netbox: upgrade to 3.3.9 and remove patches

This change migrates to using simplevisor which handles Vault credential
fetching and renewal. It removes quite a lot of fragile hacks at the
Django layer in favor of straightforward environment variable passing.

16 files changed, 126 insertions, 397 deletions

diff --git a/netbox/Dockerfile b/netbox/Dockerfile
index 022aebf..3b63944 100644
--- a/netbox/Dockerfile
+++ b/netbox/Dockerfile
@@ -3,15 +3,13 @@ LABEL maintainer="Mike Crute <mike@crute.us>"
 
 ARG netbox_version
 
-ADD config-patch1.diff /config-patch1.diff
-ADD config-patch2.diff /config-patch2.diff
-ADD settings-patch.diff /settings-patch.diff
+ADD configuration.py /configuration.py
+ADD settings.patch /settings.patch
 
 RUN set -euxo pipefail; \
     \
     apk --no-cache add \
         build-base \
-        dumb-init \
         jpeg-dev \
         libffi-dev \
         libxml2-dev \
@@ -19,13 +17,13 @@ RUN set -euxo pipefail; \
         openssl-dev \
         postgresql-dev \
         py3-pip \
+        py3-wheel \
         python3-dev \
-        runit \
-        su-exec \
         uwsgi \
         uwsgi-python \
         zlib-dev \
     ; \
+    \
     cd /tmp; \
     wget "https://github.com/netbox-community/netbox/archive/v${netbox_version}.tar.gz"; \
     tar -xvf "v${netbox_version}.tar.gz" -C /opt; \
@@ -33,41 +31,31 @@ RUN set -euxo pipefail; \
     mv /opt/netbox-${netbox_version}/ /opt/netbox/; \
     \
     cd /; \
-    cp /opt/netbox/netbox/netbox/configuration.example.py /opt/netbox/netbox/netbox/configuration.py; \
-    patch -p1 < /config-patch1.diff; \
-    rm /config-patch1.diff; \
+    mv /configuration.py /opt/netbox/netbox/netbox/configuration.py; \
+    patch -p1 < /settings.patch; rm /settings.patch; \
     \
     addgroup -S netbox; \
     adduser -S -G netbox netbox; \
     chown -R netbox:netbox /opt/netbox/netbox/media; \
     \
     cd /opt/netbox; \
-    pip3 install wheel; \
     pip3 install -r requirements.txt; \
+    pip3 install django-postgresql-setrole; \
     \
-    python3 netbox/manage.py collectstatic --no-input; \
-    \
-    cd /; \
-    cp /opt/netbox/netbox/netbox/configuration.example.py /opt/netbox/netbox/netbox/configuration.py; \
-    patch -p1 < /config-patch2.diff; \
-    rm /config-patch2.diff; \
-    \
-    patch -p1 < /settings-patch.diff; \
-    rm /settings-patch.diff; \
+    export NETBOX_SECRET_KEY="testing key for running the build"; \
+    export NETBOX_DB_PORT="0"; \
+    export NETBOX_REDIS_TASK_DB="0"; \
+    export NETBOX_REDIS_CACHE_DB="0"; \
     \
-    mkdir -p /usr/lib/python3.8/site-packages/django/db/backends/postgresqlvault; \
-    touch /usr/lib/python3.8/site-packages/django/db/backends/postgresqlvault/__init__.py; \
+    python3 netbox/manage.py collectstatic --no-input; \
     \
     rm -rf /root/.cache; \
     apk --no-cache del --purge \
         build-base \
     ;
 
-ADD django-vault-client.py /usr/lib/python3.8/site-packages/django/contrib/vault_client.py
-ADD django-driver.py /usr/lib/python3.8/site-packages/django/db/backends/postgresqlvault/base.py
-ADD etc/ /etc/
-ADD entrypoint.sh /entrypoint.sh
+ADD netbox.ini /etc/uwsgi/netbox.ini
+ADD simplevisor.json /simplevisor.json
+ADD simplevisor /simplevisor
 
-STOPSIGNAL SIGHUP
-ENTRYPOINT [ "/entrypoint.sh" ]
-CMD [ "/usr/bin/dumb-init", "/sbin/runsvdir", "/etc/service" ]
+CMD [ "/simplevisor" ]
diff --git a/netbox/Makefile b/netbox/Makefile
index 1fb4dad..f572b39 100644
--- a/netbox/Makefile
+++ b/netbox/Makefile
@@ -1,4 +1,4 @@
-VERSION=2.11.9
+VERSION=3.3.9
 IMAGE=docker.crute.me/netbox:$(VERSION)
 LATEST=$(subst :$(VERSION),,$(IMAGE)):latest
 
