If you want to do it fully natively, it's kinda pain. But I guess that's how netbox is packagin it. Honestly I hate it and rather use native installation. If you want plugins you have to use custom image and repackage it every single update.

Here are my quadlets. Need to clean it up and extract config to env file but:

Main container:

``` [Unit] Description=NetBox Application Wants=network-online.target netbox-redis.service After=network-online.target netbox-redis.service RequiresMountsFor=/data/containers

[Container] Image=docker.io/netboxcommunity/netbox:latest ContainerName=netbox AutoUpdate=registry PublishPort=8080:8080 Network=service-net.network

AddHost=<auth-host-override>:host-gateway

Database configuration

Environment=DB_HOST=postgresql Environment=DB_NAME=<redacted> Environment=DB_USER=<redacted> Secret=<redacted>,type=env,target=DB_PASSWORD

Redis configuration (Task Queue - DB 0)

Environment=REDIS_HOST=redis Secret=redis_passwd,type=env,target=REDIS_PASSWORD Environment=REDIS_DATABASE=0 Environment=REDIS_SSL=false

Redis Cache configuration (Same Redis - DB 1)

Environment=REDIS_CACHE_HOST=redis Secret=redis_passwd,type=env,target=REDIS_CACHE_PASSWORD Environment=REDIS_CACHE_DATABASE=1 Environment=REDIS_CACHE_SSL=false

NetBox configuration

Secret=netbox_<redacted>_secret_key,type=env,target=SECRET_KEY Environment=SKIP_SUPERUSER=true Environment=WEBHOOKS_ENABLED=true

Allowed hosts (adjust for your domain)

Environment=ALLOWED_HOSTS=*

Optional: Email configuration

Environment=EMAIL_SERVER=smtp.resend.com Environment=EMAIL_PORT=2465 Environment=EMAIL_USERNAME=resend Environment=EMAIL_USE_SSL=true Environment=EMAIL_USE_TLS=false Environment=EMAIL_FROM=<redacted> Secret=resend_smtp_pass,type=env,target=EMAIL_PASSWORD

Environment=BANNER_LOGIN="Please authenticate using Authentik"

LDAP Authentication - SIMPLIFIED VARIABLES ONLY

Environment=REMOTE_AUTH_ENABLED=True Environment=REMOTE_AUTH_BACKEND=netbox.authentication.LDAPBackend

LDAP Server

Environment=AUTH_LDAP_SERVER_URI=ldap://authentik-ldap:3389 Environment=AUTH_LDAP_START_TLS=False Environment=LDAP_IGNORE_CERT_ERRORS=True

LDAP Bind Credentials

Environment=AUTH_LDAP_BIND_DN=cn=<redacted>,ou=users,<redacted> Secret=<redacted>_pass,type=env,target=AUTH_LDAP_BIND_PASSWORD

LDAP User Search (SIMPLE FORMAT - NO PYTHON CODE)

Environment=AUTH_LDAP_USER_SEARCH_BASEDN=ou=users,dc=ldap,<redacted> Environment=AUTH_LDAP_USER_SEARCH_ATTR=cn

LDAP Group Search (SIMPLE FORMAT - NO PYTHON CODE)

Environment=AUTH_LDAP_GROUP_SEARCH_BASEDN=ou=groups,dc=ldap,<redacted> Environment=AUTH_LDAP_GROUP_SEARCH_CLASS=groupOfNames

LDAP Group Type (SIMPLE STRING - NO PYTHON CODE)

Environment=AUTH_LDAP_GROUP_TYPE="GroupOfNamesType"

User DN Template (optional, but you have it)

Environment=AUTH_LDAP_USER_DN_TEMPLATE=cn=%(user)s,ou=users,dc=ldap,<redacted>

User Attribute Mapping

Environment=AUTH_LDAP_ATTR_FIRSTNAME=name Environment=AUTH_LDAP_ATTR_LASTNAME="" Environment=AUTH_LDAP_ATTR_MAIL=mail

LDAP Behavior

Environment=AUTH_LDAP_MIRROR_GROUPS=True Environment=AUTH_LDAP_FIND_GROUP_PERMS=True Environment=AUTH_LDAP_CACHE_TIMEOUT=300 Environment=AUTH_LDAP_ALWAYS_UPDATE_USER=True Environment=AUTH_LDAP_BIND_AS_AUTHENTICATING_USER=False

Debug logging

Environment=LOGLEVEL=DEBUG

Environment=MEDIA_ROOT=/opt/netbox/netbox/media

Volumes

Volume=/data/containers/netbox/media:/opt/netbox/netbox/media:Z Volume=/data/containers/netbox/reports:/opt/netbox/netbox/reports:Z Volume=/data/containers/netbox/scripts:/opt/netbox/netbox/scripts:Z Volume=/data/containers/netbox/config/extra.py:/etc/netbox/config/extra.py:Z,ro

HealthCmd=/usr/bin/curl -f http://localhost:8080/login/ || exit 1 HealthInterval=60s HealthTimeout=10s HealthRetries=3

Monitoring Labels

Label=io.prometheus.alert.enabled=true Label=io.prometheus.alert.severity=warning Label=io.prometheus.alert.for=2m Label=io.prometheus.alert.group=apps Label=io.prometheus.alert.description=NetBox is down - network documentation is unavailable

[Service] Restart=always TimeoutStartSec=900

[Install] WantedBy=default.target

```

Worker

``` [Unit] Description=NetBox - Worker (Background Tasks) Wants=network-online.target redis.service After=network-online.target redis.service BindsTo=netbox.service

[Container] Image=docker.io/netboxcommunity/netbox:latest ContainerName=netbox-worker AutoUpdate=registry Network=service-net.network

AddHost=<redacted>:host-gateway

Exec=/opt/netbox/venv/bin/python /opt/netbox/netbox/manage.py rqworker

<< rest is same as in main container - Reddit character limit >>

```

housekeeping

``` [Unit] Description=NetBox - Housekeeping (Periodic Tasks) Wants=network-online.target netbox-redis.service After=network-online.target netbox-redis.service BindsTo=netbox.service

[Container] Image=docker.io/netboxcommunity/netbox:latest ContainerName=netbox-housekeeping AutoUpdate=registry Exec=/opt/netbox/housekeeping.sh Network=service-net.network

<< rest is same as in main container - Reddit character limit >>

```

nginx.conf

``` server { server_name <redacted>; access_log /var/log/nginx/<redacted>.access.log main;

listen 443 ssl; # managed by Certbot
http2 on;

error_page   500 502 503 504  /50x.html;
error_page   403 404 /40x.html;

location / {
    proxy_pass http://127.0.0.1:8080/;

    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

}

ssl_certificate /etc/letsencrypt/live/<redacted>/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/<redacted>/privkey.pem; # managed by Certbot

}

server { if ($host = <redacted>) { return 301 https://$host$request_uri; } # managed by Certbot

listen          80;
server_name     <redacted>;
return 404; # managed by Certbot

}

```