winget install --id=holland-built.Bloxsmith -e Bloxsmith is a single static binary that embeds its React UI, proxies the Infoblox BloxOne/CSP APIs, and self-updates from GitHub Releases.
Self-hosted workbench for your Infoblox Portal / CSP data.
| Subnets & DHCP | leases, utilization, exhaustion |
| DNS & zones | records, zones, query rates |
| Security & threat feeds | policies, indicators, audit logs |
| Single Go binary | embedded UI, no runtime deps |
| Encrypted vault | tenant keys AES-encrypted at rest |
| Optional AI query box | natural-language over your data |
Docker (recommended) — one command, then open http://localhost:8080:
docker run -d --name bloxsmith \
-p 127.0.0.1:8080:8080 -v noc-vault:/vault \
--restart unless-stopped \
ghcr.io/holland-built/bloxsmith:latest
First run: pick a passphrase, then paste your Infoblox API key. Tenant keys live in the encrypted noc-vault volume and survive restarts and updates.
Other platforms — macOS/Linux script · Windows · Homebrew
macOS / Linux — inspect, then install; it opens the dashboard for you:
curl --proto '=https' --tlsv1.2 -fsSLo install.sh \
https://github.com/holland-built/bloxsmith/releases/latest/download/install.sh
less install.sh # read it before running
sh install.sh
Windows — paste into Command Prompt or PowerShell (each powershell line works from either); it downloads, you inspect, then it installs and opens the dashboard:
powershell -Command "iwr -UseBasicParsing -OutFile install.ps1 https://github.com/holland-built/bloxsmith/releases/latest/download/install.ps1"
notepad install.ps1
powershell -ExecutionPolicy Bypass -File .\install.ps1
Line 1 downloads it, Notepad opens it to read — close Notepad, then line 3 installs. Prefixing with powershell -Command is what makes iwr work from cmd.exe.
Homebrew (macOS / Linux):
brew install holland-built/tap/bloxsmith
Full options and deployment guidance are in docs/DEPLOYMENT.md.
How the installers verify downloads & where they land
Read it before you run it — that's what inspecting the script first is for. Both installers verify the release's SHA-256 checksum and refuse to install on a mismatch. The checksum proves the download is intact, not that the publisher is who they claim — the binary is unsigned.
bloxsmith in ~/.local/bin (no sudo; override with --prefix DIR, pin with --version vX.Y.Z).bloxsmith.exe in %LOCALAPPDATA%\Programs\Bloxsmith and adds it to your user PATH. Reopen the shell, then run bloxsmith.Later, from a terminal:
bloxsmith # start it → http://localhost:8080
bloxsmith --port 9090 # use a different port (or set PORT=9090)
bloxsmith service install # run it in the background at login
bloxsmith update # upgrade in place
Port 8080 is the default for every install method. If it's already taken (the Docker stack also uses 8080), Bloxsmith tells you and suggests --port rather than crashing.
Run as an always-on server (LAN, compose, secure proxy)
> [!WARNING] > LAN mode has no login. Anyone on the network can reach the dashboard and query your Infoblox tenant. Keep the vault locked when not presenting, or use a secure proxy.
Binding 0.0.0.0 (Docker) or BIND=0.0.0.0 (compose) instead of 127.0.0.1 exposes the dashboard on the LAN with no auth in front of it. Pin a release with a tag (e.g. :v2.0.0) instead of :latest. Tenant keys live AES-encrypted in the noc-vault volume and survive updates, restarts, and container recreation.
Full compose / secure-proxy / Customer-install steps → docs/DEPLOYMENT.md.
Updating
Bloxsmith checks GitHub daily; nothing updates without your click. Standalone: version badge → Update now, or bloxsmith update. Docker: Update now button, or docker compose pull && docker compose up -d.
Full update modes → docs/DEPLOYMENT.md#updating.
Uninstalling
Each install method removes cleanly. Config + the encrypted vault are kept by default so a reinstall keeps your tenants — add the purge flag to delete them too.
macOS / Linux (same script, --uninstall):
sh install.sh --uninstall # remove binary, templates, login service
sh install.sh --uninstall --purge # also delete config + vault
Windows (same script, -Uninstall):
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Uninstall
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Uninstall -Purge
Homebrew — unregister the login service first (brew doesn't know about it), then uninstall:
bloxsmith service uninstall # stop + remove the login service
brew uninstall bloxsmith
rm -rf ~/Library/Application\ Support/bloxsmith # optional: config + vault (macOS)
Docker:
docker rm -f bloxsmith && docker volume rm noc-vault # volume rm also drops the vault
How it works
browser ──HTTP──▶ bloxsmith (Go binary) ──MCP──▶ csp.infoblox.com/mcp
└── optional: LLM (Groq / OpenAI-compatible) for NL queries
The binary exists because browsers can't call the Infoblox MCP endpoint directly — CORS, and MCP is JSON-RPC/SSE. It's the server-side hop that holds your API key.
More ways to run (single-key env, Compose, secure proxy, build from source)
# Single key, skip the vault:
docker run -d --name bloxsmith -p 127.0.0.1:8080:8080 \
-e INFOBLOX_API_KEY="Token " ghcr.io/holland-built/bloxsmith:latest
# Compose (always-on servers / Proxmox):
BIND=0.0.0.0 docker compose up -d # LAN
docker compose --profile secure up -d # + Caddy TLS + basic-auth
# Build from source (dev) — Go 1.26+:
git clone https://github.com/holland-built/bloxsmith && cd bloxsmith
cd ui && npm ci && npm run build && cd .. # Vite build → refreshes the embedded UI (go/web/)
cd go && go build -o bloxsmith . && ./bloxsmith # → http://localhost:8080
scripts/dev-serve.sh [port] # LIVE dev (default :8090): edit ui/src → Vite
# rebuild → go/web, binary serves from disk via WEB_DIR
Full steps, the deploy matrix, auto-unlock, and pinning → docs/DEPLOYMENT.md.
AI query box (optional)
The natural-language query box needs an LLM with tool-calling; everything else works without it. Default is Groq (free tier — fast, free models, good for demos): get a key at and set it in the dashboard (sidebar → ⚙ AI provider) or via GROQ_API_KEY. Any OpenAI-compatible provider works — see docs/DEPLOYMENT.md.
Bloxsmith releases are built and published from GitHub Actions. Windows and macOS binaries are distributed via GitHub Releases with SHA-256 checksums. The binaries are not code-signed — verify a download with the checksum, and expect a first-run warning (macOS Gatekeeper: right-click → Open, or xattr -dr com.apple.quarantine the binary; Windows SmartScreen: More info → Run anyway). Report signing issues at the GitHub issue tracker.