diff --git a/netbox/config-patch1.diff b/netbox/config-patch1.diff
deleted file mode 100644
index cc5c6d2..0000000
--- a/netbox/config-patch1.diff
+++ /dev/null
@@ -1,26 +0,0 @@
---- a/opt/netbox/netbox/netbox/configuration.py 2021-07-11 22:24:55.365668931 +0000
-+++ b/opt/netbox/netbox/netbox/configuration.py 2021-07-11 22:25:25.077103585 +0000
-@@ -4,11 +4,13 @@
- #                       #
- #########################
- 
-+import urllib3; urllib3.disable_warnings()
-+
- # This is a list of valid fully-qualified domain names (FQDNs) for the NetBox server. NetBox will not permit write
- # access to the server via any other hostnames. The first FQDN in the list will be treated as the preferred name.
- #
- # Example: ALLOWED_HOSTS = ['netbox.example.com', 'netbox.internal.local']
--ALLOWED_HOSTS = []
-+ALLOWED_HOSTS = ['*']
- 
- # PostgreSQL database configuration. See the Django documentation for a complete list of available parameters:
- #   https://docs.djangoproject.com/en/stable/ref/settings/#databases
-@@ -57,7 +59,7 @@
- # For optimal security, SECRET_KEY should be at least 50 characters in length and contain a mix of letters, numbers, and
- # symbols. NetBox will not run without this defined. For more information, see
- # https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-SECRET_KEY
--SECRET_KEY = ''
-+SECRET_KEY = 'dummy setup value will get cleared after setup run'
- 
- 
- #########################
diff --git a/netbox/config-patch2.diff b/netbox/config-patch2.diff
deleted file mode 100644
index 69162e4..0000000
--- a/netbox/config-patch2.diff
+++ /dev/null
@@ -1,92 +0,0 @@
---- a/opt/netbox/netbox/netbox/configuration.py 2021-07-11 22:24:55.365668931 +0000
-+++ b/opt/netbox/netbox/netbox/configuration.py 2021-07-11 22:28:09.665982854 +0000
-@@ -4,21 +4,35 @@
- #                       #
- #########################
- 
-+import os
-+from django.contrib.vault_client import SimpleVaultClient
-+
-+
-+def _is_affirmative(value):
-+    value = "" if not value else value
-+    return value.lower() in ["yes", "true", "on", "1"]
-+
-+
- # This is a list of valid fully-qualified domain names (FQDNs) for the NetBox server. NetBox will not permit write
- # access to the server via any other hostnames. The first FQDN in the list will be treated as the preferred name.
- #
- # Example: ALLOWED_HOSTS = ['netbox.example.com', 'netbox.internal.local']
--ALLOWED_HOSTS = []
-+ALLOWED_HOSTS = ['*']
- 
- # PostgreSQL database configuration. See the Django documentation for a complete list of available parameters:
- #   https://docs.djangoproject.com/en/stable/ref/settings/#databases
-+port = os.getenv("NETBOX_DB_PORT")
- DATABASE = {
--    'NAME': 'netbox',         # Database name
--    'USER': '',               # PostgreSQL username
--    'PASSWORD': '',           # PostgreSQL password
--    'HOST': 'localhost',      # Database server
--    'PORT': '',               # Database port (leave blank for default)
--    'CONN_MAX_AGE': 300,      # Max database connection age
-+    'NAME': os.getenv("NETBOX_DB_NAME"),
-+    'HOST': os.getenv("NETBOX_DB_HOST"),
-+    'PORT': int(port) if port else "",
-+    'CONN_MAX_AGE': 300,
-+    "VAULT_SKIP_VERIFY": os.getenv("VAULT_SKIP_VERIFY"),
-+    "VAULT_ADDR": os.getenv("VAULT_ADDR"),
-+    "VAULT_TOKEN": os.getenv("VAULT_TOKEN"),
-+    "VAULT_DB_ROLE_NAME": os.getenv("VAULT_DB_ROLE_NAME"),
-+    "VAULT_ROLE_ID": os.getenv("VAULT_ROLE_ID"),
-+    "VAULT_SECRET_ID": os.getenv("VAULT_SECRET_ID"),
- }
- 
- # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
-@@ -26,26 +40,26 @@
- # to use two separate database IDs.
