winget install --id=holland-built.Bloxsmith -e Bloxsmith is a single static binary that embeds its React UI, proxies the Infoblox BloxOne/CSP APIs, and self-updates from GitHub Releases.
Self-hosted workbench for your Infoblox Portal / CSP data.
| Subnets & DHCP | leases, utilization, exhaustion |
| DNS & zones | records, zones, query rates |
| Security & threat feeds | policies, indicators, audit logs |
| Single Go binary | embedded UI, no runtime deps |
| Encrypted vault | tenant keys AES-encrypted at rest — protects a stolen disk, not a live machine |
| Optional AI query box | natural-language over your data |
What each tab does → — all 15 tabs, which ones write to Infoblox, and how the dry-run/apply flow works.
Four steps, about five minutes. You do not need to be a developer, and you do not need to know anything about how Bloxsmith is built.
Install Docker Desktop — free, and available for Windows, macOS and Linux. Open it once after installing and leave it running. This is the only thing Bloxsmith needs.
Copy the whole block for your computer and paste it into a terminal — that's
Terminal on macOS and Linux, or Command Prompt on Windows (press
Win, type cmd, hit Enter). Paste it all at once; you do not need to
run the lines one at a time.
macOS
mkdir -p ~/Bloxsmith && cd ~/Bloxsmith
curl -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/docker-compose.yml
curl -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/update.command
chmod +x update.command
Windows
mkdir "%USERPROFILE%\Bloxsmith" 2>nul
cd /d "%USERPROFILE%\Bloxsmith"
curl.exe -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/docker-compose.yml
curl.exe -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/update.bat
Linux
mkdir -p ~/Bloxsmith && cd ~/Bloxsmith
curl -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/docker-compose.yml
curl -fsSLO https://raw.githubusercontent.com/holland-built/bloxsmith/master/update.sh
chmod +x update.sh
The first file tells Docker how to run Bloxsmith. The second is the button you press later to get a newer version — keep both together in that folder.
In that same terminal window:
docker compose up -d
The first run downloads Bloxsmith and takes a minute or two; after that it starts in seconds. It keeps running on its own, and starts again by itself when you restart your computer.
Go to ****. Bloxsmith asks you to pick a passphrase, then to paste an Infoblox API key — see the next section for where to find one. Your keys are scrambled before they're saved, and they survive restarts and updates, so this is a one-time step.
Something already using port 8080? Open docker-compose.yml in any text editor and
change PORT — full options are in docs/DEPLOYMENT.md.
Other ways to install (Homebrew, one-line installer, plain Docker)
These skip Docker Compose. They work, but the update scripts above do not apply to them — each has its own update method, listed under Keeping it up to date.
Docker without Compose — any OS
docker run -d --name bloxsmith \
-p 127.0.0.1:8080:8080 -v noc-vault:/vault \
--restart unless-stopped \
ghcr.io/holland-built/bloxsmith:latest
macOS — Homebrew
brew install holland-built/tap/bloxsmith
bloxsmith
Windows — installer script. Open Command Prompt, then paste:
powershell -Command "iwr -UseBasicParsing -OutFile install.ps1 https://github.com/holland-built/bloxsmith/releases/latest/download/install.ps1"
powershell -ExecutionPolicy Bypass -File .\install.ps1
The same two lines also work in PowerShell. powershell -Command is what makes
iwr run from cmd.exe.
macOS / Linux — installer script
curl --proto '=https' --tlsv1.2 -fsSLo install.sh https://github.com/holland-built/bloxsmith/releases/latest/download/install.sh
sh install.sh
The script installers ask one yes/no question at the end (whether to start Bloxsmith at login) — answer it and you're done. Either way, open next.
The bloxsmith command holds the terminal open — close it with
Ctrl+C, or run bloxsmith service install once to start it
automatically at login instead.
Read the installer before running it. The installers check a SHA-256 checksum and an Ed25519 signature and refuse to install if either fails — but you should still read what you run. Paste the first line of a block above on its own, then:
less install.sh # macOS / Linux — press q to quit
notepad install.ps1
…and paste the second line once you're happy.
