # /usr/pgsql-9.6/bin/postgresql96-setup initdb
 ```
@@ -47,11 +47,11 @@ Then, start the service and enable it to run at boot:
 At a minimum, we need to create a database for NetBox and assign it a username and password for authentication. This is done with the following commands.
 
 !!! danger
-    DO NOT USE THE PASSWORD FROM THE EXAMPLE.
+    **Do not use the password from the example.** Choose a strong, random password to ensure secure database authentication for your NetBox installation.
 
 ```no-highlight
 # sudo -u postgres psql
-psql (9.4.5)
+psql (10.12 (Ubuntu 10.12-0ubuntu0.18.04.1))
 Type "help" for help.
 
 postgres=# CREATE DATABASE netbox;
@@ -68,7 +68,13 @@ postgres=# \q
 You can verify that authentication works issuing the following command and providing the configured password. (Replace `localhost` with your database server if using a remote database.)
 
 ```no-highlight
-# psql -U netbox -W -h localhost netbox
+# psql --username netbox --password --host localhost netbox
+Password for user netbox: 
+psql (10.12 (Ubuntu 10.12-0ubuntu0.18.04.1))
+SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
+Type "help" for help.
+
+netbox=> \q
 ```
 
 If successful, you will enter a `netbox` prompt. Type `\q` to exit.

docs/installation/2-redis.md

@@ -4,6 +4,9 @@
 
 [Redis](https://redis.io/) is an in-memory key-value store which NetBox employs for caching and queuing. This section entails the installation and configuration of a local Redis instance. If you already have a Redis service in place, skip to [the next section](3-netbox.md).
 
+!!! note
+    NetBox v2.9.0 and later require Redis v4.0 or higher. If your distribution does not offer a recent enough release, you will need to build Redis from source. Please see [the Redis installation documentation](https://github.com/redis/redis) for further details.
+
 ### Ubuntu
 
 ```no-highlight

docs/installation/3-netbox.md

@@ -1,13 +1,18 @@
 # NetBox Installation
 
-This section of the documentation discusses installing and configuring the NetBox application. Begin by installing all system packages required by NetBox and its dependencies:
+This section of the documentation discusses installing and configuring the NetBox application itself.
 
 ## Install System Packages
 
+Begin by installing all system packages required by NetBox and its dependencies.
+
+!!! note
+    NetBox v2.8.0 and later require Python 3.6 or 3.7. This documentation assumes Python 3.6.
+
 ### Ubuntu
 
 ```no-highlight
-# apt-get install -y python3 python3-pip python3-venv python3-dev build-essential libxml2-dev libxslt1-dev libffi-dev libpq-dev libssl-dev zlib1g-dev
+# apt-get install -y python3.6 python3-pip python3-venv python3-dev build-essential libxml2-dev libxslt1-dev libffi-dev libpq-dev libssl-dev zlib1g-dev
 ```
 
 ### CentOS
@@ -17,22 +22,32 @@ This section of the documentation discusses installing and configuring the NetBo
 # easy_install-3.6 pip
 ```
 
+Before continuing with either platform, update pip (Python's package management tool) to its latest release:
+
+```no-highlight
+# pip3 install --upgrade pip
+```
+
 ## Download NetBox
 
-You may opt to install NetBox either from a numbered release or by cloning the master branch of its repository on GitHub.
+This documentation provides two options for installing NetBox: from a downloadable archive, or from the git repository. Installing from a package (option A below) requires manually fetching and decompressing the archive for every future update, whereas installation via git (option B) allows for seamless upgrades by re-pulling the `master` branch.
 
-### Option A: Download a Release
+### Option A: Download a Release Archive
 
-Download the [latest stable release](https://github.com/netbox-community/netbox/releases) from GitHub as a tarball or ZIP archive and extract it to your desired path. In this example, we'll use `/opt/netbox`.
+Download the [latest stable release](https://github.com/netbox-community/netbox/releases) from GitHub as a tarball or ZIP archive and extract it to your desired path. In this example, we'll use `/opt/netbox` as the NetBox root.
 
 ```no-highlight
 # wget https://github.com/netbox-community/netbox/archive/vX.Y.Z.tar.gz
 # tar -xzf vX.Y.Z.tar.gz -C /opt
-# cd /opt/
-# ln -s netbox-X.Y.Z/ netbox
-# cd /opt/netbox/
+# ln -s /opt/netbox-X.Y.Z/ /opt/netbox
+# ls -l /opt | grep netbox
+lrwxrwxrwx  1 root root         13 Jul 20 13:44 netbox -> netbox-2.9.0/
+drwxr-xr-x  2 root root       4096 Jul 20 13:44 netbox-2.9.0
 ```
 
+!!! note
+    It is recommended to install NetBox in a directory named for its version number. For example, NetBox v2.9.0 would be installed into `/opt/netbox-2.9.0`, and a symlink from `/opt/netbox/` would point to this location. This allows for future releases to be installed in parallel without interrupting the current installation. When changing to the new release, only the symlink needs to be updated.
+
 ### Option B: Clone the Git Repository
 
 Create the base directory for the NetBox installation. For this guide, we'll use `/opt/netbox`.
@@ -55,7 +70,7 @@ If `git` is not already installed, install it:
 # yum install -y git
 ```
 
-Next, clone the **master** branch of the NetBox GitHub repository into the current directory:
+Next, clone the **master** branch of the NetBox GitHub repository into the current directory. (This branch always holds the current stable release.)
 
 ```no-highlight
 # git clone -b master https://github.com/netbox-community/netbox.git .
@@ -68,71 +83,38 @@ Resolving deltas: 100% (1495/1495), done.
 Checking connectivity... done.
 ```
 
-## Create the NetBox User
-
-Create a system user account named `netbox`. We'll configure the WSGI and HTTP services to run under this account. We'll also assign this user ownership of the media directory. This ensures that NetBox will be able to save local files.
-
 !!! note
-    CentOS users may need to create the `netbox` group first.
+    Installation via git also allows you to easily try out development versions of NetBox. The `develop` branch contains all work underway for the next minor release, and the `develop-x.y` branch (if present) tracks progress on the next major release. 
+
+## Create the NetBox System User
+
+Create a system user account named `netbox`. We'll configure the WSGI and HTTP services to run under this account. We'll also assign this user ownership of the media directory. This ensures that NetBox will be able to save uploaded files.
+
+#### Ubuntu
 
 ```
 # adduser --system --group netbox
 # chown --recursive netbox /opt/netbox/netbox/media/
 ```
 
-## Set Up Python Environment
+#### CentOS
 
-We'll use a Python [virtual environment](https://docs.python.org/3.6/tutorial/venv.html) to ensure NetBox's required packages don't conflict with anything in the base system. This will create a directory named `venv` in our NetBox root.
-
-```no-highlight
-# python3 -m venv /opt/netbox/venv
 ```
-
-Next, activate the virtual environment and install the required Python packages. You should see your console prompt change to indicate the active environment. (Activating the virtual environment updates your command shell to use the local copy of Python that we just installed for NetBox instead of the system's Python interpreter.)
-
-```no-highlight
-# source venv/bin/activate
-(venv) # pip3 install -r requirements.txt
-```
-
-### NAPALM Automation (Optional)
-
-NetBox supports integration with the [NAPALM automation](https://napalm-automation.net/) library. NAPALM allows NetBox to fetch live data from devices and return it to a requester via its REST API. Installation of NAPALM is optional. To enable it, install the `napalm` package:
-
-```no-highlight
-(venv) # pip3 install napalm
-```
-
-To ensure NAPALM is automatically re-installed during future upgrades, create a file named `local_requirements.txt` in the NetBox root directory (alongside `requirements.txt`) and list the `napalm` package:
-
-```no-highlight
-# echo napalm >> local_requirements.txt
-```
-
-### Remote File Storage (Optional)
-
-By default, NetBox will use the local filesystem to storage uploaded files. To use a remote filesystem, install the [`django-storages`](https://django-storages.readthedocs.io/en/stable/) library and configure your [desired backend](../../configuration/optional-settings/#storage_backend) in `configuration.py`.
-
-```no-highlight
-(venv) # pip3 install django-storages
-```
-
-Don't forget to add the `django-storages` package to `local_requirements.txt` to ensure it gets re-installed during future upgrades:
-
-```no-highlight
-# echo django-storages >> local_requirements.txt
+# groupadd --system netbox
+# adduser --system -g netbox netbox
+# chown --recursive netbox /opt/netbox/netbox/media/
 ```
 
 ## Configuration
 
-Move into the NetBox configuration directory and make a copy of `configuration.example.py` named `configuration.py`.
+Move into the NetBox configuration directory and make a copy of `configuration.example.py` named `configuration.py`. This file will hold all of your local configuration parameters.
 
 ```no-highlight
-(venv) # cd netbox/netbox/
-(venv) # cp configuration.example.py configuration.py
+# cd /opt/netbox/netbox/netbox/
+# cp configuration.example.py configuration.py
 ```
 
-Open `configuration.py` with your preferred editor and set the following variables:
+Open `configuration.py` with your preferred editor to begin configuring NetBox. NetBox offers [many configuration parameters](/configuration/), but only the following four are required for new installations:
 
 * `ALLOWED_HOSTS`
 * `DATABASE`
@@ -141,19 +123,21 @@ Open `configuration.py` with your preferred editor and set the following variabl
 
 ### ALLOWED_HOSTS
 
-This is a list of the valid hostnames by which this server can be reached. You must specify at least one name or IP address.
-
-Example:
+This is a list of the valid hostnames and IP addresses by which this server can be reached. You must specify at least one name or IP address. (Note that this does not restrict the locations from which NetBox may be accessed: It is merely for [HTTP host header validation](https://docs.djangoproject.com/en/3.0/topics/security/#host-headers-virtual-hosting).)
 
 ```python
 ALLOWED_HOSTS = ['netbox.example.com', '192.0.2.123']
 ```
 
+If you are not yet sure what the domain name and/or IP address of the NetBox installation will be, you can set this to a wildcard (asterisk) to allow all host values:
+
+```python
+ALLOWED_HOSTS = ['*']
+```
+
 ### DATABASE
 
-This parameter holds the database configuration details. You must define the username and password used when you configured PostgreSQL. If the service is running on a remote host, replace `localhost` with its address. See the [configuration documentation](../../configuration/required-settings/#database) for more detail on individual parameters.
-
-Example:
+This parameter holds the database configuration details. You must define the username and password used when you configured PostgreSQL. If the service is running on a remote host, update the `HOST` and `PORT` parameters accordingly. See the [configuration documentation](/configuration/required-settings/#database) for more detail on individual parameters.
 