- REDIS = {
-     'tasks': {
--        'HOST': 'localhost',
-+        'HOST': os.getenv("NETBOX_REDIS_HOST"),
-         'PORT': 6379,
-         # Comment out `HOST` and `PORT` lines and uncomment the following if using Redis Sentinel
-         # 'SENTINELS': [('mysentinel.redis.example.com', 6379)],
-         # 'SENTINEL_SERVICE': 'netbox',
-         'PASSWORD': '',
--        'DATABASE': 0,
-+        'DATABASE': int(os.getenv("NETBOX_REDIS_TASK_DB")),
-         'SSL': False,
-         # Set this to True to skip TLS certificate verification
-         # This can expose the connection to attacks, be careful
-         # 'INSECURE_SKIP_TLS_VERIFY': False,
-     },
-     'caching': {
--        'HOST': 'localhost',
-+        'HOST': os.getenv("NETBOX_REDIS_HOST"),
-         'PORT': 6379,
-         # Comment out `HOST` and `PORT` lines and uncomment the following if using Redis Sentinel
-         # 'SENTINELS': [('mysentinel.redis.example.com', 6379)],
-         # 'SENTINEL_SERVICE': 'netbox',
-         'PASSWORD': '',
--        'DATABASE': 1,
-+        'DATABASE': int(os.getenv("NETBOX_REDIS_CACHE_DB")),
-         'SSL': False,
-         # Set this to True to skip TLS certificate verification
-         # This can expose the connection to attacks, be careful
-@@ -57,7 +71,14 @@
- # For optimal security, SECRET_KEY should be at least 50 characters in length and contain a mix of letters, numbers, and
- # symbols. NetBox will not run without this defined. For more information, see
- # https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-SECRET_KEY
--SECRET_KEY = ''
-+vc = SimpleVaultClient(
-+    os.getenv("VAULT_ADDR"),
-+    os.getenv("VAULT_ROLE_ID"),
-+    os.getenv("VAULT_SECRET_ID"),
-+    ssl_verify=not _is_affirmative(os.getenv("VAULT_SKIP_VERIFY"))
-+)
-+SECRET_KEY = vc.get_kv_secret(os.getenv("NETBOX_VAULT_SECRET_NAME"), "key")
-+del vc
- 
- 
- #########################
diff --git a/netbox/configuration.py b/netbox/configuration.py
new file mode 100644
index 0000000..9abd2aa
--- /dev/null
+++ b/netbox/configuration.py
@@ -0,0 +1,30 @@
+import os
+
+ALLOWED_HOSTS = ["*"]
+
+DATABASE = {
+    'NAME': os.getenv("NETBOX_DB_NAME"),
+    'HOST': os.getenv("NETBOX_DB_HOST"),
+    'PORT': int(os.getenv("NETBOX_DB_PORT")),
+    'USER': os.getenv("NETBOX_DB_USERNAME"),
+    'PASSWORD': os.getenv("NETBOX_DB_PASSWORD"),
+    'SET_ROLE': os.getenv("NETBOX_SET_ROLE"),
+    'CONN_MAX_AGE': 300,
+}
+
+REDIS = {
+    'tasks': {
+        'HOST': os.getenv("NETBOX_REDIS_HOST"),
+        'PORT': 6379,
+        'DATABASE': int(os.getenv("NETBOX_REDIS_TASK_DB")),
+        'SSL': False,
+    },
+    'caching': {
+        'HOST': os.getenv("NETBOX_REDIS_HOST"),
+        'PORT': 6379,
+        'DATABASE': int(os.getenv("NETBOX_REDIS_CACHE_DB")),
+        'SSL': False,
+    }
+}
+
+SECRET_KEY = os.getenv("NETBOX_SECRET_KEY")
diff --git a/netbox/django-driver.py b/netbox/django-driver.py
deleted file mode 100644
index 80bfa13..0000000
--- a/netbox/django-driver.py
+++ /dev/null
@@ -1,77 +0,0 @@
-import threading
-from datetime import datetime, timedelta
-
-from django.core.exceptions import ImproperlyConfigured
-from django.contrib.vault_client import SimpleVaultClient, Credential
-from django.db.backends.postgresql.base import DatabaseWrapper as OrigWrapper
-
-
-def _is_affirmative(value):
-    value = "" if not value else value
-    return value.lower() in ["yes", "true", "on", "1"]
-
-
-def _must_get(store, key):
-    value = store.get(key)
-
-    if not value:
-        raise ImproperlyConfigured(
-            f"Database parameter {key} is required but not set.")
