{"id":12197,"date":"2025-04-28T15:53:48","date_gmt":"2025-04-28T22:53:48","guid":{"rendered":"https:\/\/www.xh86.me\/?p=12197"},"modified":"2025-04-28T18:28:07","modified_gmt":"2025-04-29T01:28:07","slug":"ubuntu-24-04%e5%ae%89%e8%a3%85netbox","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=12197","title":{"rendered":"Ubuntu 24.04\u5b89\u88c5NetBox"},"content":{"rendered":"

#!\/bin\/bash<\/p>\n

set -e<\/p>\n

# 1. \u66f4\u65b0\u7cfb\u7edf\u5e76\u5b89\u88c5\u4f9d\u8d56
\nsudo apt update && sudo apt upgrade -y
\nsudo apt install -y python3 python3-pip python3-venv python3-dev \\
\nbuild-essential libpq-dev libffi-dev libssl-dev \\
\nredis-server postgresql nginx git certbot python3-certbot-nginx ufw<\/p>\n

# 2. \u8bbe\u7f6e\u65f6\u533a\u4e3a\u6d1b\u6749\u77f6
\nsudo timedatectl set-timezone America\/Los_Angeles<\/p>\n

# 3. \u914d\u7f6e\u9632\u706b\u5899\uff0c\u5141\u8bb822\u300180\u3001443\u7aef\u53e3
\nsudo ufw allow 22\/tcp
\nsudo ufw allow 80\/tcp
\nsudo ufw allow 443\/tcp
\nsudo ufw –force enable<\/p>\n

# 4. \u521b\u5efa NetBox \u7cfb\u7edf\u7528\u6237
\nsudo adduser –system –group netbox<\/p>\n

# 5. \u914d\u7f6e PostgreSQL \u6570\u636e\u5e93
\nsudo systemctl enable –now postgresql
\nsudo -u postgres psql <<EOF
\nCREATE DATABASE netbox;
\nCREATE USER netbox WITH PASSWORD ‘netbox’;
\nALTER ROLE netbox SET client_encoding TO ‘utf8’;
\nALTER ROLE netbox SET default_transaction_isolation TO ‘read committed’;
\nALTER ROLE netbox SET timezone TO ‘UTC’;
\nGRANT ALL PRIVILEGES ON DATABASE netbox TO netbox;
\nGRANT ALL ON SCHEMA public TO netbox;
\nALTER DATABASE netbox OWNER TO netbox;
\nEOF<\/p>\n

# 6. \u514b\u9686 NetBox \u4ed3\u5e93
\ncd \/opt
\nsudo git clone -b v4.2.8 https:\/\/github.com\/netbox-community\/netbox.git
\nsudo chown -R netbox:netbox \/opt\/netbox<\/p>\n

# 7. \u521b\u5efa\u5e76\u6fc0\u6d3b Python \u865a\u62df\u73af\u5883
\ncd \/opt\/netbox
\nsudo -u netbox python3 -m venv \/opt\/netbox\/venv
\nsudo -u netbox \/opt\/netbox\/venv\/bin\/pip install –upgrade pip
\nsudo -u netbox \/opt\/netbox\/venv\/bin\/pip install -r requirements.txt<\/p>\n

# 8. \u914d\u7f6e NetBox
\nsudo cp \/opt\/netbox\/netbox\/netbox\/configuration_example.py \/opt\/netbox\/netbox\/netbox\/configuration.py<\/p>\n

SECRET_KEY=$(python3 \/opt\/netbox\/netbox\/generate_secret_key.py)
\nsudo sed -i “s|^SECRET_KEY = .*|SECRET_KEY = ‘$SECRET_KEY’|” \/opt\/netbox\/netbox\/netbox\/configuration.py
\nsudo sed -i “s\/ALLOWED_HOSTS = \\[\\]\/ALLOWED_HOSTS = [‘netbox.digitalsystem.net’]\/” \/opt\/netbox\/netbox\/netbox\/configuration.py<\/p>\n

sudo tee -a \/opt\/netbox\/netbox\/netbox\/configuration.py > \/dev\/null <<EOF<\/p>\n

DATABASE = {
\n‘NAME’: ‘netbox’,
\n‘USER’: ‘netbox’,
\n‘PASSWORD’: ‘netbox’,
\n‘HOST’: ‘localhost’,
\n‘PORT’: ‘5432’,
\n}
\nEOF<\/p>\n

# 9. \u521d\u59cb\u5316\u6570\u636e\u5e93
\nsudo -u netbox \/opt\/netbox\/venv\/bin\/python \/opt\/netbox\/netbox\/manage.py migrate<\/p>\n