 ```python
 DATABASE = {
@@ -162,30 +146,30 @@ DATABASE = {
     'PASSWORD': 'J5brHrAXFLQSif0K', # PostgreSQL password
     'HOST': 'localhost',            # Database server
     'PORT': '',                     # Database port (leave blank for default)
-    'CONN_MAX_AGE': 300,            # Max database connection age
+    'CONN_MAX_AGE': 300,            # Max database connection age (seconds)
 }
 ```
 
 ### REDIS
 
-Redis is a in-memory key-value store required as part of the NetBox installation. It is used for features such as webhooks and caching. Redis typically requires minimal configuration; the values below should suffice for most installations. See the [configuration documentation](../../configuration/required-settings/#redis) for more detail on individual parameters.
+Redis is a in-memory key-value store used by NetBox for caching and background task queuing. Redis typically requires minimal configuration; the values below should suffice for most installations. See the [configuration documentation](/configuration/required-settings/#redis) for more detail on individual parameters.
+
+Note that NetBox requires the specification of two separate Redis databases: `tasks` and `caching`. These may both be provided by the same Redis service, however each should have a unique database ID.
 
 ```python
 REDIS = {
-    'webhooks': {
-        'HOST': 'redis.example.com',
-        'PORT': 1234,
-        'PASSWORD': 'foobar',
-        'DATABASE': 0,
-        'DEFAULT_TIMEOUT': 300,
-        'SSL': False,
+    'tasks': {
+        'HOST': 'localhost',      # Redis server
+        'PORT': 6379,             # Redis port
+        'PASSWORD': '',           # Redis password (optional)
+        'DATABASE': 0,            # Database ID
+        'SSL': False,             # Use SSL (optional)
     },
     'caching': {
         'HOST': 'localhost',
         'PORT': 6379,
         'PASSWORD': '',
-        'DATABASE': 1,
-        'DEFAULT_TIMEOUT': 300,
+        'DATABASE': 1,            # Unique ID for second database
         'SSL': False,
     }
 }
@@ -193,37 +177,69 @@ REDIS = {
 
 ### SECRET_KEY
 
-Generate a random secret key of at least 50 alphanumeric characters. This key must be unique to this installation and must not be shared outside the local system.
+This parameter must be assigned a randomly-generated key employed as a salt for hashing and related cryptographic functions. (Note, however, that it is _never_ directly used in the encryption of secret data.) This key must be unique to this installation and is recommended to be at least 50 characters long. It should not be shared outside the local system.
 
-You may use the script located at `netbox/generate_secret_key.py` to generate a suitable key.
-
-!!! note
-    In the case of a highly available installation with multiple web servers, `SECRET_KEY` must be identical among all servers in order to maintain a persistent user session state.
-
-## Run Database Migrations
-
-Before NetBox can run, we need to install the database schema. This is done by running `python3 manage.py migrate` from the `netbox` directory (`/opt/netbox/netbox/` in our example):
+A simple Python script named `generate_secret_key.py` is provided in the parent directory to assist in generating a suitable key:
 
 ```no-highlight
-(venv) # cd /opt/netbox/netbox/
-(venv) # python3 manage.py migrate
-Operations to perform:
-  Apply all migrations: dcim, sessions, admin, ipam, utilities, auth, circuits, contenttypes, extras, secrets, users
-Running migrations:
-  Rendering model states... DONE
-  Applying contenttypes.0001_initial... OK
-  Applying auth.0001_initial... OK
-  Applying admin.0001_initial... OK
-  ...
+# python3 ../generate_secret_key.py
 ```
 
-If this step results in a PostgreSQL authentication error, ensure that the username and password created in the database match what has been specified in `configuration.py`
+!!! warning
+    In the case of a highly available installation with multiple web servers, `SECRET_KEY` must be identical among all servers in order to maintain a persistent user session state.
+
+When you have finished modifying the configuration, remember to save the file.
+
+## Optional Requirements
+
+All Python packages required by NetBox are listed in `requirements.txt` and will be installed automatically. NetBox also supports some optional packages. If desired, these packages must be listed in `local_requirements.txt` within the NetBox root directory.
+
+### NAPALM
+
+The [NAPALM automation](https://napalm-automation.net/) library allows NetBox to fetch live data from devices and return it to a requester via its REST API. The `NAPALM_USERNAME` and `NAPALM_PASSWORD` configuration parameters define the credentials to be used when connecting to a device.
+
+```no-highlight
+# echo napalm >> /opt/netbox/local_requirements.txt
+```
+
+### Remote File Storage
+
+By default, NetBox will use the local filesystem to store uploaded files. To use a remote filesystem, install the [`django-storages`](https://django-storages.readthedocs.io/en/stable/) library and configure your [desired storage backend](/configuration/optional-settings/#storage_backend) in `configuration.py`.
+
+```no-highlight
+# echo django-storages >> /opt/netbox/local_requirements.txt
+```
+
+## Run the Upgrade Script
+
+Once NetBox has been configured, we're ready to proceed with the actual installation. We'll run the packaged upgrade script (`upgrade.sh`) to perform the following actions:
+
+* Create a Python virtual environment
+* Install all required Python packages
+* Run database schema migrations
+* Aggregate static resource files on disk
+
+```no-highlight
+# /opt/netbox/upgrade.sh
+```
+
+!!! note
+    Upon completion, the upgrade script may warn that no existing virtual environment was detected. As this is a new installation, this warning can be safely ignored.
 
 ## Create a Super User
 
-NetBox does not come with any predefined user accounts. You'll need to create a super user to be able to log into NetBox:
+NetBox does not come with any predefined user accounts. You'll need to create a super user (administrative account) to be able to log into NetBox. First, enter the Python virtual environment created by the upgrade script:
 
 ```no-highlight
+# source /opt/netbox/venv/bin/activate
+```
+
+Once the virtual environment has been activated, you should notice the string `(venv)` prepended to your console prompt.
+
+Next, we'll create a superuser account using the `createsuperuser` Django management command (via `manage.py`). Specifying an email address for the user is not required, but be sure to use a very strong password.
+
+```no-highlight
+(venv) # cd /opt/netbox/netbox
 (venv) # python3 manage.py createsuperuser
 Username: admin
 Email address: admin@example.com
@@ -232,17 +248,9 @@ Password (again):
 Superuser created successfully.
 ```
 
-## Collect Static Files
-
-```no-highlight
-(venv) # python3 manage.py collectstatic --no-input
-
-959 static files copied to '/opt/netbox/netbox/static'.
-```
-
 ## Test the Application
 
