Recipes & scrub sets

Where a source says how to reach a device, a recipe says what to fetch once connected. And before any capture is stored, a scrub set cleans it — stripping the volatile lines that would create false diffs and masking the secrets that must never land in a snapshot.

A recipe has a kind that matches the transport family it runs on, an optional netmiko driver, and a link to a scrub set. Recipes live under Configuration Tracker → Settings → Recipes.

Kind	Runs on	What it carries
cli	ssh, telnet	An ordered list of commands (e.g. show running-config). Each step is one command; the output is captured in order.
http	http, https	Exactly one request: a method, a path, static headers and an optional body_template.
file	scp, sftp	One remote_path — the file to pull off the device (up to 512 characters).

• CLI recipes are the common case. The netmiko driver on the recipe (a device type like cisco_ios, arista_eos, juniper_junos) drives the terminal session. Leave it blank and Taranac falls back to a sensible default at collection time; set it from the built-in platform picker, which lists every netmiko driver installed.
• HTTP recipes are the open door: because the request is yours — path, headers, body — a custom recipe can fetch essentially any file or endpoint a device’s API exposes, not just a fixed command. Headers and body may reference vault fields with {{cred.*}} placeholders.
• File recipes carry just the remote path an SCP/SFTP source fetches.

A recipe can trim each step’s output before it even reaches the scrub set — skipping a fixed number of lines top or bottom, or keeping/rejecting lines by regex. This is handy for lopping off a command echo or a trailing prompt that would otherwise show up as noise. (For content-based cleanup — masking secrets, dropping timestamps — use a scrub set, below.)

Taranac seeds a running-config recipe for the major platforms, each already wired to a matching scrub set:

Recipe	Driver	Command
Cisco IOS — running-config	cisco_ios	show running-config
Cisco NX-OS — running-config	cisco_nxos	show running-config
Cisco ASA — running-config	cisco_asa	show running-config
Cisco IOS-XR — running-config	cisco_xr	show running-config
Arista EOS — running-config	arista_eos	show running-config
Juniper Junos — configuration	juniper_junos	show configuration | no-more
Huawei VRP — running-config	huawei	display current-configuration
FortiGate FortiOS — full-configuration	fortinet	show full-configuration
MikroTik RouterOS — export	mikrotik_routeros	/export terse
Aruba AOS-CX — running-config	aruba_aoscx	show running-config
Dell OS10 — running-configuration	dell_os10	show running-configuration
Extreme EXOS — configuration	extreme_exos	show configuration

A generic HTTP GET starter recipe ships too, as a template for API-driven platforms. Seeded recipes are marked System, but they are fully editable, cloneable and deletable — and your edits survive a container rebuild. The usual pattern is to clone a system recipe and tweak the copy.

The recipe catalog: CLI, HTTP and FILE kinds, each with its netmiko driver and a System/Custom origin.

A scrub set is an ordered list of rules applied to a capture inside the collector, before the snapshot is persisted. It does two jobs:

• Strip volatile lines — timestamps, uptime counters, “current configuration” save headers: the lines that change every capture and would otherwise make every diff noisy and every config look drifted.
• Mask secrets — replace password/community/key values with a stable placeholder (••••••••) while keeping the line’s structure, so a snapshot is safe to store, diff and share but no plaintext secret is ever written.

Scrub sets live under Configuration Tracker → Settings → Scrub Sets, and attach to a recipe (not to a tracked config), so every config using that recipe is cleaned the same way.

Each rule has a stage, a regex pattern, and (for masking) an optional replacement. Stages are applied in order, and per line the strongest action wins (drop → mask → keep):

Stage	Effect
drop_volatile	Delete the whole matching line (timestamps, counters, save headers).
mask_secret	Replace the secret value in the line with the placeholder; keep the line’s shape. Capture the value in a named group so only the value — not the keyword — is masked.
keep	Mark a benign line as safe, so the fail-closed backstop (below) leaves it alone.

Scrubbing is fail-closed: even if no rule matches, any line that carries a secret-bearing keyword (password, secret, key, community, pre-shared-key, …) in value position is masked anyway, and PEM private-key blocks are masked as a block. A scrub set you write is additive safety on top of that backstop — the goal is that a plaintext secret can never reach a stored snapshot, even for a platform you haven’t written rules for.

Every seeded vendor recipe ships with a matching “<Vendor> — default scrub” set carrying that platform’s drop_volatile + mask_secret + keep rules. Like recipes, they are System-marked but editable/cloneable/deletable and survive rebuilds.

Per-vendor default scrub sets, each with its rule count — applied before a capture is stored.

Track a new vendor. Clone the closest seeded recipe, set its netmiko driver and command, then clone a scrub set and adjust the volatile-line and secret patterns for that platform’s config syntax.

Kill noisy diffs. If a device stamps a timestamp or a byte-count into its config, add a drop_volatile rule matching that line to the scrub set — the next capture that differs only by that line will de-dup instead of cutting a spurious version.

Fetch a non-standard file over the API. Write an HTTP recipe with the exact method/path for the export endpoint, put the auth token in a header via {{cred.token}}, and point an https source at it.

Job	Tool
Choose which commands / request / file to collect	Recipe
Pick the terminal driver for a CLI device	Recipe (netmiko driver)
Remove a command echo or trailing prompt from one step	Recipe (per-step trim)
Strip timestamps/counters that appear inside the config	Scrub set (drop_volatile)
Mask a password/community/key value	Scrub set (mask_secret)

Recipe fields:

Field	Notes
Name	Required, unique.
Kind	cli · http · file.
Steps	CLI: ordered {command} list. HTTP: exactly one {method, path, headers, body_template}. File: one {remote_path} (≤512 chars).
Netmiko driver	Optional; validated against the installed netmiko drivers. Blank → default at collect time.
Scrub set	Optional; blank falls back to the fail-closed backstop only.
Origin	System (seeded) or Custom. System recipes are editable and cloneable.

Scrub-set fields:

Field	Notes
Name	Required, unique.
Rules	Ordered; each has a stage (drop_volatile/mask_secret/keep), a regex pattern, and an optional replacement.
Origin	System (seeded) or Custom.

• Tracked configs & transports — the source a recipe runs on.
• Snapshots, diff & drift — what the cleaned capture becomes.
• Credentials & the vault — the {{cred.*}} values an HTTP recipe injects.