NetScribe

A lightweight pattern for scheduled network configuration backups, built around a container runner and a Git-backed backup repository.

How It Works

NetScribe keeps the runtime and the backup target separate. The container handles orchestration; the backup repository holds scripts, targets, credentials metadata, and captured configs.

Scheduled Container

A Docker image runs on a schedule, unlocks its Git access key using runtime secrets, clones the backup repository, and starts the configured backup script.

Backup Repository

The repository contains the backup logic, target device list, username, optional encrypted access material, and the destination folder for captured configs.

Git History

Each run can commit and push captured configuration changes, leaving a normal Git audit trail for network config drift and recovery.

Container Runner

Docker Resources

The example image is Alpine based and installs OpenSSH, Git, curl, GnuPG, sshpass, Bash, nano, and netcat. It expects runtime secrets to unlock the backup repository key.

Backup Target

Repository Layout

The backup repository is expected to contain a backup-config folder for scripts and target metadata, plus a backups folder for captured device configs.

[repo root]
|-- backup-config/
|   |-- code.gpg
|   |-- targets
|   |-- username
|   `-- config-backup.sh
`-- backups/

config-backup.sh example

Operational Notes

Security And Setup

Git host keys should be pre-authorised in the image so unattended Git commands do not prompt for trust decisions during scheduled runs.

Access keys and network device passwords should be encrypted, then decoded only at runtime using orchestrator-managed secrets such as files under /run/secrets.

The included config-backup.sh example is tailored for Cisco devices, but the pattern can be adapted for other network equipment.

NetScribe is released under the GNU Lesser General Public License 3.0.