ipam

Self-hosted IPAM for home labs

Know every address on your network.

L3T IPAM documents your VLANs, subnets and hosts — and checks them against your UniFi controller, so the spreadsheet never lies again.

Get started View on GitHub
docker compose up -d
Overview page of L3T IPAM: key figures, usage by type, security zones and a table of all networks
One container No database Zero dependencies amd64 + arm64 MIT

Everything a home lab needs. Nothing it doesn't.

Built for people who run more VLANs than rooms — and want to know what's on them.

Address grid

Every address of a subnet as a cell: static, reserved, DHCP lease, gateway, free. Click a free one to document it.

UniFi sync

Networks, fixed-IP reservations, devices, clients and firewall zones — compared with your documentation. You approve every change.

Issues that matter

Static addresses inside the DHCP range, duplicate MACs, overlapping subnets, hosts that left months ago.

Security zones

Zones from UniFi are created for you, your own ones too. Pick a colour per zone — every network wears it. DMZ is red. You'll notice.

Users and roles

Administrator, Editor, Viewer. Built-in login — no extra auth proxy needed in front of it.

Offline cleanup

Remove devices UniFi hasn't seen for weeks — manually or on a schedule, with safeguards and a backup first.

Your subnet, at a glance.

Colours follow the network's security zone. Shapes tell you the rest — and with UniFi connected, you see what's online and what's answering without being documented.

  • static
  • reserved
  • DHCP lease
  • online
  • online, not documented
Address grid of an IoT network with static, reserved and DHCP addresses, online rings and an undocumented device

Works with UniFi

Your controller knows. Now your docs do too.

L3T IPAM reads your UniFi controller through the official Integration API and shows what differs from your documentation — new devices, changed MACs, stale reservations. Nothing is applied until you say so.

  • Read-only: L3T IPAM never changes your controller
  • Handles real-world mess: soundbars bridging their surrounds, reservations for devices long gone
  • API key stays on the server; the controller certificate is pinned before the key is sent
  • Security zones are mirrored and created automatically
UniFi sync panel listing an undocumented UniFi device, a type correction, devices online but not documented, and a device offline for 64 days

Zones you can see. And manage.

Networks take the colour of their security zone — everywhere: sidebar, grid, overview. Always labelled, so colour is never the only cue.

  • Zones from UniFi appear on their own — the name stays with UniFi
  • Add, rename and delete your own zones when you document by hand
  • Seven colours validated for light and dark mode, or any colour you like
  • Networks without a zone keep a colour of their own
Zone management in L3T IPAM: list of security zones with colour, description and source, next to the overview
  • DMZexposed
  • Hotspotguests
  • Internaltrusted
  • Managementinfrastructure
  • MultimediaTV & audio
  • Serverself-hosted
  • VPNremote
  • Your ownany colour
A server network in dark mode
Dark mode
User management with the roles Administrator, Editor and Viewer
Users and roles
The overview on a phone
On your phone

Safe to put behind a tunnel.

Designed to sit behind a Cloudflare Tunnel or reverse proxy — with its own login, so you don't need another layer in front.

  • scrypt password hashes, hashed session tokens, lockout after failed attempts
  • Role checks on the server for every request
  • Strict Content-Security-Policy, CSRF protection, no framing, HSTS
  • Runs as a non-root user in the container
  • Every finding of the pre-release security review is covered by a test

Up and running in a minute.

Any Docker host works: Linux, Unraid, Proxmox, a Raspberry Pi — or a Synology.

docker-compose.yml
services:
  l3t-ipam:
    image: ghcr.io/l3t-io/ipam:2
    container_name: l3t-ipam
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - ./data:/data
    environment:
      PUID: "1000"
      PGID: "1000"
      IPAM_DOMAIN: home.arpa
  1. docker compose up -d
  2. Read the one-time setup code from the log: docker compose logs l3t-ipam
  3. Open http://your-host:8080, enter the code, create the first account.

Synology users: there's a step-by-step guide in the repository. Data lives in ./data as plain JSON with daily backups.

Free, and staying free.

No paid tier, no tracking, no account. If L3T IPAM saves you an evening, a coffee keeps it going.

Support on Ko-fi