# 2026-07-17 -- office1-netbox apex recovery + restart policy + edge-WAN import (Block A)

## Context

Asked to run the D-124/edge-WAN NetBox imports while access was up, I found the **IPAM apex was DOWN**:
the `netbox-docker` stack (NetBox 4.6, `/opt/netbox-docker`) had cleanly exited (0) ~3h earlier and was
not auto-restarting (its instance was stopped/rebooted). Operator approved bringing it up + adding a
restart policy.

## What changed (on office1-netbox, 10.10.1.10 -- host state, NOT repo-tracked)

- **Apex brought up:** `cd /opt/netbox-docker && sudo docker compose up -d` -> all 5 containers healthy;
  NetBox answers HTTP 302 on `:8000`.
- **Restart policy added:** `docker-compose.override.yml` now sets `restart: unless-stopped` on all five
  services (netbox, netbox-worker, postgres, redis, redis-cache) -- verified via `docker inspect`. So the
  apex survives its instance's reboots (incl. the upcoming bookend). Original override backed up on the
  host as `docker-compose.override.yml.bak-20260717`. (Config `docker compose config`-validated before
  apply.)

## Apex writes (Block A -- gated, dry-run-verified then committed)

- **`d115-office-carve.py` (dry-run):** all 11 objects already present (office+edge roles, site vr1-off1,
  prefixes) -- no-op; edge-WAN precondition satisfied.
- **`dc-edge-wan-import.py --commit`:** CREATED **172.30.2.0/24** (id=135, role=edge, scope=vr1-dc0) +
  **172.30.3.0/24** (id=136, role=edge, scope=vr1-dc1). Re-run dry-run confirms both EXIST (0 to create).
  Token read server-side (`sudo cat /root/netbox-secrets/api.token` ON the apex host) -- never entered
  agent context. Sandbox target (localhost) -- no upstream write; `netbox.baldurkeep.com` untouched.

## BLOCKED -- Block B (D-124 rack transit + rack IP)

`dc-rack-mgmt-import.py` fails its precondition: **`role 'transit' absent`**. The D-124 transit role +
the `172.31.0.0/24` container have **no seeder** (the importer is deliberately die-if-absent). Needs a
`transit`-role + `172.31.0.0/24`-container seed first -- pending an operator decision on tooling (write a
`d124-transit-seed` + harness, extend `d115-office-carve`, or defer -- Block B is decoupled from the
deploy: no netbox provider in the tree).

## Revert

- Edge /24s: delete prefixes id=135,136 in NetBox (or `dc-edge-wan-import` has no un-import; delete via UI/API).
- Restart policy: restore `docker-compose.override.yml.bak-20260717` + `docker compose up -d`.
- Apex up/down is operational state, not a repo change.