Welcome to NITA, an open source platform for automating the building and testing of complex networks.
This release upgrades the webapp to Django 5.2.1 / Python 3.12 and resolves several security findings raised by static analysis. The container now runs as a non-root user, has a health check, uses verified TLS for all downloads, and the OpenAPI specification now enforces HTTPS and explicit authentication policies.
Please refer to the README for more details.
The simplest way to install the nita-webapp is by installing nita, which can be done by running the install.sh script located and in the parent nita repo as described here.
NITA exposes a single HTTPS endpoint on port 443 (terminated by NGINX):
| Application | URL |
|---|---|
| NITA webapp (React SPA) | https://<host>/ |
| Jenkins | https://<host>/jenkins/ |
Jenkins runs behind the same proxy under the /jenkins path prefix
(--prefix=/jenkins); it is no longer published on port 8443.
The default user credentials for the NITA webapp and Jenkins are listed below:
| Username | Password | |
|---|---|---|
| Webapp | vagrant | vagrant123 |
| Jenkins | admin | admin |
There are two ways to create webapp accounts:
- Self-service registration — the public
POST /api/v1/auth/register/endpoint. New accounts always getrole=user. - Admin-created accounts — an admin uses
POST /api/v1/users/(or the User Management screen) to create a user and choose their role (user,power_user, oradmin) with an initial password.
Self-service registration is controlled by the NITA_SELF_REGISTRATION_ENABLED
environment variable, which defaults to enabled so that both onboarding
paths are active out of the box:
NITA_SELF_REGISTRATION_ENABLED |
Effect |
|---|---|
unset or True (default) |
Public registration and admin-created accounts are both active. |
any other value (False, 0, empty, …) |
Public registration is disabled (returns 403); only admins can create accounts. |
Only the exact string True enables registration; any other value disables it.
Set it as a webapp environment variable (see the commented stub in
docker-compose.yaml).
Admins can also reset any user's password via
POST /api/v1/users/{id}/set_password/ (or the Reset password action on the
User Management screen). The last active administrator is protected: an
operation that would demote, deactivate, or delete the only remaining active
admin is rejected.
Every account has one of three roles. power_user acts as a junior
administrator: it has admin-equivalent reach over operational resources, but the
administrator tier itself stays protected.
| Capability | user |
power_user |
admin |
|---|---|---|---|
| See networks | own + team | all | all |
| Edit / delete a network | own only | any | any |
| Share a network with a team | teams they belong to | any team | any team |
| Teams (list, create, delete, membership) | no (GET /api/v1/teams/mine/ only) |
all teams | all teams |
| Upload / delete a network type | no | yes | yes |
| List and view users | no | non-admins | all |
| Reset password, activate/deactivate, change role | no | non-admins, role capped at power_user |
all |
Create / delete accounts, grant admin |
no | no | yes |
A power_user can never view, modify, or delete an admin account, and can
never grant the admin role. Password resets and network-type deletions
performed by a power_user are written to the application log.
A number of CLI scripts are installed with NITA which you can use to manage the Webapp:
user@host:$ nita-cmd webapp help
nita-cmd webapp cli => Create an interactive session in the webapp container by executing a bash shell and using stdin as a tty.
nita-cmd webapp db cli => Create an interactive session in the db pod by executing a bash shell.
nita-cmd webapp up => Stops and removes the running NITA Webapp service, according to the configuration file in
nita-cmd webapp ips => Returns IPs information on webapp container.
nita-cmd webapp labels => Returns labels information on webapp container.
nita-cmd webapp logs => Follows log output of webapp container.
nita-cmd webapp db cli => Create an interactive session in the proxy pod by executing a bash shell.
nita-cmd webapp restart => Restart the NITA Webapp with zero downtime by starting a new pod before terminating the old one.
nita-cmd webapp start => Starts the NITA Webapp pod.
nita-cmd webapp status => Shows the status of every NITA Webapp containers.
nita-cmd webapp stop => Terminate the NITA Webapp pod.
nita-cmd webapp up => Creates and starts NITA Webapp service according to the configuration file in
user@host:$
You can access the shell of the webapp container simply be running the following command:
user@host$ nita-cmd webapp cli
If you don't see a command prompt, try pressing enter.
root@webapp-748668765-m286j:/app# exit
exit
user@host$
Copyright 2026, Hewlett Packard Enterprise
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
If you are planning on using NITA or any of the technologies related to NITA then please consider going on the Juniper JAUT and AJAUT courses. These will give you the essential knowledge you need to do successful network automation!
https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10840
The idea here is to provide multiple NITA based projects with a firm foundation that they can use to focus on solving customer problems rather than continually tweaking the underlying software.
It allows NITA projects to declare exactly which version of NITA they are compatible with.
Projects must explicitly use the versions of the containers provided by this package in order to avoid docker attempting to download from the registry. No containers tagged as "latest" are provided by the package.
- BREAKING — The legacy server-rendered UI has been removed and the React
SPA is now served from the root (
/). Pages such as/campustype/,/campusnetwork/and/campus_network/<id>/...no longer exist. Thedjango_tables2dependency was dropped. - BREAKING — Jenkins is now served through the webapp proxy at
https://<host>/jenkins/instead of on port 8443. - BREAKING — Deleting a network type is refused with
409 Conflictwhile networks still reference it. Previously the delete cascaded and silently removed those networks; the referencing networks must now be deleted first. - Fixed action-history entries that could stay stuck at
Running: the status updater now uses the canonical prefixed Jenkins URL. - Added a three-tier role system (
user,power_user,admin) on a custom user model, with self-service registration and an admin user-management API. - Added Teams: power users and admins create teams and manage membership, and a
network can be shared with a team. Networks gained an
ownerand an optionalteam, and list/detail visibility is scoped accordingly. - Added SPA User Management and Teams screens, including a guided ownership-transfer dialog when deleting a user is blocked by owned resources.