-At this point, NetBox should be able to run. We can verify this by starting a development instance:
+At this point, we should be able to run NetBox. We can check by starting a development instance:
 
 ```no-highlight
 (venv) # python3 manage.py runserver 0.0.0.0:8000 --insecure
@@ -264,6 +272,6 @@ Note that the initial UI will be locked down for non-authenticated users.
 
 ![NetBox UI as seen by a non-authenticated user](../media/installation/netbox_ui_guest.png)
 
-After logging in as the superuser you created earlier, all areas of the UI will be available.
+Try logging in as the super user we just created. Once authenticated, you'll be able to access all areas of the UI:
 
 ![NetBox UI as seen by an administrator](../media/installation/netbox_ui_admin.png)

docs/installation/4-gunicorn.md

@@ -0,0 +1,49 @@
+# Gunicorn
+
+Like most Django applications, NetBox runs as a [WSGI application](https://en.wikipedia.org/wiki/Web_Server_Gateway_Interface) behind an HTTP server. This documentation shows how to install and configure [gunicorn](http://gunicorn.org/) for this role, however other WSGIs are available and should work similarly well.
+
+## Configuration
+
+NetBox ships with a default configuration file for gunicorn. To use it, copy `/opt/netbox/contrib/gunicorn.py` to `/opt/netbox/gunicorn.py`. (We make a copy of this file rather than pointing to it directly to ensure that any changes to it do not get overwritten by a future upgrade.)
+
+```no-highlight
+# cd /opt/netbox
+# cp contrib/gunicorn.py /opt/netbox/gunicorn.py
+```
+
+While this default configuration should suffice for most initial installations, you may wish to edit this file to change the bound IP address and/or port number, or to make performance-related adjustments. See [the Gunicorn documentation](https://docs.gunicorn.org/en/stable/configure.html) for the available configuration parameters.
+
+## systemd Setup
+
+We'll use systemd to control both gunicorn and NetBox's background worker process. First, copy `contrib/netbox.service` and `contrib/netbox-rq.service` to the `/etc/systemd/system/` directory and reload the systemd dameon:
+
+```no-highlight
+# cp contrib/*.service /etc/systemd/system/
+# systemctl daemon-reload
+```
+
+Then, start the `netbox` and `netbox-rq` services and enable them to initiate at boot time:
+
+```no-highlight
+# systemctl start netbox netbox-rq
+# systemctl enable netbox netbox-rq
+```
+
+You can use the command `systemctl status netbox` to verify that the WSGI service is running:
+
+```no-highlight
+# systemctl status netbox.service
+● netbox.service - NetBox WSGI Service
+   Loaded: loaded (/etc/systemd/system/netbox.service; enabled; vendor preset: enabled)
+   Active: active (running) since Thu 2019-12-12 19:23:40 UTC; 25s ago
+     Docs: https://netbox.readthedocs.io/en/stable/
+ Main PID: 11993 (gunicorn)
+    Tasks: 6 (limit: 2362)
+   CGroup: /system.slice/netbox.service
+           ├─11993 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
+           ├─12015 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
+           ├─12016 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
+...
+```
+
+Once you've verified that the WSGI workers are up and running, move on to HTTP server setup.

docs/installation/4-http-daemon.md

@@ -1,167 +0,0 @@
-# HTTP Server Setup
-
-We'll set up a simple WSGI front end using [gunicorn](http://gunicorn.org/) for the purposes of this guide. For web servers, we provide example configurations for both [nginx](https://www.nginx.com/resources/wiki/) and [Apache](http://httpd.apache.org/docs/2.4). (You are of course free to use whichever combination of HTTP and WSGI services you'd like.) We'll use systemd to enable service persistence.
-
-!!! info
-    For the sake of brevity, only Ubuntu 18.04 instructions are provided here, but this sort of web server and WSGI configuration is not unique to NetBox. Please consult your distribution's documentation for assistance if needed.
-
-## HTTP Daemon Installation
-
-### Option A: nginx
-
-The following will serve as a minimal nginx configuration. Be sure to modify your server name and installation path appropriately.
-
-```no-highlight
-# apt-get install -y nginx
-```
-
-Once nginx is installed, save the following configuration to `/etc/nginx/sites-available/netbox`. Be sure to replace `netbox.example.com` with the domain name or IP address of your installation. (This should match the value configured for `ALLOWED_HOSTS` in `configuration.py`.)
-
-```nginx
-server {
-    listen 80;
-
-    server_name netbox.example.com;
-
-    client_max_body_size 25m;
-
-    location /static/ {
-        alias /opt/netbox/netbox/static/;
-    }
-
-    location / {
-        proxy_pass http://127.0.0.1:8001;
-        proxy_set_header X-Forwarded-Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
-```
-
-Then, delete `/etc/nginx/sites-enabled/default` and create a symlink in the `sites-enabled` directory to the configuration file you just created.
-
-```no-highlight
-# cd /etc/nginx/sites-enabled/
-# rm default
-# ln -s /etc/nginx/sites-available/netbox
-```
-
-Restart the nginx service to use the new configuration.
-
-```no-highlight
-# service nginx restart
-```
-
-To enable SSL, consider this guide on [securing nginx with Let's Encrypt](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04).
-
-### Option B: Apache
-
-```no-highlight
-# apt-get install -y apache2 libapache2-mod-wsgi-py3
-```
-
-Once Apache is installed, proceed with the following configuration (Be sure to modify the `ServerName` appropriately):
-
-```apache
-<VirtualHost *:80>
-    ProxyPreserveHost On
-
-    ServerName netbox.example.com
-
-    Alias /static /opt/netbox/netbox/static
-
-    # Needed to allow token-based API authentication
-    WSGIPassAuthorization on
-
-    <Directory /opt/netbox/netbox/static>
-        Options Indexes FollowSymLinks MultiViews
-        AllowOverride None
-        Require all granted
-    </Directory>
-
-    <Location /static>
-        ProxyPass !
-    </Location>
-
-    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
-    ProxyPass / http://127.0.0.1:8001/
-    ProxyPassReverse / http://127.0.0.1:8001/
-</VirtualHost>
-```
-
-Save the contents of the above example in `/etc/apache2/sites-available/netbox.conf`, enable the `proxy` and `proxy_http` modules, and reload Apache:
-
-```no-highlight
-# a2enmod proxy
-# a2enmod proxy_http
-# a2enmod headers
-# a2ensite netbox
-# service apache2 restart
-```
-
-To enable SSL, consider this guide on [securing Apache with Let's Encrypt](https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-16-04).
-
-!!! note
-    Certain components of NetBox (such as the display of rack elevation diagrams) rely on the use of embedded objects. Ensure that your HTTP server configuration does not override the `X-Frame-Options` response header set by NetBox.
-
-## gunicorn Configuration
-
-Copy `/opt/netbox/contrib/gunicorn.py` to `/opt/netbox/gunicorn.py`. (We make a copy of this file to ensure that any changes to it do not get overwritten by a future upgrade.)
-
-```no-highlight
-# cd /opt/netbox
-# cp contrib/gunicorn.py /opt/netbox/gunicorn.py
-```
-
-You may wish to edit this file to change the bound IP address or port number, or to make performance-related adjustments.
-
-## systemd Configuration
-
-We'll use systemd to control the daemonization of NetBox services. First, copy `contrib/netbox.service` and `contrib/netbox-rq.service` to the `/etc/systemd/system/` directory:
-
-```no-highlight
-# cp contrib/*.service /etc/systemd/system/
-```
-
-Then, start the `netbox` and `netbox-rq` services and enable them to initiate at boot time:
-
-```no-highlight
-# systemctl daemon-reload
-# systemctl start netbox netbox-rq
-# systemctl enable netbox netbox-rq
-```
-
-You can use the command `systemctl status netbox` to verify that the WSGI service is running:
-
-```
-# systemctl status netbox.service
-● netbox.service - NetBox WSGI Service
-   Loaded: loaded (/etc/systemd/system/netbox.service; enabled; vendor preset: enabled)
-   Active: active (running) since Thu 2019-12-12 19:23:40 UTC; 25s ago
-     Docs: https://netbox.readthedocs.io/en/stable/
- Main PID: 11993 (gunicorn)
-    Tasks: 6 (limit: 2362)
-   CGroup: /system.slice/netbox.service
-           ├─11993 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
-           ├─12015 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
-           ├─12016 /usr/bin/python3 /usr/local/bin/gunicorn --pid /var/tmp/netbox.pid --pythonpath /opt/netbox/...
-...
-```
-
-At this point, you should be able to connect to the HTTP service at the server name or IP address you provided.
-
-!!! info
-    Please keep in mind that the configurations provided here are bare minimums required to get NetBox up and running. You may want to make adjustments to better suit your production environment.
-
-## Troubleshooting
-
-If you are unable to connect to the HTTP server, check that:
-
-* Nginx/Apache is running and configured to listen on the correct port.
-* Access is not being blocked by a firewall. (Try connecting locally from the server itself.)
-
-If you are able to connect but receive a 502 (bad gateway) error, check the following:
-
-* The NetBox system process (gunicorn) is running: `systemctl status netbox`
-* nginx/Apache is configured to connect to the port on which gunicorn is listening (default is 8001).
-* SELinux is not preventing the reverse proxy connection. You may need to allow HTTP network connections with the command `setsebool -P httpd_can_network_connect 1`

docs/installation/5-http-server.md

@@ -0,0 +1,95 @@
+# HTTP Server Setup
+
+This documentation provides example configurations for both [nginx](https://www.nginx.com/resources/wiki/) and [Apache](http://httpd.apache.org/docs/2.4), though any HTTP server which supports WSGI should be compatible.
+
+!!! info
+    For the sake of brevity, only Ubuntu 18.04 instructions are provided here, these tasks not unique to NetBox and should carry over to other distributions with mininal changes. Please consult your distribution's documentation for assistance if needed.
+
+## Obtain an SSL Certificate
+
+To enable HTTPS access to NetBox, you'll need a valid SSL certificate. You can purchase one from a trusted commercial provider, obtain one for free from [Let's Encrypt](https://letsencrypt.org/getting-started/), or generate your own (although self-signed certificates are generally untrusted). Both the public certificate and private key files need to be installed on your NetBox server in a location that is readable by the `netbox` user.
+
+The command below can be used to generate a self-signed certificate for testing purposes, however it is strongly recommended to use a certificate from a trusted authority in production. Two files will be created: the public certificate (`netbox.crt`) and the private key (`netbox.key`). The certificate is published to the world, whereas the private key must be kept secret at all times.
+
+```no-highlight
+# openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+-keyout /etc/ssl/private/netbox.key \
+-out /etc/ssl/certs/netbox.crt
+```
+
+The above command will prompt you for additional details of the certificate; all of these are optional.
+
+## HTTP Server Installation
+
+### Option A: nginx
+
+Begin by installing nginx:
+
+```no-highlight
+# apt-get install -y nginx
+```
+
+Once nginx is installed, copy the nginx configuration file provided by NetBox to `/etc/nginx/sites-available/netbox`. Be sure to replace `netbox.example.com` with the domain name or IP address of your installation. (This should match the value configured for `ALLOWED_HOSTS` in `configuration.py`.)
+
+```no-highlight
+# cp /opt/netbox/contrib/nginx.conf /etc/nginx/sites-available/netbox
+```
+
+Then, delete `/etc/nginx/sites-enabled/default` and create a symlink in the `sites-enabled` directory to the configuration file you just created.
+
+```no-highlight
+# cd /etc/nginx/sites-enabled/
+# rm default
+# ln -s /etc/nginx/sites-available/netbox
+```
+
+Finally, restart the `nginx` service to use the new configuration.
+
+```no-highlight
+# service nginx restart
+```
+
+### Option B: Apache
+
+Begin by installing Apache:
+
+```no-highlight
+# apt-get install -y apache2
+```
+
+Next, copy the default configuration file to `/etc/apache2/sites-available/`. Be sure to modify the `ServerName` parameter appropriately.
+
+```no-highlight
+# cp /opt/netbox/contrib/apache.conf /etc/apache2/sites-available/netbox.conf
+```
+
+Finally, ensure that the required Apache modules are enabled, enable the `netbox` site, and reload Apache:
+
+```no-highlight
+# a2enmod ssl proxy proxy_http headers
+# a2ensite netbox
+# service apache2 restart
+```
+
+## Confirm Connectivity
+
+At this point, you should be able to connect to the HTTP service at the server name or IP address you provided.
+
+!!! info
+    Please keep in mind that the configurations provided here are bare minimums required to get NetBox up and running. You may want to make adjustments to better suit your production environment.
+
+!!! warning
+    Certain components of NetBox (such as the display of rack elevation diagrams) rely on the use of embedded objects. Ensure that your HTTP server configuration does not override the `X-Frame-Options` response header set by NetBox.
+
+## Troubleshooting
+
+If you are unable to connect to the HTTP server, check that:
+
+* Nginx/Apache is running and configured to listen on the correct port.
+* Access is not being blocked by a firewall somewhere along the path. (Try connecting locally from the server itself.)
+
+If you are able to connect but receive a 502 (bad gateway) error, check the following:
+
+* The WSGI worker processes (gunicorn) are running (`systemctl status netbox` should show a status of "active (running)")
+* nginx/Apache is configured to connect to the port on which gunicorn is listening (default is 8001).
+* SELinux is not preventing the reverse proxy connection. You may need to allow HTTP network connections with the command `setsebool -P httpd_can_network_connect 1`

docs/installation/6-ldap.md

@@ -36,7 +36,13 @@ Once installed, add the package to `local_requirements.txt` to ensure it is re-i
 
 ## Configuration
 
-Create a file in the same directory as `configuration.py` (typically `netbox/netbox/`) named `ldap_config.py`. Define all of the parameters required below in `ldap_config.py`. Complete documentation of all `django-auth-ldap` configuration options is included in the project's [official documentation](http://django-auth-ldap.readthedocs.io/).
+First, enable the LDAP authentication backend in `configuration.py`. (Be sure to overwrite this definition if it is already set to `RemoteUserBackend`.)
+
+```python
+REMOTE_AUTH_BACKEND = 'netbox.authentication.LDAPBackend'
+```
+
+Next, create a file in the same directory as `configuration.py` (typically `netbox/netbox/`) named `ldap_config.py`. Define all of the parameters required below in `ldap_config.py`. Complete documentation of all `django-auth-ldap` configuration options is included in the project's [official documentation](http://django-auth-ldap.readthedocs.io/).
 
 ### General Server Configuration
 
@@ -135,7 +141,7 @@ AUTH_LDAP_CACHE_TIMEOUT = 3600
 
 ## Troubleshooting LDAP
 
-`supervisorctl restart netbox` restarts the Netbox service, and initiates any changes made to `ldap_config.py`. If there are syntax errors present, the NetBox process will not spawn an instance, and errors should be logged to `/var/log/supervisor/`.
+`systemctl restart netbox` restarts the Netbox service, and initiates any changes made to `ldap_config.py`. If there are syntax errors present, the NetBox process will not spawn an instance, and errors should be logged to `/var/log/messages`.
 
 For troubleshooting LDAP user/group queries, add the following lines to the start of `ldap_config.py` after `import ldap`.
 
@@ -145,7 +151,8 @@ logfile = "/opt/netbox/logs/django-ldap-debug.log"
 my_logger = logging.getLogger('django_auth_ldap')
 my_logger.setLevel(logging.DEBUG)
 handler = logging.handlers.RotatingFileHandler(
-   logfile, maxBytes=1024 * 500, backupCount=5)
+    logfile, maxBytes=1024 * 500, backupCount=5
+)
 my_logger.addHandler(handler)
 ```
 

docs/installation/index.md

@@ -5,11 +5,17 @@ The following sections detail how to set up a new instance of NetBox:
 1. [PostgreSQL database](1-postgresql.md)
 1. [Redis](2-redis.md)
 3. [NetBox components](3-netbox.md)
-4. [HTTP daemon](4-http-daemon.md)
-5. [LDAP authentication](5-ldap.md) (optional)
+4. [Gunicorn](4-gunicorn.md)
+5. [HTTP server](5-http-server.md)
+6. [LDAP authentication](6-ldap.md) (optional)
+
+Below is a simplified overview of the NetBox application stack for reference:
+
+![NetBox UI as seen by a non-authenticated user](../media/installation/netbox_application_stack.png)
 
