DECATHLON NETDEVOPS

NetDevOps-Backend
Project Analysis

Network Operations Automation Platform — Full Lifecycle Management for Retail Networks

Django 5.1 + DRF 3.15 Cisco Meraki API Dify AI Integration Docker + Jenkins CI/CD
01

Project Overview

Project Purpose

NetDevOps-Backend is a backend API platform for network operations automation, serving the daily management of Decathlon's retail network. Centered on Cisco Meraki cloud-managed devices, providing full lifecycle management for store networks.

Automated Provisioning

New store network auto-setup

🔍

AI Inspection

Dify-powered network analysis

🔄

Batch Operations

Mass config & port management

🔒

Approval Workflow

Change management & audit

Tech Stack

WebDjango 5.1.2 + DRF 3.15.2
ServerDaphne (ASGI) / uWSGI (WSGI)
DatabaseMySQL (Read/Write Splitting)
ProcessSupervisord
SchedulerSupercronic + APScheduler
ExternalMeraki API v1, Dify AI
AuthJWT + OAuth2 + HMAC
EncryptionAES-ECB, PyJWT, SHA256
DeployDocker + Jenkins CI/CD
PDFpdfkit + wkhtmltopdf
02

Key Metrics

11
API Modules
30+
Meraki API Calls
8
Background Workers
4
Auth Methods

API Route Structure /open-api/

👤 /user/*

User management & auth

🛡 /role/* & /pagepower/*

Role & permission control

🌐 /manage/*

Network device management

🏪 /retail-opening/*

New store opening

✅ /approval/*

Approval workflows

🤖 /ai/*

AI inspection & alerts

🔄 /aoa/*

AOA FQDN management

📋 /sopo/*

SOPO external interface

📡 /openapi/*

OpenAPI external interface

03

Layered Architecture

Controller
HTTP Requests Parameter Formatting PaiopsView PaiopsNeedLoginView SopoApiView (HMAC) OpenApiView (HMAC)
Service
userpower manage retailopening aoa ai approval logs systemsettings sopo openapi
Utils / API
basictools.py meraki_utils/requestBase.py dify_api.py mail.py backendprocess.py exec_utils/

Database Read/Write Splitting

Write Operations

Default connection → MySQL port 3308

Read Operations

Read connection → MySQL port 3308 (separate)

Implemented via DbReadWriteRouter — reserves space for scaling read replicas

04

Deployment Architecture

All processes managed by Supervisord (PID 1) inside Docker container

uWSGI
Django WSGI application — HTTP API server
supercronic
Scheduled tasks: log rotation (10min), table cleanup (2AM daily)
runretailopenings
New store opening background worker
execapprovals
Approval task execution worker
sendmail
Email sending worker (SMTP + starttls)
aoa-crond
AOA FQDN scheduled task worker
sync-networks
Network data sync worker
inspection-worker
Inspection task execution worker
inspection-plan-scheduler
Inspection plan Cron scheduler
9
Active Workers

High Availability

Master-slave election via BackendProcesses table. Heartbeat timeout: 2 min. Auto-failover to standby.

Process Monitoring

Supervisord auto-restart on failure. Stdout logging to container logs.

05

User & Permission Management

Authentication Methods

🔑 JWT Token

Internal frontend users
PaiopsNeedLoginView → LoginedUsers table

🌏 OAuth2 SSO

Decathlon internal employees
OauthService → Decathlon IdP → Auto-create local account

🔐 HMAC (SOPO)

SOPO third-party system
SHA256("net-devops-{SECRET}-{timestamp}") — 5min validity

🔐 HMAC (OpenAPI)

External systems
Same HMAC mechanism, independent OPENAPI_SECRET

Permission Model

User ↔ Role ↔ PagePower ↔ PowerApi

Role

User role set; admin role has full permissions

PagePower

Frontend menu/page-level control (2 levels: menu + submenu)

PowerApi

Backend API path-level permission control

Verification Flow

Token Extract
Validate
Check Active
Admin? → All
Check powerapis

Passwords: AES-ECB | Tokens: JWT (HS256, 24h) | API signing: SHA256

06

Network Device Management

Core module — directly interacts with Cisco Meraki Dashboard API v1 via meraki_utils/requestBase.py

Network

Network Management

• List all Meraki Networks
• VLAN info & configuration
• Single / Batch update
• Get devices per Network

Switch

Switch Management

• List all switches
• Port list & batch update
• Update by Network tags
• Device type & tag options

AP

AP Management

• List all APs
• Batch update APs
• Add new APs

Client

Client Management

• List network clients
• Client policy management
• Batch policy updates

Template

Template & Config

• Configuration templates
• Switch access policies
• Wireless SSID config
• DHCP fixed IP assignments

Log

Change Logs

• Meraki config change logs
• Administrator list

30+
API Methods
20
Action Batch Max
3x
Rate Limit Retry
07

New Store Opening

Core business process — automated network provisioning for new stores with checkpoint-resume execution

User-Facing Four-Step Process

Step 1
Site Information
Step 2
Device Serial Numbers
Step 3
VLAN IP Configuration
Step 4
Confirm & Submit

Background Auto-Execution RunRetailOpeningThread

Create
Network
Bind
Template
Set
VLAN IP
Claim
Devices
Configure
Devices
Set
Mgmt IP

⚠ Error Handling

Each step has independent success/failure flags. Failed steps return to corresponding Step for user correction. Completed steps auto-skip on retry.