-
-    return value
-
-
-class DatabaseWrapper(OrigWrapper):
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._vault_cache_lock = threading.Lock()
-        self._vault_cred_cache = Credential.empty()
-
-    def close(self):
-        self._vault_cred_cache = Credential.empty()
-        super().close()
-
-    def close_if_unusable_or_obsolete(self):
-        super().close_if_unusable_or_obsolete()
-
-        if self.connection is None:
-            return
-
-        if not self.is_usable():
-            self.close()
-            return
-
-        with self._vault_cache_lock:
-            if not self._vault_cred_cache.is_valid:
-                self.close()
-
-    # All of this is done under lock
-    def _get_vault_cred(self):
-        print("Getting credentials from vault")
-        params = self.settings_dict
-
-        verify = not _is_affirmative(params.get("VAULT_SKIP_VERIFY"))
-        url = _must_get(params, "VAULT_ADDR")
-        token = params.get("VAULT_TOKEN")
-        db_role_name = _must_get(params, "VAULT_DB_ROLE_NAME")
-        role_id = _must_get(params, "VAULT_ROLE_ID")
-        role_secret = _must_get(params, "VAULT_SECRET_ID")
-
-        client = SimpleVaultClient(url, role_id, role_secret, verify)
-
-        self._vault_cred_cache = client.get_db_credential(db_role_name)
-
-    def get_connection_params(self):
-        conn_params = super().get_connection_params()
-
-        # Do the fetch under lock to prevent multiple threads from piling onto
-        # the vault server
-        with self._vault_cache_lock:
-            if not self._vault_cred_cache.is_valid:
-                self._get_vault_cred()
-
-            conn_params["user"] = self._vault_cred_cache.username
-            conn_params["password"] = self._vault_cred_cache.password
-
-        return conn_params
diff --git a/netbox/django-vault-client.py b/netbox/django-vault-client.py
deleted file mode 100644
index 85b5671..0000000
--- a/netbox/django-vault-client.py
+++ /dev/null
@@ -1,88 +0,0 @@
-import os
-import ssl
-import json
-from urllib import request, parse
-from datetime import datetime, timedelta
-
-
-class Credential:
-
-    def __init__(self, data):
-        self.username = data["data"]["username"]
-        self.password = data["data"]["password"]
-
-        # Leave 2 minutes in case we encounter a failure
-        _duration = timedelta(seconds=data["lease_duration"] - 120)
-        self.expires = datetime.now() + _duration
-
-    @classmethod
-    def empty(cls):
-        return cls({
-            "lease_duration": -1,
-            "data": { "username": "", "password": "" }
-        })
-
-    @property
-    def is_valid(self):
-        return self.expires > datetime.now()
-
-
-
-class SimpleVaultClient:
-
-    def __init__(self, base_url, role_id, role_secret, ssl_verify=True):
-        self.base_url = base_url
-        self.ssl_verify = ssl_verify
-        self.role_id = role_id
-        self.role_secret = role_secret
-
-        env_token = os.getenv("VAULT_TOKEN")
-        if env_token:
-            self._token = env_token
-            self._token_expires = None # Token is assumed to never expire
-        else:
-            self._token = None
-            self._token_expires = datetime.now() + timedelta(seconds=-1)
-
-    def _login_approle(self, role_id, secret):
-        res = self._make_request("auth/approle/login", auth=False, data={
-            "role_id": role_id, 
-            "secret_id": secret,
-        })
-
-        self._token = res["auth"]["client_token"]
-        self._token_expires = datetime.now() + \
-                timedelta(seconds=res["auth"]["lease_duration"])
-
-    @property
-    def _token_is_expired(self):
