What is NetMap?

NetMap provides a complete view of a home lab or small network from a single self-hosted application. It maps topology visually with a force-directed canvas, tracks devices in a searchable inventory, monitors availability with ICMP ping and service checks (TCP, HTTP, DHCP), manages IP addresses and subnets with conflict detection, ingests firewall syslog from pfSense, OPNsense, or UniFi, and runs network discovery using a bundled Nmap scanner. Built-in tools include ping, traceroute, TCP connect, DNS lookup, SNMP probe, and a subnet calculator. Alerts can be sent via ntfy, Telegram, Signal, Email, and many other channels such as chat platforms, push services, generic webhooks, or any Apprise-supported service. Access control uses four built-in roles (SuperAdmin, NetworkAdmin, SecurityAnalyst, Viewer) with customizable permissions. The entire stack — web UI, REST API, SQLite database, and syslog receiver — runs in one Docker container configured via environment variables. No external database or message queue is required.

Should you self-host NetMap?

NetMap scores 47/100 on selfhost.directory (how scoring works) and ranks #31 of 48 in Network Monitoring. It has 153 GitHub stars.

It shipped 15 stable releases in the past year. The latest, v1.7.0, came out on 17 October 2026. New versions land roughly every 6 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is GPL-3.0-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is mitmproxy (86/100, 46 448 stars). It scores higher overall, so compare the two before you pick. See NetMap vs mitmproxy side by side.

Features

Alerting with multiple notification channels
Built-in network tools
Device Inventory
Exports and reporting
Firewall log ingestion
IP Address Management (IPAM)
Live Monitoring
Network Discovery
Network topology visualization
REST API with OpenAPI documentation
Role-based Access Control

How to configure NetMap

ACCESS_TOKEN_MINUTES15Lifetime of JWT access tokens.
Lifetime of JWT access tokens.
ACTIVE_NETWORK_PUBLIC_TARGETS_ENABLEDfalseAllow ping/traceroute/TCP to public internet addresses.
Allow ping/traceroute/TCP to public internet addresses.
values: true, false
APP_PORT8080Port the web UI and API listen on.
Port the web UI and API listen on.
APP_URLPublic URL used in password-reset emails. Set this if you're behind a reverse proxy.
Public URL used in password-reset emails. Set this if you're behind a reverse proxy.
AUTH_COOKIE_SECUREAuth cookies are marked Secure when APP_URL is https://. Set true or false only to override.
Auth cookies are marked Secure when APP_URL is https://. Set true or false only to override.
AUTH_LOCKOUT_MINUTES15Duration of account lockout after failed attempts.
Duration of account lockout after failed attempts.
AUTH_MAX_FAILED_ATTEMPTS5Failed login attempts before lockout.
Failed login attempts before lockout.
CORS_ORIGINSJSON array of allowed CORS origins.
JSON array of allowed CORS origins.
EVENT_RETENTION_DAYS7Days to keep monitoring poll events.
Days to keep monitoring poll events.
FIREWALL_LOG_RETENTION_DAYS7Days to keep syslog events.
Days to keep syslog events.
LOG_LEVELinfoUvicorn log level: debug, info, warning, error, critical.
Uvicorn log level: debug, info, warning, error, critical.
values: debug, info, warning, error, critical
MASTER_KEYRequired. Fernet key for encrypting stored secrets, including saved SNMP community profiles. Generate once, never change.
Required. Fernet key for encrypting stored secrets, including saved SNMP community profiles. Generate once, never change.
PGID1000GID the container process runs as.
GID the container process runs as.
PUID1000UID the container process runs as. Match your host user for correct bind mount permissions.
UID the container process runs as. Match your host user for correct bind mount permissions.
REFRESH_TOKEN_DAYS7Refresh token lifetime.
Refresh token lifetime.
SECRET_KEYRequired. Signs session tokens. Generate once, keep stable.
Required. Signs session tokens. Generate once, keep stable.
SECURE_HSTS_ENABLEDfalseOptional. Set true to send HSTS headers once NetMap will only ever be served over HTTPS on this hostname.
Optional. Set true to send HSTS headers once NetMap will only ever be served over HTTPS on this hostname.
SYSLOG_ENABLEDtrueEnable/disable the syslog receiver entirely.
Enable/disable the syslog receiver entirely.
values: true, false
SYSLOG_SENDER_ALLOWLISTJSON array of IPs or CIDRs allowed to send logs.
JSON array of IPs or CIDRs allowed to send logs.
SYSLOG_TCP_ENABLEDtrueEnable/disable TCP syslog.
Enable/disable TCP syslog.
values: true, false
SYSLOG_TCP_PORT1514Internal TCP port.
Internal TCP port.
SYSLOG_UDP_ENABLEDtrueEnable/disable UDP syslog.
Enable/disable UDP syslog.
values: true, false
SYSLOG_UDP_PORT1514Internal UDP port (map it to 5514 externally in compose).
Internal UDP port (map it to 5514 externally in compose).
TZUTCContainer timezone. Use a tz database name (e.g. Europe/London, America/New_York). Affects log timestamps and scheduled tasks.
Container timezone. Use a tz database name (e.g. Europe/London, America/New_York). Affects log timestamps and scheduled tasks.