The problem
Network automation has a failure mode nobody talks about: it works, and then its author changes teams. Scripts live in personal folders, credentials live in personal heads, and the fifth engineer to need the tool rewrites it from scratch because finding the fourth engineer’s copy is harder than starting over. The team needed automation that behaves like a product: one platform, one contribution process, and a consumption model that does not require every network engineer to become a git user first.
My role
I founded the platform and built its first tools. That includes the architecture, the repository structure, the onboarding and credential model, the contribution workflow, and the two tools that prove the pattern. This is the newest thing I run, and it is deliberately built to grow without me.
The approach
The design splits the audience in two. Engineers and operations teams consume: tools run on a shared hardened jump host, and a one-time init script sets up each user, prompting for their NetBox API token and TACACS credentials and encrypting them with a personal vault passphrase. After that, automation is a shell command, not a git workflow. Developers contribute: local development, feature branch, pull request, CI, review, merge. Source on the jump host is read-only and owned by a service account, so the running platform cannot drift from the repository.
NetBox anchors everything as the network source of truth: devices, addressing, VLANs, sites. Tools query it live instead of carrying their own inventory, which means the platform gets more accurate as the source of truth does, and never disagrees with it.
The stack is three layers: Python 3.11+ tools with UV-managed environments, Ansible playbooks running NetBox dynamic inventory, and Bash for host setup and user onboarding. Linting, pre-commit hooks, and CI keep contributions consistent, and the security rules are non-negotiable: no credential of any kind in the repository, vault files gitignored with only example templates committed. AI-assisted development is part of the workflow too, with project context checked into the repo so every session starts already briefed.
What shipped
Two tools prove the platform pattern. netdiagram generates architecture diagrams from live NetBox data, rendering the same network differently for a technical audience and a leadership one, because those are different diagrams. argus is a network state observer: it collects topology, routing, and ACL state with change history, so “what changed since yesterday” becomes a query instead of an investigation.
Around the tools: the per-user onboarding script, the playbook inventory wired to NetBox, the contribution guide, and the CI pipeline that keeps the platform releasable.
Where it stands
The platform is young and growing, which is the honest and interesting part. The pattern is proven: tools ship through PRs, engineers consume them as commands, credentials stay encrypted and personal, and the source of truth stays singular. Every tool added from here inherits the same delivery, the same security posture, and the same documentation standard. Automation that outlives its author is the whole point.