-        return self._token_expires and \
-                self._token_expires < (datetime.now() + timedelta(seconds=120))
-
-    def _auth_as_needed(self):
-        if self._token_is_expired:
-            self._login_approle(self.role_id, self.role_secret)
-
-    def _make_request(self, url, data=None, auth=True):
-        context = ssl._create_unverified_context() \
-                if not self.ssl_verify else None
-
-        data = json.dumps(data).encode("utf-8") if data else None
-        headers = { "X-Vault-Token": self._token } if auth else {}
-
-        url = parse.urljoin(self.base_url, parse.urljoin("/v1/", url))
-        req = request.Request(url, headers=headers, data=data)
-        res = request.urlopen(req, context=context)
-
-        if res.status != 200:
-            raise Exception("Failed to fetch credential from vault")
-
-        return json.load(res)
-
-    def get_kv_secret(self, path, key):
-        self._auth_as_needed()
-        return self._make_request(f"kv/data/{path}")["data"]["data"][key]
-
-    def get_db_credential(self, role):
-        self._auth_as_needed()
-        return Credential(self._make_request(f"database/creds/{role}"))
diff --git a/netbox/entrypoint.sh b/netbox/entrypoint.sh
deleted file mode 100755
index a4f844c..0000000
--- a/netbox/entrypoint.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cd "/opt/netbox"
-
-# Apply any database migrations
-/sbin/su-exec netbox python3 netbox/manage.py migrate
-
-# Trace any missing cable paths (not typically needed)
-/sbin/su-exec netbox python3 netbox/manage.py trace_paths --no-input
-
-# Delete any stale content types
-/sbin/su-exec netbox python3 netbox/manage.py remove_stale_contenttypes --no-input
-
-# Delete any expired user sessions
-/sbin/su-exec netbox python3 netbox/manage.py clearsessions
-
-# Clear all cached data
-/sbin/su-exec netbox python3 netbox/manage.py invalidate all
-
-exec "$@"
diff --git a/netbox/etc/service/netbox-rq/log/run b/netbox/etc/service/netbox-rq/log/run
deleted file mode 100755
index 6193824..0000000
--- a/netbox/etc/service/netbox-rq/log/run
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-cat -
diff --git a/netbox/etc/service/netbox-rq/run b/netbox/etc/service/netbox-rq/run
deleted file mode 100755
index aa4b675..0000000
--- a/netbox/etc/service/netbox-rq/run
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-# runsv sends us a TERM but uwsgi will only shutdown cleanly
-# if it receives an INT so we need to translate the signal
-# properly for uwsgi
-trap 'kill -INT $PID' TERM
-
-/sbin/su-exec netbox /usr/bin/python3 /opt/netbox/netbox/manage.py rqworker &
-
-PID=$!
-
-# wait for uwsgi, will get cancelled when runsv TERMs us and
-# the trap will get executed next, unless something goes wrong
-# and uwsgi fails then this wait will run
-wait $PID
-
-# if something went wrong then unregister the trap because it
-# won't have a target
-trap - TERM
-
-# waiting on a dead process will return the return code of the
-# processes original exit
-wait $PID
diff --git a/netbox/etc/service/uwsgi/log/run b/netbox/etc/service/uwsgi/log/run
deleted file mode 100755
index 6193824..0000000
--- a/netbox/etc/service/uwsgi/log/run
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-cat -
diff --git a/netbox/etc/service/uwsgi/run b/netbox/etc/service/uwsgi/run
deleted file mode 100755
index e24ede7..0000000
--- a/netbox/etc/service/uwsgi/run
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-# runsv sends us a TERM but uwsgi will only shutdown cleanly
-# if it receives an INT so we need to translate the signal
-# properly for uwsgi
-trap 'kill -INT $PID' TERM
-
-/usr/sbin/uwsgi --ini /etc/uwsgi/netbox.ini &
-
-PID=$!