How the installers verify downloads & where they land
Read it before you run it — that's what inspecting the script first is for. Both installers verify the release's SHA-256 checksum and refuse to install on a mismatch, and install.sh also verifies an Ed25519 signature over checksums.txt against a public key pinned in the script itself — so the thing deciding whether a release is genuine does not travel with the release. It refuses to install if that signature is missing or does not verify, because an attacker who can replace release assets would simply delete it. Verification uses ssh-keygen, which ships by default on macOS, Linux and Windows, falling back to OpenSSL 3.x. The OS binaries themselves are still unsigned for Gatekeeper/SmartScreen purposes — see Code signing policy.
bloxsmith in ~/.local/bin (no sudo; override with --prefix DIR, pin with --version vX.Y.Z).bloxsmith.exe in %LOCALAPPDATA%\Programs\Bloxsmith and adds it to your user PATH. Reopen the shell, then run bloxsmith.Later, from a terminal:
bloxsmith # start it → http://localhost:8080
bloxsmith --port 9090 # use a different port (or set PORT=9090)
bloxsmith service install # run it in the background at login
bloxsmith update # upgrade in place
Port 8080 is the default for every install method. If it's already taken (the Docker stack also uses 8080), Bloxsmith tells you and suggests --port rather than crashing.
Nothing updates on its own. Bloxsmith checks once a day and shows a small banner when a newer version is out; you decide when to take it.
If you installed with the four steps above, open the Bloxsmith folder you made in step 2 and:
| Your computer | What to do |
|---|---|
| macOS | Double-click update.command |
| Windows | Double-click update.bat |
| Linux | Run ./update.sh |
Each one fetches the newer version and restarts Bloxsmith. Your passphrase, keys and saved views are kept. It takes about a minute, and the dashboard is briefly unavailable while it swaps over.
Prefer to type it yourself? docker compose pull && docker compose up -d in that
folder does exactly the same thing. If you used one of the other install methods,
use the version badge → Update now in the dashboard, or run bloxsmith update.
Full update modes → docs/DEPLOYMENT.md#updating.
Run as an always-on server (LAN, compose, secure proxy)
> [!WARNING] > LAN mode has no login. Anyone on the network can reach the dashboard and query your Infoblox tenant. Keep the vault locked when not presenting, or use a secure proxy.
Binding 0.0.0.0 (Docker) or BIND=0.0.0.0 (compose) instead of 127.0.0.1 exposes the dashboard on the LAN with no auth in front of it. Pinning an exact version instead of :latest freezes the deploy — and opts you out of updates, including the Update now button (how to pin). Tenant keys live AES-encrypted in the noc-vault volume and survive updates, restarts, and container recreation. With auto-unlock enabled the passphrase necessarily lives on the same machine, so that encryption protects a stolen disk or backup — not a host someone already has a process on. What it is worth, exactly.
Full compose / secure-proxy / Customer-install steps → docs/DEPLOYMENT.md.
Backing up the vault
bloxsmith vault-backup ./backup.tar.gz copies the whole state directory — the encrypted vault, saved views, brand and audit log — into one 0600 archive; bloxsmith vault-restore ./backup.tar.gz --confirm restore puts it back. No passphrase either way: vault.json is already encrypted, so the archive is exactly as secret as the passphrase that opens it. From Docker, docker compose exec bloxsmith bloxsmith vault-backup /vault/backup.tar.gz then docker cp bloxsmith:/vault/backup.tar.gz .. The audit signing key and .env are deliberately not in it — what that means, and the restore guards.
Uninstalling
Each install method removes cleanly. Config + the encrypted vault are kept by default so a reinstall keeps your tenants — add the purge flag to delete them too.
Docker Compose (the four-step install above) — from your Bloxsmith folder:
docker compose down # stop it, keep your keys
docker compose down -v && docker volume rm noc-vault # also delete the vault
macOS / Linux (same script, --uninstall):
sh install.sh --uninstall # remove binary, templates, login service
sh install.sh --uninstall --purge # also delete config + vault
Windows (same script, -Uninstall):
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Uninstall
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Uninstall -Purge
Homebrew — unregister the login service first (brew doesn't know about it), then uninstall:
bloxsmith service uninstall # stop + remove the login service
brew uninstall bloxsmith
rm -rf ~/Library/Application\ Support/bloxsmith # optional: config + vault (macOS)
Docker without Compose:
docker rm -f bloxsmith && docker volume rm noc-vault # volume rm also drops the vault
AI query box (optional)
The natural-language query box needs an LLM with tool-calling; everything else works without it. Default is Groq (free tier — fast, free models, good for demos): get a key at and set it in the dashboard (sidebar → ⚙ AI provider) or via GROQ_API_KEY. Any OpenAI-compatible provider works — see docs/DEPLOYMENT.md.
