Webfrontend with database in readonly mode

[PieterL75]

NetBox version

v3.3.9

Feature type

Change to existing functionality

Proposed functionality

The current 'Maintenance mode' ensures that no writes are done to the database. It also displays a banner that the instance is in maintenance mode.

I would like to have a 'ReadOnly' mode that

• like maintenance mode, prevents updates by logins.
• don't display a banner (custom banner can be set with the BANNER_TOP)
• don't do any database updates with the upgrade.sh script
• optionally: provide a message to the user if he tries to do a write operation, with info to the read/write
• optionally: use a separate database for session logs

Use case

We use postgres WAL to create a almost-realtime readonly copy of our production database.
This can be used to poll data from with API calls and the GUI.

In order to maintain this node, we need to patch the upgrade.sh (remove database operation), but that breaks the git pull.
Also, that banner that is show is not relevant to the state of our instance. It is not in maintenance, it is in readonly.
The sessionpath is an option, but I would rather like to send that to a separate database (different postgresql server) to maintain the session state across webfrontends

Database changes

No response

External dependencies

No response

[jeremystretch]

I'd really like to see this as well, however I'm not sure if we can elegantly hook into the database connection to catch and prevent write operations cleanly. Anyone have any ideas?

[talha700]

Same case here, we are using postgres streaming replication and setup up 2 instances of Netbox, It would be cool if user can login (we are using LDAP for remote auth) to replica instance of Netbox as read-only.

I'm still seeing logs after turning MAINTENANCE_MODE=True, is it not supposed to update the last login etc... ? v3.3.7

[kkthxbye-code]

@talha700 - https://django-auth-ldap.readthedocs.io/en/latest/reference.html#auth-ldap-always-update-user

[abhi1693]

@jeremystretch Can I take a try at this? I have a solution which involves overriding CursorWrapper to raise exception in maintenance mode which in turn disallows write operations and gracefully informs the user via django message framework.

[jeremystretch]

@abhi1693 sure! Put a PR in against the develop branch for now, although we may end up needing to defer this until the v3.5 release depending on how involved the implementation ends up being. Thanks!

[PieterL75]

There are also plugins (like ldap, okta saml) that write to the database when a user logs in
Is there a way to tackle that too?

[abhi1693]

I don't have a setup for that yet so I cannot say

[pycolas]

I am also interested with this feature.
A primary netbox instance where read/write operations are possible on sensitive network, and some read only instances reachable from less sensitive networks in the company (or in remote offices with huge latency with central).

Django as a database router functionnality. Maybe it can help in order to separate R/W operations for frontend user experience, and read operations for models storage ?
Or maybe in my usecase I can simply declare users with no write privileges at all.