Python as the Brain, Ansible as the Hands
Spreadsheet IP management works right up until it doesn’t. Two people edit it, someone fat-fingers an octet, and now two devices think they own the same address. I wanted something better for the lab without buying anything, so I built a small IPAM tool with Flask and Ansible.
The split of responsibilities is the part I’d recommend to anyone building internal tools. Python is the brain: the Flask app owns the web interface, the database of assignments, and all the decision making. Ansible is the hands: when the tool needs to actually touch a device or verify that an address is really in use, it calls a playbook. Neither side does the other’s job. Python never SSHes into a switch, and Ansible never decides anything.
That split pays off in testing. I can exercise all the logic without a single device connected, because the device layer is behind playbooks I can run with check mode or against a lab target. And when I change how devices get configured, the Python side doesn’t care. Same reason you don’t weld the socket to the ratchet.
It’s not a product. It’s a few hundred lines that solved my problem, taught me a pattern, and gave me one more reason to keep credentials in vault instead of code. Most useful tools I’ve built look exactly like that.