Runtime Data and Configuration#

#Runtime directory

By default, rauto stores runtime data in:

~/.rauto
├── rauto.db
└── backups/

Where:

• ~/.rauto/rauto.db: SQLite database
• ~/.rauto/backups/: backup archive directory

Both directories are created automatically when needed.

#RAUTO_HOME

If you do not want to use the default path, override it with an environment variable:

RAUTO_HOME=/data/rauto rauto web

This changes the runtime root from ~/.rauto to your chosen location.

#What is stored in SQLite

Based on the source code and README, rauto.db mainly stores:

• reusable device credential metadata and encrypted ciphertext
• saved connections, credential references, and optional device facts
• unified session records and replay events
• latest device discovery run and results
• configuration command overrides and volatile-line patterns
• command blacklist patterns
• custom device profiles
• stored command templates
• stored command flow templates
• custom TextFSM templates and command mappings
• custom show objects
• other runtime metadata

#Saved connections

For stable targets, saved connections are usually better than repeating raw connection flags every time.

#Add a connection

rauto connection add lab1 \
  --host 192.168.1.1 \
  --credential network-admin \
  --ssh-port 22 \
  --ssh-security balanced \
  --device-profile cisco_ios

#Reuse a connection

rauto exec "show version" --connection lab1

#Inspect and delete

rauto connection list
rauto connection show lab1
rauto connection delete lab1

#Credential storage behavior

Authentication records are independent from saved connections:

• saved connections store a credential_id reference
• credential secrets are encrypted before writing to SQLite
• the encryption master key is stored in the operating system keyring
• credential APIs and CLI output never return plaintext secrets
• referenced credentials cannot be deleted until connections release them

That means:

• database backups can move most runtime data
• after restoring on another machine, you may need to re-save credentials because the keyring master key is not in the archive

#Bulk import

rauto can import saved connections from CSV or Excel:

rauto connection import ./devices.csv
rauto connection import ./devices.xlsx

Supported formats include:

• .csv
• .xlsx
• .xls
• .xlsm
• .xlsb

#Inventory CLI

rauto no longer keeps a separate target record layer for inventory. Instead, saved connections act as the inventory source.

The remaining focus is group management over saved connection host names.

#Manage groups

rauto inventory group list
rauto inventory group show access --json
rauto inventory group upsert access --file ./group-access.json
rauto inventory group delete access

Groups contain a name, optional description, and host names only. Runtime variables stay in template, flow, transaction, and orchestration inputs.

#Command blacklist

Blacklist rules reject commands before they are actually sent. They apply to:

• exec
• template
• flow
• tx
• tx-workflow
• orchestrate

Common commands:

rauto blacklist list
rauto blacklist add "write erase"
rauto blacklist add "reload*"
rauto blacklist check "reload in 5"
rauto blacklist delete "reload*"

The * wildcard matches any character sequence, and matching is case-insensitive.

#Backup and restore

#Create backups

rauto backup create
rauto backup create --output ./rauto-backup.tar.gz

#List backups

rauto backup list

#Restore backups

rauto backup restore ./rauto-backup.tar.gz
rauto backup restore ./rauto-backup.tar.gz --replace

#Common flag reference

#Recording and replay

Most execution commands support --record-file and --record-level:

• key-events-only
• full

Use rauto session list/show for database records and rauto session replay to inspect recorded command output entries or replay a specific command and mode combination.

This is especially valuable for network change audits, troubleshooting, and AI execution-path debugging.