 ## Upgrading
 
 If you are upgrading from an existing installation, please consult the [upgrading guide](upgrading.md).
 
-Netbox v2.5.9 and later moved to using systemd instead of supervisord.  Please see the instructions for [migrating to systemd](migrating-to-systemd.md) if you are still using supervisord.
+!!! note
+    Beginning with v2.5.9, the official documentation calls for systemd to be used for managing the WSGI workers in place of supervisord.  Please see the instructions for [migrating to systemd](migrating-to-systemd.md) if you are still using supervisord.

docs/installation/migrating-to-systemd.md

@@ -7,7 +7,7 @@ This document contains instructions for migrating from a legacy NetBox deploymen
 ### Uninstall supervisord
 
 ```no-highlight
-# apt-get remove -y supervisord
+# apt-get remove -y supervisor
 ```
 
 ### Configure systemd

docs/installation/upgrading.md

@@ -4,6 +4,16 @@
 
 Prior to upgrading your NetBox instance, be sure to carefully review all [release notes](../../release-notes/) that have been published since your current version was released. Although the upgrade process typically does not involve additional work, certain releases may introduce breaking or backward-incompatible changes. These are called out in the release notes under the version in which the change went into effect.
 
+## Update Dependencies to Required Versions
+
+NetBox v2.9.0 and later requires the following:
+
+| Dependency | Minimum Version |
+|------------|-----------------|
+| Python     | 3.6             |
+| PostgreSQL | 9.6             |
+| Redis      | 4.0             |
+
 ## Install the Latest Code
 
 As with the initial installation, you can upgrade NetBox by either downloading the latest release package or by cloning the `master` branch of the git repository. 
@@ -27,6 +37,12 @@ Copy the 'configuration.py' you created when first installing to the new version
 # cp netbox-X.Y.Z/netbox/netbox/configuration.py netbox/netbox/netbox/configuration.py
 ```
 
+Copy your local requirements file if used:
+
+```no-highlight
+# cp netbox-X.Y.Z/local_requirements.txt netbox/local_requirements.txt
+```
+
 Also copy the LDAP configuration if using LDAP:
 
 ```no-highlight

docs/models/circuits/circuit.md

@@ -1,3 +1,19 @@
 # Circuits
 
-A circuit represents a single _physical_ link connecting exactly two endpoints. (A circuit with more than two endpoints is a virtual circuit, which is not currently supported by NetBox.) Each circuit belongs to a provider and must be assigned a circuit ID which is unique to that provider.
+A communications circuit represents a single _physical_ link connecting exactly two endpoints, commonly referred to as its A and Z terminations. A circuit in NetBox may have zero, one, or two terminations defined. It is common to have only one termination defined when you don't necessarily care about the details of the provider side of the circuit, e.g. for Internet access circuits. Both terminations would likely be modeled for circuits which connect one customer site to another.
+
+Each circuit is associated with a provider and a user-defined type. For example, you might have Internet access circuits delivered to each site by one provider, and private MPLS circuits delivered by another. Each circuit must be assigned a circuit ID, each of which must be unique per provider.
+
+Each circuit is also assigned one of the following operational statuses:
+
+* Planned
+* Provisioning
+* Active
+* Offline
+* Deprovisioning
+* Decommissioned
+
+Circuits also have optional fields for annotating their installation date and commit rate, and may be assigned to NetBox tenants.
+
+!!! note
+    NetBox currently models only physical circuits: those which have exactly two endpoints. It is common to layer virtualized constructs (_virtual circuits_) such as MPLS or EVPN tunnels on top of these, however NetBox does not yet support virtual circuit modeling.

docs/models/circuits/circuittermination.md

@@ -1,11 +1,10 @@
 # Circuit Terminations
 
-A circuit may have one or two terminations, annotated as the "A" and "Z" sides of the circuit. A single-termination circuit can be used when you don't know (or care) about the far end of a circuit (for example, an Internet access circuit which connects to a transit provider). A dual-termination circuit is useful for tracking circuits which connect two sites.
+The association of a circuit with a particular site and/or device is modeled separately as a circuit termination. A circuit may have up to two terminations, labeled A and Z. A single-termination circuit can be used when you don't know (or care) about the far end of a circuit (for example, an Internet access circuit which connects to a transit provider). A dual-termination circuit is useful for tracking circuits which connect two sites.
 
-Each circuit termination is tied to a site, and may optionally be connected via a cable to a specific device interface or pass-through port. Each termination can be assigned a separate downstream and upstream speed independent from one another. Fields are also available to track cross-connect and patch panel details.
+Each circuit termination is tied to a site, and may optionally be connected via a cable to a specific device interface or port within that site. Each termination must be assigned a port speed, and can optionally be assigned an upstream speed if it differs from the downstream speed (a common scenario with e.g. DOCSIS cable modems). Fields are also available to track cross-connect and patch panel details.
+
+In adherence with NetBox's philosophy of closely modeling the real world, a circuit may terminate only to a physical interface. For example, circuits may not terminate to LAG interfaces, which are virtual in nature. In such cases, a separate physical circuit is associated with each LAG member interface and each needs to be modeled discretely.
 
 !!! note
-    A circuit represents a physical link, and cannot have more than two endpoints. When modeling a multi-point topology, each leg of the topology must be defined as a discrete circuit.
-
-!!! note
-    A circuit may terminate only to a physical interface. Circuits may not terminate to LAG interfaces, which are virtual interfaces: You must define each physical circuit within a service bundle separately and terminate it to its actual physical interface.
+    A circuit in NetBox represents a physical link, and cannot have more than two endpoints. When modeling a multi-point topology, each leg of the topology must be defined as a discrete circuit, with one end terminating within the provider's infrastructure.

docs/models/circuits/circuittype.md

@@ -1,10 +1,8 @@
 # Circuit Types
 
-Circuits are classified by type. For example, you might define circuit types for:
+Circuits are classified by functional type. These types are completely customizable, and are typically used to convey the type of service being delivered over a circuit. For example, you might define circuit types for:
 
 * Internet transit
 * Out-of-band connectivity
 * Peering
 * Private backhaul
-
-Circuit types are fully customizable.

docs/models/circuits/provider.md

@@ -1,5 +1,5 @@
 # Providers
 
-A provider is any entity which provides some form of connectivity. While this obviously includes carriers which offer Internet and private transit service, it might also include Internet exchange (IX) points and even organizations with whom you peer directly.
+A circuit provider is any entity which provides some form of connectivity of among sites or organizations within a site. While this obviously includes carriers which offer Internet and private transit service, it might also include Internet exchange (IX) points and even organizations with whom you peer directly. Each circuit within NetBox must be assigned a provider and a circuit ID which is unique to that provider.
 
-Each provider may be assigned an autonomous system number (ASN), an account number, and relevant contact information.
+Each provider may be assigned an autonomous system number (ASN), an account number, and contact information.

docs/models/dcim/cable.md

@@ -1,19 +1,34 @@
 # Cables
 
-A cable represents a physical connection between two termination points, such as between a console port and a patch panel port, or between two network interfaces. Cables can be traced through pass-through ports to form a complete path between two endpoints. In the example below, three individual cables comprise a path between the two connected endpoints.
+All connections between device components in NetBox are represented using cables. A cable represents a direct physical connection between two termination points, such as between a console port and a patch panel port, or between two network interfaces.
 
-```
-|<------------------------------------------ Cable Path ------------------------------------------->|
+Each cable must have two endpoints defined. These endpoints are sometimes referenced as A and B for clarity, however cables are direction-agnostic and the order in which terminations are made has no meaning. Cables may be connected to the following objects:
 
-  Device A                   Patch Panel A                 Patch Panel B                  Device B
-+-----------+               +-------------+               +-------------+               +-----------+
-| Interface | --- Cable --- | Front Port  |               | Front Port  | --- Cable --- | Interface |
-+-----------+               +-------------+               +-------------+               +-----------+
-                            +-------------+               +-------------+
-                            |  Rear Port  | --- Cable --- |  Rear Port  |
-                            +-------------+               +-------------+
-```
+* Circuit terminations
+* Console ports
+* Console server ports
+* Interfaces
+* Pass-through ports (front and rear)
+* Power feeds
+* Power outlets
+* Power ports
 
-All connections between device components in NetBox are represented using cables. However, defining the actual cable plant is optional: Components can be be directly connected using cables with no type or other attributes assigned.
+Each cable may be assigned a type, label, length, and color. Each cable is also assigned one of three operational statuses:
 
-Cables are also used to associated ports and interfaces with circuit terminations. To do this, first create the circuit termination, then navigate the desired component and connect a cable between the two.
+* Active (default)
+* Planned
+* Decommissioning
+
+## Tracing Cables
+
+A cable may be traced from either of its endpoints by clicking the "trace" button. (A REST API endpoint also provides this functionality.) NetBox will follow the path of connected cables from this termination across the directly connected cable to the far-end termination. If the cable connects to a pass-through port, and the peer port has another cable connected, NetBox will continue following the cable path until it encounters a non-pass-through or unconnected termination point. The entire path will be displayed to the user.
+
+In the example below, three individual cables comprise a path between devices A and D:
+
+![Cable path](../../media/models/dcim_cable_trace.png)
+
+Traced from Interface 1 on Device A, NetBox will show the following path:
+
+* Cable 1: Interface 1 to Front Port 1
+* Cable 2: Rear Port 1 to Rear Port 2
+* Cable 3: Front Port 2 to Interface 2

docs/models/dcim/consoleport.md

@@ -1,5 +1,5 @@
 ## Console Ports
 
-A console port provides connectivity to the physical console of a device. Console ports are typically used for temporary access by someone who is physically near the device, or for remote out-of-band access via a console server.
+A console port provides connectivity to the physical console of a device. These are typically used for temporary access by someone who is physically near the device, or for remote out-of-band access provided via a networked console server. Each console port may be assigned a physical type.
 
