Device configuration example (Huawei):
hwtacacs-server template nb
hwtacacs-server authentication <this-server-ip>
hwtacacs-server shared-key cipher <secret>

Devices keep the server they came from; the dashboard Sync button can sync one server or all at once.

The connection method (telnet/SSH) now lives on each script binding — see Devices → Scripts → Bindings, or override it per device with its Config button.

Create a bot with @BotFather, then message the bot (or add it to a group) and use @userinfobot / getUpdates to find the chat ID.

Uploads every 7z archive created since the last successful upload. Minimal IAM policy: s3:PutObject + s3:ListBucket on the bucket.

Uses DNS-01 (no port 80 needed). Host must have: apt install -y certbot python3-certbot-dns-cloudflare. Checked weekly (Mon 05:00); certbot renews inside 30 days of expiry and reloads nginx.

Share the target Drive folder with the service account's e-mail address, then paste the folder ID from its URL.

Used by any group that doesn't choose its own. Pick as many as you like.

"auto" uses cores × sessions-per-core. Telnet/SSH is I/O-bound, so 2–4 per core is usually safe and much faster.

When on, every account must enroll an authenticator at first login, and users cannot disable their own 2FA. Lost phone → admin uses "Reset 2FA" on the Users page. If the only admin is locked out: docker compose exec backend python -m app.rescue admin

Point devices here, e.g. on Huawei VRP:
info-center enable
info-center loghost <server-ip> facility local4
info-center source default channel 2 log level warning
Port changes need a container restart. Open the port in the Firewall page for your device networks.

Runs after each backup cycle (daily backstop at 04:30). 7z archives never uploaded to S3 follow the local-days rule instead, so nothing is deleted before it could go off-site. History entries in Files/Versions remain, marked "file missing".

Session tokens are stored hashed, sent HttpOnly and marked Secure over HTTPS. Changing a password signs out that user's other sessions automatically.

Devices rewrite CRCs, digests and "last saved" timestamps on every save. Without this, each backup looks like a configuration change. Defaults cover Huawei VRP, Cisco IOS/NX-OS and JunOS.

Re-enabling a device restores the group it came from. With the second option off, a subnet rule will pull disabled devices back into a scheduled group on the next sync.

Backups and version history are always kept, even when a device row is deleted — the files stay on disk and remain browsable on the Files page.

Devices matching a CIDR are auto-assigned to the group on every sync — except the excluded IPs, which keep their manual group.

Policy precedence — evaluated in this order, higher wins:
1️⃣ Vendor config (below): a disabled vendor locks all its devices to never, everywhere.
2️⃣ Group rules (subnet conditions): applied to the remaining devices, minus each rule's exceptions.
3️⃣ Manual assignment: whatever you set per device or per batch, for devices no rule touches.
At cycle time, "Pause all" and each device's Enabled flag are still respected on top.

Unticked vendors are skipped during cycles (their devices show as skipped, no failure mails).

Your current IP: ? — include it before saving or you will be locked out (127.0.0.1 always works).

A device that never uploads is retried automatically; a shorter wait (e.g. 20s) fails unreachable devices fast instead of holding a worker for two minutes. Configuration errors — missing script, disabled vendor, bad credentials — are not retried.

Placeholders: {ip} {hostname} {ddmmyyyy} {hhmm} {date} {time}. Example result: 10.8.0.36_14082026_1400 — .zip is appended automatically for TFTP-push; the server verifies the zip, stores the extracted .cfg, then deletes the zip.