Network configuration management

Watchtower backs up the configuration of routers and switches, shows what changed, and can restore an earlier version of NETCONF devices.

Setup

1. Add the device: POST /v1/projects/{p}/netconf-devices with host, transport (netconf on port 830, or ssh_cli for show running-config), optional entity_id (links changes to the entity timeline), interval_s (at least 300, default 900) and either credentials (sealed, never returned) or credentials_ref.

2. Enable the agent module netconf on a host that can reach the device, with api_url, api_token, project_id and a local credentials map keyed by credentials_ref. Credentials used by the agent live only in the agent's file.

What is stored

• A new version is stored only when the SHA-256 of the (redacted) config differs from the last.

• Values after password, secret, community and key-string are replaced with REDACTED before anything leaves the agent.

• The SSH host key is pinned on first use. A changed key is never connected to; the agent logs an error event instead. An operator accepts a new key with PATCH … {host_key, reset_host_key: true}.

• Versions are kept for one year. A change inside a maintenance window is still stored.

History, diff and rollback

• GET …/configs, GET …/configs/{v}, GET …/diff?from=&to= (unified diff).

• POST …/rollback {version, confirm: true} needs ManageMonitors and is audited as netconf.rollback. The agent loads the version, replaces the candidate datastore, issues a confirmed commit (120 s), checks the device is reachable through a fresh session, then sends the confirming commit. If the check fails the device reverts by itself.

• ssh_cli devices are backup only (422 rollback_unsupported_for_cli).

• A stored config with redacted secrets is not rolled back by the agent, since that would overwrite real secrets with the marker text.