-Console ports can be connected to console server ports.
+Cables can connect console ports to console server ports or pass-through ports.

docs/models/dcim/consoleporttemplate.md

@@ -1,3 +1,3 @@
 ## Console Port Templates
 
-A template for a console port that will be created on all instantiations of the parent device type.
+A template for a console port that will be created on all instantiations of the parent device type. Each console port can be assigned a physical type.

docs/models/dcim/consoleserverport.md

@@ -1,5 +1,5 @@
 ## Console Server Ports
 
-A console server is a device which provides remote access to the local consoles of connected devices. This is typically done to provide remote out-of-band access to network devices.
+A console server is a device which provides remote access to the local consoles of connected devices. They are typically used to provide remote out-of-band access to network devices. Each console server port may be assigned a physical type.
 
-Console server ports can be connected to console ports.
+Cables can connect console server ports to console ports or pass-through ports.

docs/models/dcim/consoleserverporttemplate.md

@@ -1,3 +1,3 @@
 ## Console Server Port Templates
 
-A template for a console server port that will be created on all instantiations of the parent device type.
+A template for a console server port that will be created on all instantiations of the parent device type. Each console server port can be assigned a physical type.

docs/models/dcim/device.md

@@ -1,7 +1,15 @@
 # Devices
 
-Every piece of hardware which is installed within a rack exists in NetBox as a device. Devices are measured in rack units (U) and can be half depth or full depth. A device may have a height of 0U: These devices do not consume vertical rack space and cannot be assigned to a particular rack unit. A common example of a 0U device is a vertically-mounted PDU.
+Every piece of hardware which is installed within a site or rack exists in NetBox as a device. Devices are measured in rack units (U) and can be half depth or full depth. A device may have a height of 0U: These devices do not consume vertical rack space and cannot be assigned to a particular rack unit. A common example of a 0U device is a vertically-mounted PDU.
 
 When assigning a multi-U device to a rack, it is considered to be mounted in the lowest-numbered rack unit which it occupies. For example, a 3U device which occupies U8 through U10 is said to be mounted in U8. This logic applies to racks with both ascending and descending unit numbering.
 
-A device is said to be full depth if its installation on one rack face prevents the installation of any other device on the opposite face within the same rack unit(s). This could be either because the device is physically too deep to allow a device behind it, or because the installation of an opposing device would impede airflow.
+A device is said to be full-depth if its installation on one rack face prevents the installation of any other device on the opposite face within the same rack unit(s). This could be either because the device is physically too deep to allow a device behind it, or because the installation of an opposing device would impede airflow.
+
+Each device must be instantiated from a pre-created device type, and its default components (console ports, power ports, interfaces, etc.) will be created automatically. (The device type associated with a device may be changed after its creation, however its components will not be updated retroactively.)
+
+Each device must be assigned a site, device role, and operational status, and may optionally be assigned to a specific rack within a site. A platform, serial number, and asset tag may optionally be assigned to each device.
+
+Device names must be unique within a site, unless the device has been assigned to a tenant. Devices may also be unnamed.
+
+When a device has one or more interfaces with IP addresses assigned, a primary IP for the device can be designated, for both IPv4 and IPv6.

docs/models/dcim/devicebay.md

@@ -1,7 +1,8 @@
 ## Device Bays
 
-Device bays represent the ability of a device to house child devices. For example, you might install four blade servers into a 2U chassis. The chassis would appear in the rack elevation as a 2U device with four device bays. Each server within it would be defined as a 0U device installed in one of the device bays. Child devices do not appear within rack elevations or the "Non-Racked Devices" list within the rack view.
+Device bays represent a space or slot within a parent device in which a child device may be installed. For example, a 2U parent chassis might house four individual blade servers. The chassis would appear in the rack elevation as a 2U device with four device bays, and each server within it would be defined as a 0U device installed in one of the device bays. Child devices do not appear within rack elevations or count as consuming rack units.
 
-Child devices are first-class Devices in their own right: that is, fully independent managed entities which don't share any control plane with the parent.  Just like normal devices, child devices have their own platform (OS), role, tags, and interfaces.  You cannot create a LAG between interfaces in different child devices.
+Child devices are first-class Devices in their own right: That is, they are fully independent managed entities which don't share any control plane with the parent.  Just like normal devices, child devices have their own platform (OS), role, tags, and components.  LAG interfaces may not group interfaces belonging to different child devices.
 
-Therefore, Device bays are **not** suitable for modeling chassis-based switches and routers.  These should instead be modeled as a single Device, with the line cards as Inventory Items.
+!!! note
+    Device bays are **not** suitable for modeling line cards (such as those commonly found in chassis-based routers and switches), as these components depend on the control plane of the parent device to operate. Instead, line cards and similarly non-autonomous hardware should be modeled as inventory items within a device, with any associated interfaces or other components assigned directly to the device.

docs/models/dcim/devicerole.md

@@ -1,3 +1,3 @@
 # Device Roles
 
-Devices can be organized by functional roles. These roles are fully customizable. For example, you might create roles for core switches, distribution switches, and access switches.
+Devices can be organized by functional roles, which are fully customizable by the user. For example, you might create roles for core switches, distribution switches, and access switches within your network.

docs/models/dcim/devicetype.md

@@ -1,18 +1,14 @@
 # Device Types
 
-A device type represents a particular make and model of hardware that exists in the real world. Device types define the physical attributes of a device (rack height and depth) and its individual components (console, power, and network interfaces).
+A device type represents a particular make and model of hardware that exists in the real world. Device types define the physical attributes of a device (rack height and depth) and its individual components (console, power, network interfaces, and so on).
 
-Device types are instantiated as devices installed within racks. For example, you might define a device type to represent a Juniper EX4300-48T network switch with 48 Ethernet interfaces. You can then create multiple devices of this type named "switch1," "switch2," and so on. Each device will inherit the components (such as interfaces) of its device type at the time of creation. (However, changes made to a device type will **not** apply to instances of that device type retroactively.)
+Device types are instantiated as devices installed within sites and/or equipment racks. For example, you might define a device type to represent a Juniper EX4300-48T network switch with 48 Ethernet interfaces. You can then create multiple _instances_ of this type named "switch1," "switch2," and so on. Each device will automatically inherit the components (such as interfaces) of its device type at the time of creation. However, changes made to a device type will **not** apply to instances of that device type retroactively.
 
 Some devices house child devices which share physical resources, like space and power, but which functional independently from one another. A common example of this is blade server chassis. Each device type is designated as one of the following:
 
 * A parent device (which has device bays)
-* A child device (which must be installed in a device bay)
+* A child device (which must be installed within a device bay)
 * Neither
 
 !!! note
-    This parent/child relationship is **not** suitable for modeling chassis-based devices, wherein child members share a common control plane.
-
-    For that application you should create a single Device for the chassis, and add Interfaces directly to it.  Interfaces can be created in bulk using range patterns, e.g. "Gi1/[1-24]".
-
-    Add Inventory Items if you want to record the line cards themselves as separate entities.  There is no explicit relationship between each interface and its line card, but it may be implied by the naming (e.g. interfaces "Gi1/x" are on line card 1)
+    This parent/child relationship is **not** suitable for modeling chassis-based devices, wherein child members share a common control plane. Instead, line cards and similarly non-autonomous hardware should be modeled as inventory items within a device, with any associated interfaces or other components assigned directly to the device.

docs/models/dcim/frontport.md

@@ -1,5 +1,3 @@
 ## Front Ports
 
-Front ports are pass-through ports used to represent physical cable connections that comprise part of a longer path. For example, the ports on the front face of a UTP patch panel would be modeled in NetBox as front ports.
-
-Each front port is mapped to a specific rear port on the same device. A single rear port may be mapped to multiple rear ports.
+Front ports are pass-through ports used to represent physical cable connections that comprise part of a longer path. For example, the ports on the front face of a UTP patch panel would be modeled in NetBox as front ports. Each port is assigned a physical type, and must be mapped to a specific rear port on the same device. A single rear port may be mapped to multiple rear ports, using numeric positions to annotate the specific alignment of each.

docs/models/dcim/frontporttemplate.md

@@ -1,3 +1,3 @@
 ## Front Port Templates
 
-A template for a front-facing pass-through port that will be created on all instantiations of the parent device type.
+A template for a front-facing pass-through port that will be created on all instantiations of the parent device type. Front ports may have a physical type assigned, and must be associated with a corresponding rear port and position. This association will be automatically replicated when the device type is instantiated.

docs/models/dcim/interface.md

@@ -1,9 +1,12 @@
 ## Interfaces
 
-Interfaces connect to one another in a symmetric manner: If interface A connects to interface B, interface B therefore connects to interface A. Each type of connection can be classified as either *planned* or *connected*.
+Interfaces in NetBox represent network interfaces used to exchange data with connected devices. On modern networks, these are most commonly Ethernet, but other types are supported as well. Each interface must be assigned a type, and may optionally be assigned a MAC address, MTU, and IEEE 802.1Q mode (tagged or access). Each interface can also be enabled or disabled, and optionally designated as management-only (for out-of-band management).
 
-Each interface is a assigned a type denoting its physical properties. Two special types exist: the "virtual" type can be used to designate logical interfaces (such as SVIs), and the "LAG" type can be used to desinate link aggregation groups to which physical interfaces can be assigned.
+Interfaces may be physical or virtual in nature, but only physical interfaces may be connected via cables. Cables can connect interfaces to pass-through ports, circuit terminations, or other interfaces.
 
-Each interface can also be enabled or disabled, and optionally designated as management-only (for out-of-band management). Fields are also provided to store an interface's MTU and MAC address.
+Physical interfaces may be arranged into a link aggregation group (LAG) and associated with a parent LAG (virtual) interface. LAG interfaces can be recursively nested to model bonding of trunk groups. Like all virtual interfaces, LAG interfaces cannot be connected physically.
 
