Inventory file reference

An inventory file lists the devices port49 serves: their names, platforms, addresses, attributes and the key that admits each. It is one YAML document; an unknown key (a typo such as keyref: for key_ref:) or a second document is refused, so a mistake cannot silently un-pin a device onto a group key.

The key_groups: block is read from the policy file, where key assignment is reviewed. A block here still loads, with a notice, until it is moved; where both files have one, the policy file's wins.

Paths below use [] for an item of a list.

devices

Key	Type	Description
devices.[].name	string	The device's name, which policy scopes, tests and the log use.
devices.[].platform	string	The device's platform, lowercase letters, digits and _, matching an adapter in the pinned platform set or one the policy file defines. A platform with no adapter gets the generic one.
devices.[].addresses	list of string	The IP addresses the device's connections come from, as a list. A connection is matched to its device by source address.
devices.[].attributes	map of string	Free key and value pairs, such as site, role and os_version, that scopes match on and key groups can match on.
devices.[].key_ref	string	Pins the device to one key, by name. The key is a name that the policy file's keys: block (or port49d's) defines; it never holds the secret.
devices.[].transport	string	How the device speaks TACACS+: tcp (default), obfuscated under a shared key, or tls, mutual TLS with no shared key. Any other value makes the device refused rather than the file.

key_groups

Key	Type	Description
key_groups.[].match.cidr	string	Matches the devices whose address is in this prefix, written without host bits. A group needs cidr or attributes; one with neither is refused.
key_groups.[].match.attributes	map of string	Matches the devices whose attributes equal all of these pairs.
key_groups.[].key_ref	string	The key that devices in the group are admitted under. Required. A key name: lowercase letters, digits and _, starting with a letter, at most 64, and not the reserved single_device.