Tracked configs & transports

A tracked config is the unit the tracker watches: one device, its version history and its baseline. It doesn’t hold connection details itself — those live on a reusable source. The split is deliberate: a source describes how to reach a device, the recipe describes what to fetch, and the tracked config binds them to a specific box.

Term	What it is
Source	A named connection: a transport, a target host, a port, an optional credential and the collector that reaches it. One source can serve many tracked configs.
Transport	How the collector talks to the device — one of ssh, telnet, scp, sftp, http, https. The transport fixes which connection settings the source carries.
Target	The device address, held as a network object of type host or fqdn. A subnet or range is rejected — a source points at exactly one host.
Tracked config	A name, one source, an optional recipe override, and the device address(es) to collect from. Carries the snapshots, the baseline and the drift status.
Collector	The reachability domain that runs the collection. Every source is bound to one; the built-in embedded collector is the default.

A source’s transport decides both the connection settings it carries and whether it needs a credential.

Transport	Default port	Needs a credential?	Use it for
ssh	22	Yes	CLI gear — run show/running commands and capture the output.
telnet	23	Yes	Legacy CLI gear with no SSH.
scp	22	Yes	Boxes that hand you the config as a file over SCP.
sftp	22	Yes	Boxes that hand you the config as a file over SFTP.
http	80	No	API-driven platforms (a token can ride in a header or the URL).
https	443	No	API-driven platforms over TLS.

• CLI transports (ssh, telnet) run a CLI recipe — an ordered list of commands — and capture the output. The netmiko driver on the recipe drives the session.
• File transports (scp, sftp) pull a config file straight off the device. The remote path lives on a file recipe, not on the source — the source is the connection, the recipe is what to fetch.
• API transports (http, https) run an HTTP recipe that carries its own request — method, path, headers and an optional body — so a custom recipe can fetch essentially any file or endpoint a device exposes.

SSH-family sources pin the device’s host key in Taranac’s own store (not OpenSSH known_hosts), keyed per (collector, address, port). A source picks a host-key policy:

Policy	Behaviour
trust_on_first_use	Default. Pin the first key seen (only after a successful collect), then refuse any later key that doesn’t match — the change is recorded as a candidate for you to review.
trust_always	Accept whatever key is presented and pin nothing. For lab or already-trusted paths only.
strict	Require a key that is already pinned; an unknown or changed key is refused.

When a pinned key changes, the connection is refused and the new key is stashed as a candidate — Taranac never silently re-pins. An operator re-trusts it explicitly (or resets the pin to re-learn from scratch). Every pin, accept and reset is audited.

An http/https source carries the connection half of the request; the recipe carries the rest:

• Base path — a path-only prefix that must start with / (no scheme, host, query or fragment). The host and port come from the source’s network object.
• Method — GET (default) or POST.
• Headers — static request headers.
• Body template — an optional request body.
• TLS verify (https only) — off by default, because device management APIs are commonly self-signed. Turn it on where the device presents a trusted certificate.

Base path, headers and body may reference credential fields with {{cred.*}} placeholders so a token from the vault is injected at collection time rather than written into the source.

Sources live under Configuration Tracker → Settings → Sources; tracked configs under Configuration Tracker → Configs.

Add a source and set:

• Name — required, unique across all sources.
• Transport — one of the six above; it decides the rest of the form.
• Target — the network object (host or fqdn) to reach.
• Port — optional; blank uses the transport’s default.
• Credential — the vault entry to authenticate with (required for ssh/telnet/scp/sftp).
• Collector — the reachability domain that will do the collecting.
• Transport settings — host-key policy for SSH-family, or base path / method / headers / body / TLS-verify for HTTP(S).

The Sources list shows each source’s transport, resolved address:port, collector, whether a credential is attached, and a Used by count you can expand to see which tracked configs depend on it.

Sources across every transport — SSH, HTTP, SCP, SFTP and HTTPS — each with its target address, collector, credential and reference count.

From Configs, choose Track a config for a single device (or Onboard (bulk) to import a whole pool). Set:

• Name — required. Names need not be globally unique; the real identity is the address + collector + recipe.
• Source — the connection to use.
• Recipe — optional. Blank means “use the default recipe resolved at collection time”; set one to override what this config fetches.
• Addresses — one or more concrete device addresses (a host, not a subnet), each scoped to a collector. These are what the AAA activity correlation matches on.

On save you land on the config’s detail page, where you can Collect now, watch the version history build, and later pin a baseline.

The Configs list shows each config’s source, whether a baseline is set, its derived status (OK / Drifted / Failing / Collector offline / Never collected / Disabled), the last-changed version and the last-checked time.

A rack of identical switches. Create one source per switch (or bulk-onboard the pool), all pointing at the same SSH credential and the “Cisco IOS — running-config” recipe. Each becomes its own tracked config with its own history and baseline.

A firewall that only speaks its API. Use an https source with TLS-verify on (the firewall presents a real cert), an HTTP recipe whose request pulls the config export endpoint, and a token-type credential referenced from the header via {{cred.token}}.

A box that only hands you a file. Use an scp or sftp source plus a file recipe carrying the remote path (e.g. /config/running). Taranac pulls the blob and versions it like any other capture.

A remote site behind NAT. Point the source’s collector at a standalone collector deployed at that site; the source and recipe are otherwise identical to a local one.

The device…	Transport
Exposes a CLI over SSH and you run show running-config	ssh
Only offers Telnet	telnet
Serves its config as a downloadable file	scp or sftp
Is driven entirely through a REST/HTTP API	http or https

Prefer ssh over telnet and https over http wherever the device supports it. For file transports, choose whichever of SCP/SFTP the device implements — the recipe side is identical.

Source fields:

Field	Notes
Name	Required, unique.
Transport	ssh · telnet · scp · sftp · http · https.
Target (network object)	Host or fqdn only; no subnet/range. Supplies the address.
Port	Optional; blank → transport default (22/23/22/22/80/443).
Credential	Required for ssh/telnet/scp/sftp; not needed for http(s). Detaching a deleted credential leaves the source credential-less rather than erroring.
Collector	Required; the reachability domain.
Transport settings	Per-transport: host-key policy (SSH family) or base path/method/headers/body/TLS-verify (HTTP family).

Tracked-config fields:

Field	Notes
Name	Required; not globally unique.
Source	Required; deleting a source in use is blocked while configs reference it.
Recipe	Optional override; blank resolves the default at collection time.
Addresses	One or more concrete host addresses, each collector-scoped; used for AAA correlation.
Enabled	Only enabled configs are collected by the scheduled sweep.

• Recipes & scrub sets — what a source fetches, and cleaning it.
• Credentials & the vault — the credential a source authenticates with.
• Collectors — the reachability domain a source is bound to.
• Bulk onboarding — create many sources and configs at once.
• Snapshots, diff & drift — what a collection produces.