-VLANs can be assigned to each interface as either tagged or untagged. (An interface may have only one untagged VLAN.)
+IP addresses can be assigned to interfaces. VLANs can also be assigned to each interface as either tagged or untagged. (An interface may have only one untagged VLAN.)
+
+!!! note
+    Although devices and virtual machines both can have interfaces, a separate model is used for each. Thus, device interfaces have some properties that are not present on virtual machine interfaces and vice versa.

docs/models/dcim/interfacetemplate.md

@@ -1,3 +1,3 @@
 ## Interface Templates
 
-A template for an interface that will be created on all instantiations of the parent device type.
+A template for a network interface that will be created on all instantiations of the parent device type. Each interface may be assigned a physical or virtual type, and may be designated as "management-only."

docs/models/dcim/inventoryitem.md

@@ -1,3 +1,7 @@
 # Inventory Items
 
-Inventory items represent hardware components installed within a device, such as a power supply or CPU or line card. Currently, these are used merely for inventory tracking, although future development might see their functionality expand. Like device types, each item can optionally be assigned a manufacturer.
+Inventory items represent hardware components installed within a device, such as a power supply or CPU or line card. Inventory items are distinct from other device components in that they cannot be templatized on a device type, and cannot be connected by cables. They are intended to be used primarily for inventory purposes.
+
+Each inventory item can be assigned a manufacturer, part ID, serial number, and asset tag (all optional). A boolean toggle is also provided to indicate whether each item was entered manually or discovered automatically (by some process outside of NetBox).
+
+Inventory items are hierarchical in nature, such that any individual item may be designated as the parent for other items. For example, an inventory item might be created to represent a line card which houses several SFP optics, each of which exists as a child item within the device.

docs/models/dcim/manufacturer.md

@@ -1,3 +1,3 @@
 # Manufacturers
 
-Each device type must be assigned to a manufacturer. The model number of a device type must be unique to its manufacturer.
+A manufacturer represents the "make" of a device; e.g. Cisco or Dell. Each device type must be assigned to a manufacturer. (Inventory items and platforms may also be associated with manufacturers.) Each manufacturer must have a unique name and may have a description assigned to it.

docs/models/dcim/platform.md

@@ -1,7 +1,9 @@
 # Platforms
 
-A platform defines the type of software running on a device or virtual machine. This can be helpful when it is necessary to distinguish between, for instance, different feature sets. Note that two devices of the same type may be assigned different platforms: for example, one Juniper MX240 running Junos 14 and another running Junos 15.
+A platform defines the type of software running on a device or virtual machine. This can be helpful to model when it is necessary to distinguish between different versions or feature sets. Note that two devices of the same type may be assigned different platforms: For example, one Juniper MX240 might run Junos 14 while another runs Junos 15.
 
-The platform model is also used to indicate which [NAPALM](https://napalm-automation.net/) driver NetBox should use when connecting to a remote device. The name of the driver along with optional parameters are stored with the platform.
+Platforms may optionally be limited by manufacturer: If a platform is assigned to a particular manufacturer, it can only be assigned to devices with a type belonging to that manufacturer.
+
+The platform model is also used to indicate which [NAPALM](https://napalm-automation.net/) driver and any associated arguments NetBox should use when connecting to a remote device. The name of the driver along with optional parameters are stored with the platform.
 
 The assignment of platforms to devices is an optional feature, and may be disregarded if not desired.

docs/models/dcim/powerfeed.md

@@ -1,8 +1,21 @@
 # Power Feed
 
-A power feed identifies the power outlet/drop that goes to a rack and is terminated to a power panel. Power feeds have a supply type (AC/DC), voltage, amperage, and phase type (single/three).
+A power feed represents the distribution of power from a power panel to a particular device, typically a power distribution unit (PDU). The power pot (inlet) on a device can be connected via a cable to a power feed. A power feed may optionally be assigned to a rack to allow more easily tracking the distribution of power among racks.
 
-Power feeds are optionally assigned to a rack. In addition, a power port – and only one – can connect to a power feed; in the context of a PDU, the power feed is analogous to the power outlet that a PDU's power port/inlet connects to.
+Each power feed is assigned an operational type (primary or redundant) and one of the following statuses:
+
+* Offline
+* Active
+* Planned
+* Failed
+
+Each power feed also defines the electrical characteristics of the circuit which it represents. These include the following:
+
+* Supply type (AC or DC)
+* Phase (single or three-phase)
+* Voltage
+* Amperage
+* Maximum utilization (percentage)
 
 !!! info
-    The power usage of a rack is calculated when a power feed (or multiple) is assigned to that rack and connected to a power port.
+    The power utilization of a rack is calculated when one or more power feeds are assigned to the rack and connected to devices that draw power.

docs/models/dcim/poweroutlet.md

@@ -1,3 +1,7 @@
 ## Power Outlets
 
-Power outlets represent the ports on a PDU that supply power to other devices. Power outlets are downstream-facing towards power ports. A power outlet can be associated with a power port on the same device and a feed leg (i.e. in a case of a three-phase supply). This indicates which power port supplies power to a power outlet.
+Power outlets represent the outlets on a power distribution unit (PDU) or other device that supply power to dependent devices. Each power port may be assigned a physical type, and may be associated with a specific feed leg (where three-phase power is used) and/or a specific upstream power port. This association can be used to model the distribution of power within a device.
+
+For example, imagine a PDU with one power port which draws from a three-phase feed and 48 power outlets arranged into three banks of 16 outlets each. Outlets 1-16 would be associated with leg A on the port, and outlets 17-32 and 33-48 would be associated with legs B and C, respectively.
+
+Cables can connect power outlets only to downstream power ports. (Pass-through ports cannot be used to model power distribution.)

docs/models/dcim/poweroutlettemplate.md

@@ -1,3 +1,3 @@
 ## Power Outlet Templates
 
-A template for a power outlet that will be created on all instantiations of the parent device type.
+A template for a power outlet that will be created on all instantiations of the parent device type. Each power outlet can be assigned a physical type, and its power source may be mapped to a specific feed leg and power port template. This association will be automatically replicated when the device type is instantiated.

docs/models/dcim/powerpanel.md

@@ -1,3 +1,8 @@
 # Power Panel
 
-A power panel represents the distribution board where power circuits – and their circuit breakers – terminate on. If you have multiple power panels in your data center, you should model them as such in NetBox to assist you in determining the redundancy of your power allocation.
+A power panel represents the origin point in NetBox for electrical power being disseminated by one or more power feeds. In a data center environment, one power panel often serves a group of racks, with an individual power feed extending to each rack, though this is not always the case. It is common to have two sets of panels and feeds arranged in parallel to provide redundant power to each rack.
+
+Each power panel must be assigned to a site, and may optionally be assigned to a particular rack group.
+
+!!! note
+    NetBox does not model the mechanism by which power is delivered to a power panel. Power panels define the root level of the power distribution hierarchy in NetBox.

docs/models/dcim/powerport.md

@@ -1,6 +1,8 @@
 ## Power Ports
 
-A power port is the inlet of a device where it draws its power. Power ports are upstream-facing towards power outlets. Alternatively, a power port can connect to a power feed – as mentioned in the power feed section – to indicate the power source of a PDU's inlet.
+A power port represents the inlet of a device where it draws its power, i.e. the connection port(s) on a device's power supply. Each power port may be assigned a physical type, as well as allocated and maximum draw values (in watts). These values can be used to calculate the overall utilization of an upstream power feed.
 
 !!! info
-    If the draw of a power port is left empty, it will be dynamically calculated based on the power outlets associated with that power port. This is usually the case on the power ports of devices that supply power, like a PDU.
+    When creating a power port on a device which supplies power to downstream devices, the allocated and maximum draw numbers should be left blank. Utilization will be calculated by taking the sum of all power ports of devices connected downstream.
+
+Cables can connect power ports only to power outlets or power feeds. (Pass-through ports cannot be used to model power distribution.)

docs/models/dcim/powerporttemplate.md

@@ -1,3 +1,3 @@
 ## Power Port Templates
 
-A template for a power port that will be created on all instantiations of the parent device type.
+A template for a power port that will be created on all instantiations of the parent device type. Each power port can be assigned a physical type, as well as a maximum and allocated draw in watts.

docs/models/dcim/rack.md

@@ -1,8 +1,10 @@
 # Racks
 
-The rack model represents a physical two- or four-post equipment rack in which equipment is mounted. Each rack must be assigned to a site. Rack height is measured in *rack units* (U); racks are commonly between 42U and 48U tall, but NetBox allows you to define racks of arbitrary height. A toggle is provided to indicate whether rack units are in ascending or descending order.
+The rack model represents a physical two- or four-post equipment rack in which devices can be installed. Each rack must be assigned to a site, and may optionally be assigned to a rack group and/or tenant. Racks can also be organized by user-defined functional roles.
 
-Each rack is assigned a name and (optionally) a separate facility ID. This is helpful when leasing space in a data center your organization does not own: The facility will often assign a seemingly arbitrary ID to a rack (for example, "M204.313") whereas internally you refer to is simply as "R113." A unique serial number may also be associated with each rack.
+Rack height is measured in *rack units* (U); racks are commonly between 42U and 48U tall, but NetBox allows you to define racks of arbitrary height. A toggle is provided to indicate whether rack units are in ascending (from the ground up) or descending order.
+
+Each rack is assigned a name and (optionally) a separate facility ID. This is helpful when leasing space in a data center your organization does not own: The facility will often assign a seemingly arbitrary ID to a rack (for example, "M204.313") whereas internally you refer to is simply as "R113." A unique serial number and asset tag may also be associated with each rack.
 
 A rack must be designated as one of the following types:
 
@@ -12,4 +14,12 @@ A rack must be designated as one of the following types:
 * Wall-mounted frame
 * Wall-mounted cabinet
 
-Each rack has two faces (front and rear) on which devices can be mounted. Rail-to-rail width may be 19 or 23 inches.
+Similarly, each rack must be assigned an operational status, which is one of the following:
+
+* Reserved
+* Available
+* Planned
+* Active
+* Deprecated
+
+Each rack has two faces (front and rear) on which devices can be mounted. Rail-to-rail width may be 10, 19, 21, or 23 inches. The outer width and depth of a rack or cabinet can also be annotated in millimeters or inches.

docs/models/dcim/rackgroup.md

@@ -1,7 +1,7 @@
 # Rack Groups
 
-Racks can be arranged into groups. As with sites, how you choose to designate rack groups will depend on the nature of your organization. For example, if each site represents a campus, each group might represent a building within a campus. If each site represents a building, each rack group might equate to a floor or room.
+Racks can be organized into groups, which can be nested into themselves similar to regions. As with sites, how you choose to designate rack groups will depend on the nature of your organization. For example, if each site represents a campus, each group might represent a building within a campus. If each site represents a building, each rack group might equate to a floor or room.
 