✅ SOPO Integration

External SOPO system can also create opening work orders via HMAC-authenticated endpoints, enabling automated CI/CD pipeline integration.

08

Approval Workflow

Approval State Machine

pending accept running successed failed expired cancel
pending reject pending without (no approval needed)

Execution Flow

1. Initiate Change

User triggers network operation requiring approval (batch port modification, DHCP config, etc.)

2. Approval Decision

Email notification → Approver approves with scheduled time OR rejects with comments

3. Auto-Execution

execapprovals process executes at scheduled time using dynamic importlib loader

Execution Actions

DHCP

DhcpOnOff, DhcpDns, DhcpBootOption, FixedIp, ReservedIp

Network

RebootDevices, VPN Hubs, Access Policy, Rollback Alert Tags

SwitchPort

ChangePort, ChangePortByNetworkTags, RollbackChangePort

AP / Template / Client

AddAP, DeleteAP, MoveAP, SwitchAccessPolicy, ChangeClientGroupPolicy

09

AI Inspection & Alerts

Integrated with Dify AI Workflow for intelligent network inspection and alert analysis

Inspection Flow

User / Plan
Trigger
InspectionQueue
(pending)
inspection-worker
Pickup
Dify AI
Workflow
Markdown
Report
Status
Update

Inspection Status Categories

✅ Healthy 👍 Good ⚠ Warning ❌ Failure 🔌 Partial Outage ❓ Other

Inspection Plans

• Cron-based auto-scheduling
• Associate with multiple Network IDs
• Enable/disable toggle
• Execution logs in InspectionPlanLog

Inspection Dashboard

Status Statistics

Bucketed by All / Retail / Office / Warehouse

Coverage Rate

(Total - Uninspected) / Total × 100%

Alert Analysis

Meraki Assurance Alerts + Dify AI analysis workflow

Report Export

Markdown → HTML → PDF (with Twemoji images)

10

External Integration

🌐

Cisco Meraki

Dashboard API v1

• 30+ wrapped API calls
• Auto rate-limit retry (3x)
• Link Header pagination
• Action Batch (20 actions/batch)
• Network/Device/Switch/AP/Client/VPN/Template/Alert management

🤖

Dify AI

SSE Streaming

• 2 Workflow integrations
• Inspection Analysis (DIFY_API_KEY)
• Alert Analysis (DIFY_API_KEY_ALERT_ANALYZER)
• SSE workflow_finished event
• Markdown report generation

🔒

Decathlon IdP

OAuth2 SSO

• Authorization endpoint
• Token endpoint
• User info (OpenID)
• Auto-create local accounts
• First-login admin notification

AOA FQDN & DNS Management

DNS Resolution

Dual DNS servers: 114.114.114.114 / 8.8.8.8

Library: dnspython

Update Modes

Full & incremental FQDN updates via aoa-crond worker. Dynamic cron rescheduling. Failure email notifications.

11

Data Model Relationships

Core Entity Relationships

UserRolePagePowerPowerApi
├─ LoginedUsers (login state, 1:N)
└─ LoginLogs (login logs, 1:N)
RetailOpeningEvents (step_data JSON)
PlanExecApproval → exec_utils/
Networks
├─ InspectionQueue
├─ InspectionPlan → InspectionPlanLog
└─ Aoa → AoaLogs

System Configuration Models

SystemSettings

Differentiated by type field (mail/hubs/s-p-r-e), JSON content storage

SystemSettingsIpNet

IP subnet pool → auto-allocate during store opening

SystemSettingsTemplate

Network type templates (Retail/Office/Warehouse)

SwitchPortDeviceTypes

Port device type configuration

MailQueue

Email sending queue

BackendProcesses

Background process registry & heartbeat

12

Utility Components

ComponentDescription
BaseLoginUtilsUser login/logout, JWT generation, info assembly
PaiopsAesAES encryption/decryption, SHA256 hashing
BasicModelListGeneric paginated list (ORM + raw SQL)
BasicModelCreateGeneric model creation
BasicModelUpdateGeneric model update with callback
BasicManyToManyGeneric M2M relationship operations
BasicRunSqlRaw SQL execution utility
ComponentDescription
requestBaseMeraki API wrapper (30+ methods)
call_dify_workflowDify AI SSE invocation
DktMailToolsEmail notifications (SMTP + starttls)
BackendProcessBasicToolsProcess election, heartbeat, logging
ModelSerializersModel serialization utilities
PaiopsJsonResponseUnified JSON response format
httpresultUnified error codes (4001~4043)

Scheduled Tasks

10min
Log Rotation
2:00AM
Table Cleanup
180d
Log Retention
50KB
Log File Size

Ready to Deploy

NetDevOps-Backend — Powering Decathlon's retail network automation with intelligent operations and AI-driven insights.

Django 5.1 Meraki API Dify AI Docker
or Space to navigate