- Added admin onboarding: admin-created accounts with an initial password, admin
password reset, the
NITA_SELF_REGISTRATION_ENABLEDflag, and protection for the last active administrator. - Power users now act as junior administrators — they manage all teams and all
non-admin users (view, reset password, activate/deactivate, and change role up
to
power_user). They cannot view or modifyadminaccounts or grant theadminrole; creating and deleting accounts remains admin-only. - Power users have full reach over every network, and may delete any network
type. A regular owner may share a network only with a team they belong to.
Added
GET /api/v1/teams/mine/so any user can discover their own teams. - Frontend: introduced a shared
useApiResourcedata-fetching hook and enabled ESLint enforcement in CI.
- Upgraded to Django 5.2.1 and Django REST Framework 3.15.2 on Python 3.12.
- Upgraded python-jenkins to 1.8.3, removing the
sixdependency and resolving a Python 3.12 startup crash caused by the removedpkgutil.ImpImporter. - Fixed Jenkins CSRF crumb handling — the crumb fetch and
createItemPOST now share the same session cookie, resolving HTTP 403 errors on job creation. - Fixed a
logger.debugformat-string bug innetworktypeparser.pyand a missingfilenamekey in thevalidateZipFileexception handler. - Resolved a pip dependency conflict between
python-jenkinsandsetuptools. - Container security hardening:
- Container now runs as a non-root
appuser(principle of least privilege). HEALTHCHECKinstruction added to the Dockerfile.- Removed
--no-check-certificatefromwget— TLS verification is now enforced. - OpenAPI spec updated: global security policy, HTTPS-only servers entry, and
maxItemsbounds on all array schemas. - CI workflows locked to
permissions: read-allwith per-job grant overrides.
- Container now runs as a non-root
- CI upgraded to Python 3.12 across all workflow files.
- Loads of security advisories, please use this version to avoid security problems in 22.8.
- Fixed session problem in the webapp causing disconnects from Jenkins and Kubernetes.
- Loads of security advisories, please use this version to avoid security problems in 21.7.
- AI integration between Robot, Jenkins and ChatGPT
- Upgraded Jenkins
- Loads of security advisories, please use this version to avoid security problems in 20.10.
- Upgraded django and openpyxl.
- Removed dependency on xlrd.
- Made it possible to configure the Jenkins password more easily.
- The NITA webapp is now much more forgiving about the format of project zip files. The location of the project.yaml file now determines the root of the project and directory names or even a lack of a directory inside a zip file is irrelevant.
- Jenkins credentials can now be customized during the installation process by providing an environment variable to the docker container.
- Webapp credentials can now be customized during the installation process by providing an environment variable to the docker container.
- Fixed a bug in the NITA webapp where after a certain number of spreadsheet uploads the interface would become unusable.
- NITA no longer checks for a hosts file or insists on the existence of group_vars/ or host_vars/ directories
- There is new version of the ansible container with Ansible 2.9.9 and support for pyez and Netbox libraries
- NITA 20.5-1 failed to delete Jenkins jobs when a Network was deleted, fixed in 20.5-2 and included in this release
- NITA now sets the build_dir variable for jenkins jobs in the "Test" category
- Jenkins is now supplied as an independent package
- The Webapp and its key components are now supplied as an addon package
- Removed Webapp operational scripts from the Jenkins container
- No dependencies between packages allowing custom installations
- Cli scripts now bundled in their respective packages
- Changed database to MariaDB, previously MySQL
- Internal connection with Jenkins is now authenticated
- Default connection to Webapp and Jenkins now set to HTTPS
- Ansible and Robot containers are now separately packaged becoming optional addons
- Ansible and Robot updated to support python3, previous version can still be installed to ensure backwards compatibility with older projects
- Supported installation packages for Ubuntu 18.04 LTS and CentOS 7/8
- When installing the packages with root on a debian based system this warning may surface
N: Download is performed unsandboxed as root as file '/root/nita-webapp-20.7-1.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)and can be ignored. - When removing the webapp the process may leave webapp specific jobs still installed on the runnning Jenkins instance, use
nita jenkins jobs deleteto remove them. - On reinstalling the nita-jenkins it is necessary to reload the webapp instance to guarantee that the correct jobs are installed, simply run
nita-cmd webapp restartafter nita-jenkins reinstallation. - On CentOS systems if SELinux is enabled it is necessary to manually start the services after the installation, this can be avoided by disabling SELinux during the installation (with
setenforce 0beforehand andsetenforce 1afterwards). - No method to automatically change SSL certificates for the Webapp and Jenkins (can be done manually).
- No method to reset Jenkins access password (can be done manually).
- In recent versions of Ubuntu 20.04, there is an incompatiability with openjdk. It may be necessary to install a previous version using
apt install openjdk-11-jre-headless=11.0.7+10-3ubuntu1or similar (you can find which versions are available withapt-cache policy openjdk-11-jre-headless