IPAM built in
VLANs, prefixes, an allocation wizard with reachability probes, and RFC 2136, PowerDNS and Technitium DNS integration.
The DCIM that already speaks your stack's language
Cofferdam is a modern data centre platform that maps every rack, cable, IP address and watt in your facility, then keeps it in sync with the systems you already run. Structured cabling, power topology, environmental telemetry and IPAM in one place. NetBox-compatible by design.
What it does
One platform across cabling, power, environment and IPAM
First-class integrations with NetBox and Proxmox VE, with HPE OneView, Jira Assets, Freshservice, ServiceNow and SAP S/4HANA in beta, mean no more spreadsheet bridges between teams.
Built-in structured-cabling proposer, power topology with single-line diagrams, blade chassis bay grids, environmental telemetry with threshold alerts, and a tenant-scoped RBAC model layered over hash-chained audit logs.
Self-hosted, including on air-gapped sites, and AI-agent-ready.
See it
Everything in one place
Live captures from the Cofferdam demo environment, next to the problems they solve.
Racks that match reality
U-accurate elevations with drag-to-place assets, blade chassis bay grids, and a per-port patching table behind every device: what each port runs, where it's patched, and on which cable number.
The badges tell the story: these assets came straight in from NetBox.
Cabling proposed, polarity checked
Pick two ports and the proposer routes the path: which panels, which cassettes, which cores, reusing trunk capacity where it exists. Polarity is verified end to end before anyone orders a cable.
Apply the plan and every leg lands in the cable register with a work-order label.
It audits the physical layer
Optics running beyond their span's reach. Transceiver rate mismatches. Cables with no SFP type stamped. Rack feeds that no PDU draws from. Cofferdam flags what a spreadsheet never could, with a trace to the offending cable.
Power as a living single-line
Utility to generator to ATS to UPS to sub-panel to CRAC, drawn as a live single-line diagram with attributed load and utilisation on every box, plus redundancy modes and facility-level rollup. PDU telemetry feeds the same model, with measured panel load from rack PDUs. Live UPS readings over the standard UPS-MIB are in beta; where a UPS reports its own runtime, that replaces the nameplate estimate. Recorded generator fuel levels give a runtime estimate.
The room, thermally honest
Floor plans placed to a 600 mm grid, with SNMP probes feeding a live thermal overlay across hot and cold aisles. Threshold alerts fire before the hardware complains.
This demo room survives the loss of one cooling unit (it is N+1), and Cofferdam can show you why.
Beyond the building
Fibre spans, ducts, microwave links and shared-risk groups on a live map, coloured by plant kind. Open joints carry crew labels, so "who is standing in which pit" is a glance, not a phone call. Fibre core and splice records, OTDR traces and imported copper cable-test results sit with the spans, strands and cables they describe.
And the rest of the toolbox
-
-
Speaks your stack
NetBox and Proxmox VE, with HPE OneView, Jira Assets, Freshservice, ServiceNow and SAP S/4HANA in beta, plus a NetBox-API-compatible IPAM endpoint.
-
AI-agent-ready
An agent proposal queue keeps automation on a leash: agents propose inventory changes, an administrator approves or rejects each one, and the audit log records every proposal and every decision. The NetBox-compatible API is the one exception, and only for a token an administrator enables for it.
-
Enterprise controls
OIDC single sign-on, LDAP (Active Directory) login, phishing-resistant passkeys and TOTP for multi-factor authentication, tenant-scoped RBAC and visibility, a hash-chained audit log and snapshot versioning.
-
Network config write-back
Push approved configuration to Cisco IOS-XE, to Juniper and other NETCONF devices that support confirmed commit, and to Arista EOS. A change one person requests is pushed only after a second person approves it, and the device undoes it after a rollback timer, five minutes by default, unless someone keeps it; devices that cannot roll back are refused. Restoring many devices to their approved baselines can run as one bulk plan, approved by a second person and kept automatically on each device that reads back correctly.
-
Config drift review
Cofferdam labels any device whose running configuration has moved away from its approved baseline and, on devices that support write-back, restores it on request, one device or in bulk, with two-person approval.
-
Remote pollers
Bring isolated OT sites into the same inventory through remote pollers, with every request signed.
-
Signed offline updates
Signed offline bundles keep air-gapped sites current, and connected sites can update from inside the application.
-
Threat context
Findings from firmware vulnerability matching carry an indicative MITRE ATT&CK for ICS mapping, and threat-intelligence indicators you import can be linked to advisories for reference.