-
-# wait for uwsgi, will get cancelled when runsv TERMs us and
-# the trap will get executed next, unless something goes wrong
-# and uwsgi fails then this wait will run
-wait $PID
-
-# if something went wrong then unregister the trap because it
-# won't have a target
-trap - TERM
-
-# waiting on a dead process will return the return code of the
-# processes original exit
-wait $PID
diff --git a/netbox/etc/uwsgi/netbox.ini b/netbox/netbox.ini
index 8431c6f..8431c6f 100644
--- a/netbox/etc/uwsgi/netbox.ini
+++ b/netbox/netbox.ini
diff --git a/netbox/settings-patch.diff b/netbox/settings-patch.diff
deleted file mode 100644
index 78510ad..0000000
--- a/netbox/settings-patch.diff
+++ /dev/null
@@ -1,11 +0,0 @@
---- /opt/netbox/netbox/netbox/settings.py
-+++ /opt/netbox/netbox/netbox/settings.py
-@@ -147,7 +147,7 @@
-     })
- else:
-     DATABASE.update({
--        'ENGINE': 'django.db.backends.postgresql'
-+        'ENGINE': 'django.db.backends.postgresqlvault'
-     })
-
- DATABASES = {
diff --git a/netbox/settings.patch b/netbox/settings.patch
new file mode 100644
index 0000000..1141d64
--- /dev/null
+++ b/netbox/settings.patch
@@ -0,0 +1,10 @@
+--- a/opt/netbox/netbox/netbox/settings.py      2022-11-30 13:14:00.000000000 -0800
++++ b/opt/netbox/netbox/netbox/settings.py      2022-12-04 21:35:52.779482819 -0800
+@@ -302,6 +302,7 @@
+ #
+ 
+ INSTALLED_APPS = [
++    'postgresql_setrole',
+     'django.contrib.admin',
+     'django.contrib.auth',
+     'django.contrib.contenttypes',
diff --git a/netbox/simplevisor.json b/netbox/simplevisor.json
new file mode 100644
index 0000000..666a765
--- /dev/null
+++ b/netbox/simplevisor.json
@@ -0,0 +1,69 @@
+{
+    "env": {
+        "pass": [
+            "PATH",
+            "HOSTNAME",
+            "SHLVL",
+            "HOME",
+            "PWD",
+
+            "NETBOX_REDIS_TASK_DB",
+            "NETBOX_DB_HOST",
+            "NETBOX_DB_PORT",
+            "NETBOX_REDIS_HOST",
+            "NETBOX_DB_NAME",
+            "NETBOX_REDIS_CACHE_DB",
+            "NETBOX_DB_USERNAME",
+            "NETBOX_DB_PASSWORD",
+            "NETBOX_DELETE_LEGACY_DATA",
+            "NETBOX_SET_ROLE",
+            "NETBOX_SECRET_KEY"
+        ],
+        "vault-replace": [
+            "NETBOX_DB_USERNAME",
+            "NETBOX_DB_PASSWORD",
+            "NETBOX_SECRET_KEY"
+        ]
+    },
+    "jobs": {
+        "init": [
+            {
+                "name": "migrate",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "migrate"],
+                "run-as": "netbox"
+            },
+            {
+                "name": "trace_paths",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "trace_paths", "--no-input"],
+                "run-as": "netbox"
+            },
+            {
+                "name": "remove_stale_contenttypes",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "remove_stale_contenttypes", "--no-input"],
+                "run-as": "netbox"
+            },
+            {
+                "name": "clearsessions",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "clearsessions"],
+                "run-as": "netbox"
+            },
+            {
+                "name": "clearcache",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "clearcache"],
+                "run-as": "netbox"
+            }
+        ],
+        "main": [
+            {
+                "name": "queue-worker",
+                "cmd": ["/usr/bin/python3", "/opt/netbox/netbox/manage.py", "rqworker"],
+                "run-as": "netbox"
+            },
+            {
+                "cmd": ["/usr/sbin/uwsgi", "--ini", "/etc/uwsgi/netbox.ini"],
+                "kill-signal": "INT",
+                "run-as": "root"
+            }
+        ]
+    }
+}