Skip to content

Admin settings

Administrators configure Factum from Admin. Most runtime settings live in the database (this UI), not in /etc/factum2/factum2.yaml. The YAML file is process config: database URL, bind address, JWT secret, worker TLS. After install, you almost never edit YAML to turn NetBox or DNS on.

Directory

Directory is the internal LDAP tree (people, roles, and folders) and each OpenLDAP or Active Directory server. Workers with an ldap command serve the internal directory. Server connection settings are edited on the selected server. Login tries enabled servers in order and denies the client when none accepts. OpenLDAP entries can be added and changed when ldap_writeback is set in the config file. Active Directory is browse-only. admin cannot be deleted. The Authorization tab maps LDAP group DNs to Factum roles, and sets a default role for users who match no group. See Directory.

Settings → Factum

Feature switches (all off by default except as noted):

  • Organization — customers, contacts, and hierarchical sites
  • Optical / WDM modeling — ROADM/transponder inventory, paths, maintenance impact
  • IP address management — namespaces, VRFs, prefixes
  • DNS zone editor — zones, DNS templates, SOA templates, DNSSEC policies. Distinct from Admin → Destinations → DNS (device-record sync).
  • Software repository — NOS images for routers and switches (Software). The repository field is the worker.paths key storage_root. The directory is only in the storage host's factum2-worker.yaml.

Also set the API token (service-to-service, not a user password), default domain (used when matching short device names to FQDNs), public URL (absolute links in email — set this to the HTTPS origin when factum2-web sits behind a reverse proxy), optional header branding (logo and text shown to the right of the Factum wordmark; AbundoPortal can show the same values), and how many finished jobs housekeeping keeps. Unfinished jobs are never deleted.

The Email tab is SMTP for password reset and similar. Send a test message from that tab after filling the host.

Dashboard (under Settings) is the shortcut links on the home page: name, URL, group, optional icon.

Sources

Enable and credential BECS, NetBox, and Lime under Admin → Sources. Lime has a change report list: after a sync that adds, updates, or removes customers, services, or contacts, Factum emails that list. A sync with no changes does not send mail. The message uses the SMTP settings on Settings → Factum → Email.

NetBox also has a webhook secret (HMAC on POST /api/netbox-webhook) and options to sync Factum customers to NetBox tenants and Factum contacts to NetBox contacts (assigned onto the matching tenant when that tenant exists).

When NetBox is enabled, jobs show two NetBox targets. Netbox is the full inventory sync; schedule it a few times a day. Netbox changes reads the NetBox changelog since the last sync and is the one to run more often (and the one a webhook starts after a short quiet period). Sync all runs the full NetBox sync only.

A source that is disabled is skipped by jobs. Credentials are used by the corresponding sync tool, which may run on the primary (NetBox/Lime/BECS talk to Postgres) rather than a remote worker.

Destinations

DNS, DHCP, Icinga, LibreNMS, Oxidized, Prometheus, and Certificates each have an enabled flag under Admin → Destinations. DNS, Icinga, LibreNMS, Oxidized, and Prometheus also have a destination file or API URL, and ignore lists (newline-separated). A destination file field stores a worker.paths key, such as icinga_hosts_file or dns_zones_file, not a filesystem path. Each worker maps that key to a path in factum2-worker.yaml. Workers can use different paths for the same key. A blank field uses the key named for that field. One field may name another key when two outputs should share a file. Destinations → DNS also has the key of the dnsmgr2 zone include written when the zone editor is on. BIND paths, sqlite serial DB, and host templates live in the administrator-managed dnsmgr2.yaml. Destinations → DHCP is DHCP server management: per-prefix DHCP in IPAM, the MAC column on DNS zone records, default DNS servers for DHCP clients, and the key of the dnsmgr2 prefix include (dns_prefixes_file). Kea paths and host templates live in the administrator-managed dnsmgr2.yaml. LibreNMS delayed delete lives under Destinations → LibreNMS. Oxidized API URL is what the GUI Oxidized browser uses; it must be reachable from factum2-web.

Destinations → Certificates is ACME / lego: lego_yaml, lego_env, lego_bin, and lego_storage keys, plus default key type and Common Name. Sync writes the files those keys name on the worker and runs lego; it does not install certificates on hosts.

These tools normally run on the destination host, talking back through a worker — not by opening Postgres from that host.

Worker nodes

Who the primary dials for hub transport: name, host:port, shared token, optional TLS CA (paste the worker's hub.crt), skip-verify, enabled. Edits take effect within about ten seconds. Address SAN must match the certificate; there is no ws:// fallback. This page only registers who to dial; the worker binary, TLS cert, and worker.commands allowlist are configured on the worker host.

Device sync

Credentials and options for factum2-device-sync (read on-device services into NetBox/Factum). GUI device I/O uses the same credentials (per-device override, or the default row): service push, delete-from-device, unrealize, Config-tree rebind, interface refresh/update, and VLAN push.

Waystream iBOS (platform ibos) is the exception. BECS already manages those switches, so device sync only reads LLDP and creates the NetBox cables. Set the SNMP community on the credential those devices use. Interface refresh, VLAN push, and service push do not apply to them.

Services

  • RADIUS — switch and router login. LDAP groups are mapped to NetBox device roles. See RADIUS