Skip to content

Admin settings

Administrators configure Factum from Admin. Most runtime settings live in the database (this UI), not in /etc/factum2/factum2.yaml. The YAML file is process config: database URL, bind address, JWT secret, worker TLS. After install, you almost never edit YAML to turn NetBox or DNS on.

Settings → Factum

Feature switches (all off by default except as noted):

  • Organization — customers, contacts, and hierarchical sites
  • Optical / WDM modeling — ROADM/transponder inventory, paths, maintenance impact
  • IP address management — namespaces, VRFs, prefixes
  • DNS zone editor — zones, DNS templates, SOA templates, DNSSEC policies. Distinct from Admin → Destinations → DNS (device-record sync).
  • Software repository — NOS images for routers and switches (Software). Files live on the factum2-storage host.

Also set the API token (service-to-service, not a user password), default domain (used when matching short device names to FQDNs), public URL (absolute links in email — set this to the HTTPS origin when factum2-web sits behind a reverse proxy), optional header branding (logo and text shown to the right of the Factum wordmark; AbundoPortal can show the same values), and how many finished jobs housekeeping keeps. Unfinished jobs are never deleted.

The Email tab is SMTP for password reset and similar. Send a test message from that tab after filling the host.

Dashboard (under Settings) is the shortcut links on the home page: name, URL, group, optional icon.

Sources

Enable and credential BECS, NetBox, and Lime under Admin → Sources. NetBox also has a webhook secret (HMAC on POST /api/netbox-webhook) and options to sync Factum customers to NetBox tenants and Factum contacts to NetBox contacts (assigned onto the matching tenant when that tenant exists).

A source that is disabled is skipped by jobs. Credentials are used by the corresponding sync tool, which may run on the primary (NetBox/Lime/BECS talk to Postgres) rather than a remote worker.

Destinations

DNS, DHCP, Icinga, LibreNMS, Oxidized, Prometheus, and Certificates each have an enabled flag under Admin → Destinations. DNS, Icinga, LibreNMS, Oxidized, and Prometheus also have a destination file or API URL, and ignore lists (newline-separated). Destinations → DNS also has the path of the dnsmgr2 zone include written when the zone editor is on. BIND paths, sqlite serial DB, and host templates live in the administrator-managed dnsmgr2.yaml. Destinations → DHCP is DHCP server management: per-prefix DHCP in IPAM, the MAC column on DNS zone records, default DNS servers for DHCP clients, and the path of the dnsmgr2 prefix include. Kea paths and host templates live in the administrator-managed dnsmgr2.yaml. LibreNMS delayed delete lives under Destinations → LibreNMS. Oxidized API URL is what the GUI Oxidized browser uses; it must be reachable from factum2-web.

Destinations → Certificates is ACME / lego: YAML and dotenv paths, lego binary, default key type and Common Name. Sync writes those files and runs lego; it does not install certificates on hosts.

These tools normally run on the destination host, talking back through a worker — not by opening Postgres from that host.

Worker nodes

Who the primary dials for hub transport: name, host:port, shared token, optional TLS CA (paste the worker's hub.crt), skip-verify, enabled. Edits take effect within about ten seconds. Address SAN must match the certificate; there is no ws:// fallback. This page only registers who to dial; the worker binary, TLS cert, and worker.commands allowlist are configured on the worker host.

Device sync

Credentials and options for factum2-device-sync (read on-device services into NetBox/Factum). GUI device I/O uses the same credentials (per-device override, or the default row): service push, delete-from-device, unrealize, Config-tree rebind, interface refresh/update, and VLAN push.

AAA

  • Users / Roles — local accounts; admin cannot be deleted
  • Authentication — local and LDAP (AD or generic), bind mode, TLS
  • Authorization — map LDAP group DNs to Factum roles, plus a default role for users who match no group