-Each rack group must be assigned to a parent site. Hierarchical recursion of rack groups is not currently supported.
+Each rack group must be assigned to a parent site, and rack groups may optionally be nested within a site to model a multi-level hierarchy. For example, you might have a tier of rooms beneath a tier of floors, all belonging to the same parent building (site).
 
 The name and facility ID of each rack within a group must be unique. (Racks not assigned to the same rack group may have identical names and/or facility IDs.)

docs/models/dcim/rackreservation.md

@@ -1,3 +1,3 @@
 # Rack Reservations
 
-Users can reserve units within a rack for future use. Multiple non-contiguous rack units can be associated with a single reservation (but reservations cannot span multiple racks). A rack reservation may optionally designate a specific tenant.
+Users can reserve specific units within a rack for future use. An arbitrary set of units within a rack can be associated with a single reservation, but reservations cannot span multiple racks. A description is required for each reservation, reservations may optionally be associated with a specific tenant.

docs/models/dcim/rackrole.md

@@ -1,3 +1,3 @@
 # Rack Roles
 
-Each rack can optionally be assigned a functional role. For example, you might designate a rack for compute or storage resources, or to house colocated customer devices. Rack roles are fully customizable.
+Each rack can optionally be assigned a user-defined functional role. For example, you might designate a rack for compute or storage resources, or to house colocated customer devices. Rack roles are fully customizable and may be color-coded.

docs/models/dcim/rearport.md

@@ -1,5 +1,6 @@
 ## Rear Ports
 
-Like front ports, rear ports are pass-through ports which represent the end of a particular cable segment in a path. Each rear port is defined with a number of positions: rear ports with more than one position can be mapped to multiple front ports. This can be useful for modeling instances where multiple paths share a common cable (for example, six different fiber connections sharing a 12-strand MPO cable).
+Like front ports, rear ports are pass-through ports which represent the continuation of a path from one cable to the next. Each rear port is defined with its physical type and a number of positions: Rear ports with more than one position can be mapped to multiple front ports. This can be useful for modeling instances where multiple paths share a common cable (for example, six discrete two-strand fiber connections sharing a 12-strand MPO cable).
 
-Note that front and rear ports need not necessarily reside on the actual front or rear device face. This terminology is used primarily to distinguish between the two components in a pass-through port pairing.
+!!! note
+    Front and rear ports need not necessarily reside on the actual front or rear device face. This terminology is used primarily to distinguish between the two components in a pass-through port pairing.

docs/models/dcim/rearporttemplate.md

@@ -1,3 +1,3 @@
 ## Rear Port Templates
 
-A template for a rear-facing pass-through port that will be created on all instantiations of the parent device type.
+A template for a rear-facing pass-through port that will be created on all instantiations of the parent device type. Each rear port may have a physical type and one or more front port templates assigned to it. The number of positions associated with a rear port determines how many front ports can be assigned to it (the maximum is 1024).

docs/models/dcim/site.md

@@ -1,13 +1,15 @@
 # Sites
 
-How you choose to use sites will depend on the nature of your organization, but typically a site will equate to a building or campus. For example, a chain of banks might create a site to represent each of its branches, a site for its corporate headquarters, and two additional sites for its presence in two colocation facilities.
+How you choose to employ sites when modeling your network may vary depending on the nature of your organization, but generally a site will equate to a building or campus. For example, a chain of banks might create a site to represent each of its branches, a site for its corporate headquarters, and two additional sites for its presence in two colocation facilities.
 
-Each site must be assigned one of the following operational statuses:
+Each site must be assigned a unique name and may optionally be assigned to a region and/or tenant. The following operational statuses are available:
 
-* Active
 * Planned
+* Staging
+* Active
+* Decommissioning
 * Retired
 
-The site model provides a facility ID field which can be used to annotate a facility ID (such as a datacenter name) associated with the site. Each site may also have an autonomous system (AS) number and time zone associated with it. (Time zones are provided by the [pytz](https://pypi.org/project/pytz/) package.)
+The site model also provides a facility ID field which can be used to annotate a facility ID (such as a datacenter name) associated with the site. Each site may also have an autonomous system (AS) number and time zone associated with it. (Time zones are provided by the [pytz](https://pypi.org/project/pytz/) package.)
 
-The site model also includes several fields for storing contact and address information.
+The site model also includes several fields for storing contact and address information as well as geolocation data (GPS coordinates).

docs/models/dcim/virtualchassis.md

@@ -1,5 +1,8 @@
 # Virtual Chassis
 
-A virtual chassis represents a set of devices which share a single control plane: a stack of switches which are managed as a single device, for example. Each device in the virtual chassis is assigned a position and (optionally) a priority. Exactly one device is designated the virtual chassis master: This device will typically be assigned a name, secrets, services, and other attributes related to its management.
+A virtual chassis represents a set of devices which share a common control plane. A common example of this is a stack of switches which are connected and configured to operate as a single device. A virtual chassis must be assigned a name and may be assigned a domain.
 
-It's important to recognize the distinction between a virtual chassis and a chassis-based device. For instance, a virtual chassis is not used to model a chassis switch with removable line cards such as the Juniper EX9208, as its line cards are _not_ physically separate devices capable of operating independently.
+Each device in the virtual chassis is referred to as a VC member, and assigned a position and (optionally) a priority. VC member devices commonly reside within the same rack, though this is not a requirement. One of the devices may be designated as the VC master: This device will typically be assigned a name, secrets, services, and other attributes related to managing the VC.
+
+!!! note
+    It's important to recognize the distinction between a virtual chassis and a chassis-based device. A virtual chassis is **not** suitable for modeling a chassis-based switch with removable line cards (such as the Juniper EX9208), as its line cards are _not_ physically autonomous devices.

docs/models/extras/configcontext.md

@@ -1,5 +1,65 @@
 # Configuration Contexts
 
-Sometimes it is desirable to associate arbitrary data with a group of devices to aid in their configuration. For example, you might want to associate a set of syslog servers for all devices at a particular site. Context data enables the association of arbitrary data to devices and virtual machines grouped by region, site, role, platform, and/or tenant. Context data is arranged hierarchically, so that data with a higher weight can be entered to override more general lower-weight data. Multiple instances of data are automatically merged by NetBox to present a single dictionary for each object.
+Sometimes it is desirable to associate additional data with a group of devices or virtual machines to aid in automated configuration. For example, you might want to associate a set of syslog servers for all devices within a particular region. Context data enables the association of extra user-defined data with devices and virtual machines grouped by one or more of the following assignments:
 
-Devices and Virtual Machines may also have a local config context defined. This local context will always overwrite the rendered config context objects for the Device/VM. This is useful in situations were the device requires a one-off value different from the rest of the environment.
+* Region
+* Site
+* Role
+* Platform
+* Cluster group
+* Cluster
+* Tenant group
+* Tenant
+* Tag
+
+## Hierarchical Rendering
+
+Context data is arranged hierarchically, so that data with a higher weight can be entered to override lower-weight data. Multiple instances of data are automatically merged by NetBox to present a single dictionary for each object.
+
+For example, suppose we want to specify a set of syslog and NTP servers for all devices within a region. We could create a config context instance with a weight of 1000 assigned to the region, with the following JSON data:
+
+```json
+{
+    "ntp-servers": [
+        "172.16.10.22",
+        "172.16.10.33"
+    ],
+    "syslog-servers": [
+        "172.16.9.100",
+        "172.16.9.101"
+    ]
+}
+```
+
+But suppose there's a problem at one particular site within this region preventing traffic from reaching the regional syslog server. Devices there need to use a local syslog server instead of the two defined above. We'll create a second config context assigned only to that site with a weight of 2000 and the following data:
+
+```json
+{
+    "syslog-servers": [
+        "192.168.43.107"
+    ]
+}
+```
+
+When the context data for a device at this site is rendered, the second, higher-weight data overwrite the first, resulting in the following:
+
+```json
+{
+    "ntp-servers": [
+        "172.16.10.22",
+        "172.16.10.33"
+    ],
+    "syslog-servers": [
+        "192.168.43.107"
+    ]
+}
+```
+
+Data from the higher-weight context overwrites conflicting data from the lower-weight context, while the non-conflicting portion of the lower-weight context (the list of NTP servers) is preserved.
+
+## Local Context Data
+
+Devices and virtual machines may also have a local config context defined. This local context will _always_ take precedence over any separate config context objects which apply to the device/VM. This is useful in situations where we need to call out a specific deviation in the data for a particular object.
+
+!!! warning
+    If you find that you're routinely defining local context data for many individual devices or virtual machines, custom fields may offer a more effective solution.

docs/models/extras/imageattachment.md

@@ -0,0 +1,3 @@
+# Image Attachments
+
+Certain objects in NetBox support the attachment of uploaded images. These will be saved to the NetBox server and made available whenever the object is viewed.

docs/models/extras/tag.md

@@ -1,24 +1,20 @@
 # Tags
 
-Tags are free-form text labels which can be applied to a variety of objects within NetBox. Tags are created on-demand as they are assigned to objects. Use commas to separate tags when adding multiple tags to an object (for example: `Inventoried, Monitored`). Use double quotes around a multi-word tag when adding only one tag, e.g. `"Core Switch"`.
+Tags are user-defined labels which can be applied to a variety of objects within NetBox. They can be used to establish dimensions of organization beyond the relationships built into NetBox. For example, you might create a tag to identify a particular ownership or condition across several types of objects.
 
-Each tag has a label and a URL-friendly slug. For example, the slug for a tag named "Dunder Mifflin, Inc." would be `dunder-mifflin-inc`. The slug is generated automatically and makes tags easier to work with as URL parameters.
+Each tag has a label, color, and a URL-friendly slug. For example, the slug for a tag named "Dunder Mifflin, Inc." would be `dunder-mifflin-inc`. The slug is generated automatically and makes tags easier to work with as URL parameters. Each tag can also be assigned a description indicating its purpose.
 