# 10. \u6536\u96c6\u9759\u6001\u6587\u4ef6
\nsudo -u netbox \/opt\/netbox\/venv\/bin\/python \/opt\/netbox\/netbox\/manage.py collectstatic –no-input<\/p>\n

# 11. \u5148\u914d\u7f6e\u4e34\u65f6 HTTP nginx
\nsudo tee \/etc\/nginx\/sites-available\/netbox > \/dev\/null <<EOF
\nserver {
\nlisten 80;
\nserver_name netbox.digitalsystem.net;<\/p>\n

location \/static\/ {
\nalias \/opt\/netbox\/netbox\/static\/;
\n}<\/p>\n

location \/ {
\nproxy_pass http:\/\/127.0.0.1:8001;
\nproxy_set_header Host \\$host;
\nproxy_set_header X-Real-IP \\$remote_addr;
\n}
\n}
\nEOF<\/p>\n

sudo ln -sf \/etc\/nginx\/sites-available\/netbox \/etc\/nginx\/sites-enabled\/netbox
\nsudo rm -f \/etc\/nginx\/sites-enabled\/default
\nsudo systemctl restart nginx<\/p>\n

# 12. \u7533\u8bf7 Let’s Encrypt \u8bc1\u4e66
\nsudo certbot –nginx -d netbox.digitalsystem.net –non-interactive –agree-tos -m xxx@xxx.com –redirect<\/p>\n

# 13. \u66f4\u65b0 nginx \u914d\u7f6e\uff0c\u5f3a\u5236 HTTPS
\nsudo tee \/etc\/nginx\/sites-available\/netbox > \/dev\/null <<EOF
\nserver {
\nlisten 80;
\nserver_name netbox.xxxxxx.net;
\nreturn 301 https:\/\/\\$host\\$request_uri;
\n}<\/p>\n

server {
\nlisten 443 ssl;
\nserver_name netbox.xxxxxxxx.net;<\/p>\n

ssl_certificate \/etc\/letsencrypt\/live\/netbox.xxxxxxx.net\/fullchain.pem;
\nssl_certificate_key \/etc\/letsencrypt\/live\/netbox.xxxxxx.net\/privkey.pem;<\/p>\n

location \/static\/ {
\nalias \/opt\/netbox\/netbox\/static\/;
\n}<\/p>\n

location \/ {
\nproxy_pass http:\/\/127.0.0.1:8001;
\nproxy_set_header Host \\$host;
\nproxy_set_header X-Real-IP \\$remote_addr;
\n}
\n}
\nEOF<\/p>\n

sudo systemctl reload nginx<\/p>\n

# 14. \u914d\u7f6e Gunicorn systemd \u670d\u52a1
\nsudo tee \/etc\/systemd\/system\/netbox.service > \/dev\/null <<EOF
\n[Unit]
\nDescription=NetBox WSGI Service
\nAfter=network.target<\/p>\n

[Service]
\nType=simple
\nUser=netbox
\nGroup=netbox
\nWorkingDirectory=\/opt\/netbox\/netbox
\nExecStart=\/opt\/netbox\/venv\/bin\/gunicorn –workers 3 –bind 127.0.0.1:8001 netbox.wsgi
\nRestart=always<\/p>\n

[Install]
\nWantedBy=multi-user.target
\nEOF<\/p>\n

# 15. \u542f\u52a8\u5e76\u542f\u7528 NetBox \u670d\u52a1
\nsudo systemctl daemon-reload
\nsudo systemctl enable netbox
\nsudo systemctl restart netbox<\/p>\n

# 16. \u8bbe\u7f6e\u6bcf\u65e5\u81ea\u52a8\u5907\u4efd\u6570\u636e\u5e93\uff0c\u53ea\u4fdd\u7559\u6700\u8fd130\u5929\u5907\u4efd
\nsudo tee \/etc\/cron.daily\/netbox_backup > \/dev\/null <<EOF
\n#!\/bin\/bash
\nBACKUP_DIR=”\/opt\/netbox\/backups”
\nmkdir -p \\$BACKUP_DIR
\nPGPASSWORD=”netbox” pg_dump -U netbox -h localhost -p 5432 netbox > \\$BACKUP_DIR\/netbox_backup_\\$(date +\\%F).sql
\nfind \\$BACKUP_DIR -type f -mtime +30 -delete
\nEOF
\nsudo chmod +x \/etc\/cron.daily\/netbox_backup<\/p>\n