-
Asset health
A health score for every asset, built from the inventory facts Cofferdam already holds. Room pages summarise power and cooling; site pages add asset health.
-
Built for automation
Config contexts and templates, a read-only GraphQL API and queryable jobs.
-
Compliance evidence
The SOCI CIRMP and AESCSF catalogues map the evidence Cofferdam holds to a selection of each framework's controls. For SOCI CIRMP, you can also record an accepted risk for equipment past vendor end of support, with a review date after which it lapses. You can write your own compliance policies too.
-
Four languages
The interface is available in English, German, Spanish and Chinese.
-
Trends and forecasts
Power and environment trends going back up to five years, with a growth forecast for power.
-
Dashboards and NOC view
Personal dashboards for each user, and a wall-screen view for the NOC.
-
Find space
Search racks for space that fits a device, by free rack units, power budget, feed headroom and weight, then reserve it.
-
Power checks
An alert when all of a device's power cords land on the same A or B side, and, where PDUs meter each outlet, a report of devices that have sat idle.
-
Config capture over SSH
Capture device configuration over the SSH command line, using read-only commands and profiles you can write yourself: verified on Arista EOS and Junos, with Cisco IOS in beta. Optionally, a device's own configuration-change syslog message triggers a fresh capture.
-
Approved remote access
Privileged remote-access sessions need a second person's approval by default.
How it fits
Built to drop into the environment you already run
Deployment, your way
Cofferdam runs on your own infrastructure: on Kubernetes (Helm), Docker Compose or a plain VM, on x86-64, with PostgreSQL alongside, delivered online or as a signed offline bundle for air-gapped sites. Your operational data stays on your infrastructure. The outbound connections are documented and listed in the product; most are optional or have an offline alternative, and Cofferdam can run fully air-gapped. Prefer not to host it? We also offer a managed service where every customer gets a dedicated, single-tenant instance in the cloud region that suits their data-residency requirements. We never run shared tenancies.
Speaks to what you already own
First-class integrations cover NetBox and Proxmox VE. HPE OneView, Jira Assets, Freshservice, ServiceNow and SAP S/4HANA are in beta, and the roadmap shows where each one stands. Because Cofferdam exposes a NetBox-API-compatible IPAM endpoint, much of your existing automation (Proxmox SDN plugins, Nautobot mirrors, network scripts) keeps working with little or no change.
Enterprise controls from day one
Sign in through your existing identity provider with OIDC or LDAP. Tenant-scoped role-based access keeps teams inside their lane, and an administrator can narrow what a user may see and change at each site. A signed, hash-chained audit log records every change a person makes in Cofferdam's web interface or API, and who made it, while Trash, settings history and two-person configuration rollback let you undo many mistakes. Auditors get evidence, not archaeology.
FAQ
DCIM, answered
DCIM stands for data centre infrastructure management (data center in US spelling): software that tracks the physical layer of your facility. That covers racks, devices, structured cabling, power distribution, cooling and IP address space, kept accurate as the room changes. Cofferdam is a modern DCIM platform built to stay in sync with the systems you already run.
Yes, by design. Cofferdam imports most NetBox data directly (sites, racks, devices, cables and IP space) and exposes a NetBox-API-compatible IPAM endpoint, so much of your existing automation, like Proxmox SDN plugins and network scripts, keeps working with little or no change.
Yes. Cofferdam runs on your own infrastructure on Kubernetes, Docker Compose or a plain VM, with PostgreSQL alongside, and a signed offline bundle supports air-gapped sites. Your operational data stays on your infrastructure. If you prefer not to host it, we offer a managed single-tenant instance in the cloud region that suits your data-residency requirements. We never run shared tenancies.
Racks and elevations that match reality, structured cabling with polarity checked end to end, power as a living single-line diagram, thermal floor plans, fibre runs between buildings and IPAM. It also audits the physical layer: optics beyond span reach, transceiver mismatches, rack feeds with no PDU.
Not a general-purpose one. It polls power and environmental telemetry and alerts on thresholds, but it does not replace your monitoring stack. Cofferdam is the source of truth for what is physically installed, connected and powered, and it flags where that record and reality disagree.
There are three editions. Community is free for one site, up to 250 assets and 5 users. Professional is $18,000 a year in Australian dollars, excluding GST, for up to 10 sites, 2,500 assets and 50 users, and you can try it free for 30 days. Enterprise is priced on request. The Cofferdam pricing page compares what each edition includes.
Get started
Bring order to your data centre
Self-hosted, NetBox-compatible and ready for air-gapped sites. Let's talk about your environment.
Book a demo