Install NetBox on Debian with Docker, Nginx and TLS
This guide installs a single NetBox instance through the official netbox-docker release. It starts private, then publishes HTTPS only after a successful certificate request.
Before you start
Use Debian 12 or 13 with Docker Engine and the modern Compose plugin. Choose a fully-qualified domain name and make its DNS records point to the host before requesting TLS.
- The stack contains NetBox, its worker, PostgreSQL, Valkey, Nginx and Certbot.
- Four GiB RAM, two vCPU and 40 GiB free space are a practical reference; the preflight warns instead of blocking smaller labs.
- The installer does not create DNS records or firewall rules.
Use the versioned installer
The installer validates the host, prepares a fixed netbox-docker release, asks for the first administrator account without echoing its password, and starts NetBox only on localhost before TLS.
curl -fsSL https://scripts.lrq.lat/netbox/v1/install.sh | sudo bashDownloads the stable v1 path and opens the portable interactive menu.
curl -fsSL https://scripts.lrq.lat/netbox/v1/install.sh | sudo bash -s -- preflight --yesChecks platform, Docker, ports, capacity, time synchronization and partial installations without changing the host.
curl -fsSL https://scripts.lrq.lat/netbox/v1/install.sh | sudo bash -s -- tlsRequests or retries TLS after DNS and TCP ports 80 and 443 are ready.
Manual and safe installation
Use this path when every modification needs review. It uses the official netbox-docker release 5.0.2 and its recorded commit, with local files and secrets restricted below /opt/lrqnet/netbox.
sudo apt update
sudo apt install -y ca-certificates git openssl
sudo install -d -m 0750 /opt/lrqnet/netbox
sudo git clone --depth 1 --branch 5.0.2 https://github.com/netbox-community/netbox-docker.git /opt/lrqnet/netbox/netbox-docker
sudo git -C /opt/lrqnet/netbox/netbox-docker rev-parse HEADInstalls the review tools, clones the fixed official release and prints its commit so it can be compared with the documented release commit.
sudo install -d -m 0750 /opt/lrqnet/netbox/netbox-docker/env
read -rsp 'Initial NetBox administrator password: ' NETBOX_ADMIN_PASSWORD; printf '\n'
read -rsp 'Confirm password: ' NETBOX_ADMIN_PASSWORD_CONFIRM; printf '\n'
[ "$NETBOX_ADMIN_PASSWORD" = "$NETBOX_ADMIN_PASSWORD_CONFIRM" ] || { echo 'Passwords do not match' >&2; exit 1; }
[ "${#NETBOX_ADMIN_PASSWORD}" -ge 12 ] || { echo 'Use at least 12 characters' >&2; exit 1; }
NETBOX_SECRET_KEY="$(openssl rand -base64 48 | tr -d '\n')"Creates a restricted configuration directory, collects the initial password without echoing it and generates the NetBox secret locally. Do not store these values in shell history, tickets or an unencrypted backup.
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker config
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker up -d
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker psValidates the resolved Compose configuration, starts the persistent services and shows their state. Apply the reviewed Nginx and Certbot override before exposing the service publicly.
TLS, validation and maintenance
The TLS path uses Nginx and Certbot HTTP-01. If issuance fails, the public listener is removed and NetBox remains private. A systemd timer renews certificates and reloads Nginx after a successful renewal.
sudo systemctl status lrqnet-netbox-renew.timer --no-pager
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker ps
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker logs --tail=100 netbox netbox-workerChecks automatic renewal, service health and recent application logs. Review logs locally because operational output can contain private context.
sudo docker compose --project-directory /opt/lrqnet/netbox/netbox-docker downStops the stack without deleting its named volumes. Do not add --volumes unless you intentionally want to erase NetBox data.