# 17. \u8bbe\u7f6e\u6bcf\u65e5\u81ea\u52a8\u7eed\u671f SSL \u8bc1\u4e66\u5e76\u91cd\u8f7d nginx
\nsudo tee \/etc\/cron.daily\/certbot_renew > \/dev\/null <<EOF
\n#!\/bin\/bash
\ncertbot renew –quiet –deploy-hook “systemctl reload nginx”
\nEOF
\nsudo chmod +x \/etc\/cron.daily\/certbot_renew<\/p>\n

echo “NetBox \u5b89\u88c5\u5b8c\u6210\uff01\u8bbf\u95ee https:\/\/netbox.xxxxx.net \uff0822\u548c443\u7aef\u53e3\u5f00\u653e\uff0c\u81ea\u52a8\u7ef4\u62a4\uff0c\u6d1b\u6749\u77f6\u65f6\u95f4\uff09\u3002”<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\u5728\u767b\u5f55 NetBox \u65f6\u9047\u5230\u7684 “Forbidden (403) CSRF verification failed” \u9519\u8bef\uff0c\u901a\u5e38\u662f\u7531\u4e8e Django \u7684 CSRF \u9632\u62a4\u673a\u5236\u672a\u80fd\u6b63\u786e\u8bc6\u522b\u8bf7\u6c42\u7684\u6765\u6e90\u3002\u8fd9\u5728\u542f\u7528 HTTPS \u6216\u4f7f\u7528\u53cd\u5411\u4ee3\u7406\uff08\u5982 Nginx\uff09\u65f6\u5c24\u4e3a\u5e38\u89c1\u3002\u6839\u636e NetBox \u7684\u5b98\u65b9\u6587\u6863\u548c\u793e\u533a\u8ba8\u8bba\uff0c\u4ee5\u4e0b\u662f\u89e3\u51b3\u8be5\u95ee\u9898\u7684\u6b65\u9aa4\uff1a (Forbidden (403) CSRF verification failed. Request aborted. Reason …<\/a>)<\/p>\n

\n

\u89e3\u51b3\u65b9\u6848\uff1a\u914d\u7f6e CSRF_TRUSTED_ORIGINS<\/h3>\n
    \n
  1. \u7f16\u8f91 NetBox \u914d\u7f6e\u6587\u4ef6<\/strong>\n

    \u6253\u5f00 NetBox \u7684\u914d\u7f6e\u6587\u4ef6 configuration.py<\/code>\uff1a<\/p>\n

    sudo nano \/opt\/netbox\/netbox\/netbox\/configuration.py\r\n<\/code><\/pre>\n<\/li>\n
  2. \u6dfb\u52a0 CSRF_TRUSTED_ORIGINS \u8bbe\u7f6e<\/strong>\n
    \u5728\u6587\u4ef6\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\uff0c\u786e\u4fdd\u4f7f\u7528\u60a8\u7684\u5b9e\u9645\u57df\u540d\u66ff\u6362\u793a\u4f8b\u4e2d\u7684\u57df\u540d\uff1a<\/p>\n
    CSRF_TRUSTED_ORIGINS = ['https:\/\/netbox.xxxxxxxx.net']\r\n<\/code><\/pre>\n
    \u8bf7\u6ce8\u610f\uff0cDjango 4.0 \u53ca\u4ee5\u4e0a\u7248\u672c\u8981\u6c42\u5728 CSRF_TRUSTED_ORIGINS<\/code> \u4e2d\u5305\u542b\u534f\u8bae\uff08\u5982 http:\/\/<\/code> \u6216 https:\/\/<\/code>\uff09 \u3002<\/li>\n
  3. \u91cd\u542f NetBox \u670d\u52a1<\/strong>\n
    \u4fdd\u5b58\u5e76\u5173\u95ed\u914d\u7f6e\u6587\u4ef6\u540e\uff0c\u91cd\u542f NetBox \u670d\u52a1\u4ee5\u5e94\u7528\u66f4\u6539\uff1a<\/p>\n
    sudo systemctl restart netbox\r\n<\/code><\/pre>\n<\/li>\n
  4. \u6e05\u9664\u6d4f\u89c8\u5668\u7f13\u5b58\u548c Cookie<\/strong>\n
    \u5728\u6d4f\u89c8\u5668\u4e2d\u6e05\u9664\u4e0e NetBox \u76f8\u5173\u7684\u7f13\u5b58\u548c Cookie\uff0c\u7136\u540e\u91cd\u65b0\u52a0\u8f7d\u767b\u5f55\u9875\u9762\u3002<\/li>\n<\/ol>\n
    \n
    \ud83d\udd0d \u5176\u4ed6\u5efa\u8bae<\/h3>\n