 Objects can be filtered by the tags they have applied. For example, the following API request will retrieve all devices tagged as "monitored":
 
-```
+```no-highlight
 GET /api/dcim/devices/?tag=monitored
 ```
 
-Tags are included in the API representation of an object as a list of plain strings:
+The `tag` filter can be specified multiple times to match only objects which have _all_ of the specified tags assigned:
 
+```no-highlight
+GET /api/dcim/devices/?tag=monitored&tag=deprecated
 ```
-{
-    ...
-    "tags": [
-        "Core Switch",
-        "Monitored"
-    ],
-    ...
-}
-```
+
+!!! note
+    Tags have changed substantially in NetBox v2.9. They are no longer created on-demand when editing an object, and their representation in the REST API now includes a complete depiction of the tag rather than only its label.

docs/models/ipam/aggregate.md

@@ -1,6 +1,18 @@
 # Aggregates
 
-The first step to documenting your IP space is to define its scope by creating aggregates. Aggregates establish the root of your IP address hierarchy by defining the top-level allocations that you're interested in managing. Most organizations will want to track some commonly-used private IP spaces, such as:
+IP addressing is by nature hierarchical. The first few levels of the IPv4 hierarchy, for example, look like this:
+
+* 0.0.0.0/0
+    * 0.0.0.0/1
+        * 0.0.0.0/2
+        * 64.0.0.0/2
+    * 128.0.0.0/1
+        * 128.0.0.0/2
+        * 192.0.0.0/2
+
+This hierarchy comprises 33 tiers of addressing, from /0 all the way down to individual /32 address (and much, much further to /128 for IPv6). Of course, most organizations are concerned with only relatively small portions of the total IP space, so tracking the uppermost of these tiers isn't necessary.
+
+NetBox allows us to specify the portions of IP space that are interesting to us by defining _aggregates_. Typically, an aggregate will correspond to either an allocation of public (globally routable) IP space granted by a regional authority, or a private (internally-routable) designation. Common private designations include:
 
 * 10.0.0.0/8 (RFC 1918)
 * 100.64.0.0/10 (RFC 6598)
@@ -8,8 +20,9 @@ The first step to documenting your IP space is to define its scope by creating a
 * 192.168.0.0/16 (RFC 1918)
 * One or more /48s within fd00::/8 (IPv6 unique local addressing)
 
-In addition to one or more of these, you'll want to create an aggregate for each globally-routable space your organization has been allocated. These aggregates should match the allocations recorded in public WHOIS databases.
+Each aggregate is assigned to a RIR. For "public" aggregates, this will be the real-world authority which has granted your organization permission to use the specified IP space on the public Internet. For "private" aggregates, this will be a statutory authority, such as RFC 1918. Each aggregate can also annotate that date on which it was allocated, where applicable.
 
-Each IP prefix will be automatically arranged under its parent aggregate if one exists. Note that it's advised to create aggregates only for IP ranges actually allocated to your organization (or marked for private use): There is no need to define aggregates for provider-assigned space which is only used on Internet circuits, for example.
+Prefixes are automatically arranged beneath their parent aggregates in NetBox. Typically you'll want to create aggregates only for the prefixes and IP addresses that your organization actually manages: There is no need to define aggregates for provider-assigned space which is only used on Internet circuits, for example.
 
-Aggregates cannot overlap with one another: They can only exist side-by-side. For instance, you cannot define both 10.0.0.0/8 and 10.16.0.0/16 as aggregates, because they overlap. 10.16.0.0/16 in this example would be created as a prefix and automatically grouped under 10.0.0.0/8. Remember, the purpose of aggregates is to establish the root of your IP addressing hierarchy.
+!!! note
+    Because aggregates represent swaths of the global IP space, they cannot overlap with one another: They can only exist side-by-side. For instance, you cannot define both 10.0.0.0/8 and 10.16.0.0/16 as aggregates, because they overlap. 10.16.0.0/16 in this example would be created as a container prefix and automatically grouped under the 10.0.0.0/8 aggregate. Remember, the purpose of aggregates is to establish the root of your IP addressing hierarchy.

docs/models/ipam/ipaddress.md

@@ -2,16 +2,17 @@
 
 An IP address comprises a single host address (either IPv4 or IPv6) and its subnet mask. Its mask should match exactly how the IP address is configured on an interface in the real world.
 
-Like prefixes, an IP address can optionally be assigned to a VRF (otherwise, it will appear in the "global" table). IP addresses are automatically organized under parent prefixes within their respective VRFs.
+Like a prefix, an IP address can optionally be assigned to a VRF (otherwise, it will appear in the "global" table). IP addresses are automatically arranged under parent prefixes within their respective VRFs according to the IP hierarchy.
 
-Also like prefixes, each IP address can be assigned a status and a role. Statuses are hard-coded in NetBox and include the following:
+Each IP address can also be assigned an operational status and a functional role. Statuses are hard-coded in NetBox and include the following:
 
 * Active
 * Reserved
 * Deprecated
 * DHCP
+* SLAAC (IPv6 Stateless Address Autoconfiguration)
 
-Each IP address can optionally be assigned a special role. Roles are used to indicate some special attribute of an IP address: for example, it is used as a loopback, or is a virtual IP maintained using VRRP. (Note that this differs in purpose from a _functional_ role, and thus cannot be customized.) Available roles include:
+Roles are used to indicate some special attribute of an IP address; for example, use as a loopback or as the the virtual IP for a VRRP group. (Note that functional roles are conceptual in nature, and thus cannot be customized by the user.) Available roles include:
 
 * Loopback
 * Secondary
@@ -21,7 +22,10 @@ Each IP address can optionally be assigned a special role. Roles are used to ind
 * HSRP
 * GLBP
 
-An IP address can be assigned to a device or virtual machine interface, and an interface may have multiple IP addresses assigned to it. Further, each device and virtual machine may have one of its interface IPs designated as its primary IP address (one for IPv4 and one for IPv6).
+An IP address can be assigned to any device or virtual machine interface, and an interface may have multiple IP addresses assigned to it. Further, each device and virtual machine may have one of its interface IPs designated as its primary IP per address family (one for IPv4 and one for IPv6).
+
+!!! note
+    When primary IPs are set for both IPv4 and IPv6, NetBox will prefer IPv6. This can be changed by setting the `PREFER_IPV4` configuration parameter.
 
 ## Network Address Translation (NAT)
 

docs/models/ipam/prefix.md

@@ -2,7 +2,7 @@
 
 A prefix is an IPv4 or IPv6 network and mask expressed in CIDR notation (e.g. 192.0.2.0/24). A prefix entails only the "network portion" of an IP address: All bits in the address not covered by the mask must be zero. (In other words, a prefix cannot be a specific IP address.)
 
-Prefixes are automatically arranged by their parent aggregates. Additionally, each prefix can be assigned to a particular site and VRF (routing table). All prefixes not assigned to a VRF will appear in the "global" table.
+Prefixes are automatically organized by their parent aggregates. Additionally, each prefix can be assigned to a particular site and virtual routing and forwarding instance (VRF). Each VRF represents a separate IP space or routing table. All prefixes not assigned to a VRF are considered to be in the "global" table.
 
 Each prefix can be assigned a status and a role. These terms are often used interchangeably so it's important to recognize the difference between them. The **status** defines a prefix's operational state. Statuses are hard-coded in NetBox and can be one of the following:
 
@@ -13,6 +13,6 @@ Each prefix can be assigned a status and a role. These terms are often used inte
 
 On the other hand, a prefix's **role** defines its function. Role assignment is optional and roles are fully customizable. For example, you might create roles to differentiate between production and development infrastructure.
 
-A prefix may also be assigned to a VLAN. This association is helpful for identifying which prefixes are included when reviewing a list of VLANs.
+A prefix may also be assigned to a VLAN. This association is helpful for associating address space with layer two domains. A VLAN may have multiple prefixes assigned to it.
 
-The prefix model include a "pool" flag. If enabled, NetBox will treat this prefix as a range (such as a NAT pool) wherein every IP address is valid and assignable. This logic is used for identifying available IP addresses within a prefix. If this flag is disabled, NetBox will assume that the first and last (broadcast) address within the prefix are unusable.
+The prefix model include an "is pool" flag. If enabled, NetBox will treat this prefix as a range (such as a NAT pool) wherein every IP address is valid and assignable. This logic is used when identifying available IP addresses within a prefix. If this flag is disabled, NetBox will assume that the first and last (broadcast) address within an IPv4 prefix are unusable.

docs/models/ipam/rir.md

@@ -1,7 +1,7 @@
 # Regional Internet Registries (RIRs)
 
-[Regional Internet registries](https://en.wikipedia.org/wiki/Regional_Internet_registry) are responsible for the allocation of globally-routable address space. The five RIRs are ARIN, RIPE, APNIC, LACNIC, and AFRINIC. However, some address space has been set aside for internal use, such as defined in RFCs 1918 and 6598. NetBox considers these RFCs as a sort of RIR as well; that is, an authority which "owns" certain address space. There also exist lower-tier registries which serve a particular geographic area.
+[Regional Internet registries](https://en.wikipedia.org/wiki/Regional_Internet_registry) are responsible for the allocation of globally-routable address space. The five RIRs are ARIN, RIPE, APNIC, LACNIC, and AFRINIC. However, some address space has been set aside for internal use, such as defined in RFCs 1918 and 6598. NetBox considers these RFCs as a sort of RIR as well; that is, an authority which "owns" certain address space. There also exist lower-tier registries which serve particular geographic areas.
 
-Each aggregate must be assigned to one RIR. You are free to define whichever RIRs you choose (or create your own). The RIR model includes a boolean flag which indicates whether the RIR allocates only private IP space.
+Users can create whatever RIRs they like, but each aggregate must be assigned to one RIR. The RIR model includes a boolean flag which indicates whether the RIR allocates only private IP space.
 
-For example, suppose your organization has been allocated 104.131.0.0/16 by ARIN. It also makes use of RFC 1918 addressing internally. You would first create RIRs named ARIN and RFC 1918, then create an aggregate for each of these top-level prefixes, assigning it to its respective RIR.
+For example, suppose your organization has been allocated 104.131.0.0/16 by ARIN. It also makes use of RFC 1918 addressing internally. You would first create RIRs named "ARIN" and "RFC 1918," then create an aggregate for each of these top-level prefixes, assigning it to its respective RIR.

docs/models/ipam/vlan.md

@@ -1,6 +1,6 @@
 # VLANs
 
-A VLAN represents an isolated layer two domain, identified by a name and a numeric ID (1-4094) as defined in [IEEE 802.1Q](https://en.wikipedia.org/wiki/IEEE_802.1Q). Each VLAN may be assigned to a site and/or VLAN group.
+A VLAN represents an isolated layer two domain, identified by a name and a numeric ID (1-4094) as defined in [IEEE 802.1Q](https://en.wikipedia.org/wiki/IEEE_802.1Q). Each VLAN may be assigned to a site, tenant, and/or VLAN group.
 
 Each VLAN must be assigned one of the following operational statuses:
 
@@ -8,4 +8,4 @@ Each VLAN must be assigned one of the following operational statuses:
 * Reserved
 * Deprecated
 
-Each VLAN may also be assigned a functional role. Prefixes and VLANs share the same set of customizable roles.
+As with prefixes, each VLAN may also be assigned a functional role. Prefixes and VLANs share the same set of customizable roles.