Bloxsmith releases are built and published from GitHub Actions.
OS trust. The Windows and macOS binaries are not code-signed (no Apple notarization, no Windows Authenticode), so a first run trips OS gatekeeping: macOS Gatekeeper — right-click → Open, or xattr -dr com.apple.quarantine the binary; Windows SmartScreen — More info → Run anyway. This applies to the Homebrew and installer-script methods only; the Docker install never puts a binary on your machine.
Supply-chain provenance. Two independent signatures, because they answer different questions.
Ed25519, checked automatically. checksums.txt is signed with an Ed25519 key held only in this repository's GitHub Actions secrets, in two formats: a raw signature the compiled-in verifier reads with no dependencies, and an SSH-format one (checksums.txt.sshsig) that ssh-keygen verifies — chosen because OpenSSH is present by default on macOS, Linux and Windows while OpenSSL 3.x is not (macOS ships LibreSSL, which cannot verify raw Ed25519 at all). The public half is compiled into every binary (go/signing.go) and pinned in install.sh. Both the installer and the updater refuse when the signature is missing — treating an absent signature as "checksum only" would let an attacker turn the control off by deleting one file. The in-app updater refuses to apply a release whose signature is missing or does not verify — before it looks at the checksum at all, because a checksum fetched from the same release as the archive proves the download is intact, never that this project published it. CI refuses to publish an unsigned release, so a missing signature is not a degraded release; it is a tampered one.
What this does not cover: anyone who can push a tag, or who steals the Actions secret, can still produce a signature that verifies. It stops an attacker who can write release assets, not one who owns CI. Rotating the key means shipping a new binary — the price of an anchor that does not live in the release.
Cosign, checked by hand. checksums.txt is additionally keyless-signed in CI using the workflow's GitHub OIDC identity — the same mechanism that signs the ghcr container images. This proves which workflow run built the artifacts and is verifiable by a third party with no prior knowledge of this project. Neither signature is OS trust, and neither removes the warnings above. Verify:
cosign verify-blob \
--certificate checksums.txt.pem --signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/holland-built/bloxsmith/\.github/workflows/release\.yml@refs/tags/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
checksums.txt
Report signing issues at the GitHub issue tracker.
Everything below is for developers working on Bloxsmith.
How it works
browser ──HTTP──▶ bloxsmith (Go binary) ──MCP──▶ csp.infoblox.com/mcp
└── optional: LLM (Groq / OpenAI-compatible) for NL queries
The binary exists because browsers can't call the Infoblox MCP endpoint directly — CORS, and MCP is JSON-RPC/SSE. It's the server-side hop that holds your API key.
More ways to run (single-key env, Compose, secure proxy, build from source)
# Single key, skip the vault:
docker run -d --name bloxsmith -p 127.0.0.1:8080:8080 \
-e INFOBLOX_API_KEY="Token " ghcr.io/holland-built/bloxsmith:latest
# Compose (always-on servers / Proxmox):
BIND=0.0.0.0 docker compose up -d # LAN
docker compose --profile secure up -d # + Caddy TLS + basic-auth
# Build from source (dev) — Go 1.26+:
git clone https://github.com/holland-built/bloxsmith && cd bloxsmith
cd ui && npm ci && npm run build && cd .. # Vite build → refreshes the embedded UI (go/web/)
cd go && go build -o bloxsmith . && ./bloxsmith # → http://localhost:8080
scripts/dev-serve.sh [port] # LIVE dev (default :8090): edit ui/src → Vite
# rebuild → go/web, binary serves from disk via WEB_DIR
Full steps, the deploy matrix, auto-unlock, and pinning → docs/DEPLOYMENT.md.