IPAM

IPAM is dnswiz’s IP address management module. It models your address space as typed objects (blocks, networks, addresses), tracks what’s used and what’s free, and hands out the next free subnet or host on request. Because it lives in the same account as your DNS, an address with a hostname can publish its own record.

IPAM is a paid add-on. It’s available from the Pro plan up; enable it per workspace under Settings once your plan allows it. Everything below is scoped to your tenant and isolated in the database like the rest of dnswiz.

The hierarchy

VRF                     routing/addressing context (a default one exists)
  └─ Block              address-space planning (10.0.0.0/8)
       └─ Block         sub-blocks nest by CIDR containment (10.1.0.0/16)
            └─ Network  an assignable subnet (10.1.5.0/24, has a gateway)
                 └─ IP  a single host (10.1.5.10, has a hostname + status)

VRF: the routing context an address lives in. A default VRF is created for you; most setups never need a second one.
Block: address-space planning. Blocks self-organize by CIDR containment, declare 10.0.0.0/8 and 10.1.0.0/16 and the second nests under the first automatically. No parent to wire by hand.
Network: an assignable subnet inside a block. Carries an optional gateway IP and can be linked to a DNS zone (see below).
IP address: a single host in a network, with a hostname, a status (active, reserved, deprecated, dhcp, slaac, pending), and tags.

Containment is enforced on the server: a network always sits inside its block, an address inside its network, and nothing overlaps a sibling.

Allocating

You rarely type the next subnet by hand. Ask for it.

Next free subnet from a block: pick a prefix length, get the lowest free CIDR of that size.
Next free host in a network: get the lowest unused address.
From a tagged pool: tag several blocks the same way (for example region:eu-central-1) and allocate against the tag instead of a single block. The lowest-CIDR block with room wins, so it fills predictably. Tags match with AND semantics, and each allocation is locked per block so two concurrent requests never hand out the same range.

Tree operations

The address plan changes over time, so the block tree is editable in place:

Split a block into equal sub-blocks.
Merge adjacent sibling blocks back together.
Dissolve a block into its parent (keeps the children, drops the layer).
Edit / expand CIDR on a block or network. Resizing a network keeps it inside its block and must still contain every assigned address.
Move a network to a different block, or an address to a different network.

Views

Each level has three views:

Table: the contents (sub-blocks and networks, or addresses).
Map: the address range laid out visually, used next to free.
Free: the free space inside a block, so you can see what’s left before you allocate.

Locate searches the whole tree by CIDR, address, or name and jumps you straight to the match. You can also bulk-add or import addresses into a network.

DNS that publishes itself

This is the part a standalone IPAM can’t do. Link a network to one of your DNS zones, and any address in it that has a hostname publishes its own A/AAAA record into that zone. Assign vip to 10.1.6.20 in a network linked to corp.example.com, and vip.corp.example.com resolves. Change the address, the record follows. The link is forward today (address to DNS record); it does not generate reverse PTR zones.

As code

Everything above is in the Terraform provider. Blocks nest by containment, networks place three ways (explicit, next-free-in-block, next-free-from-a-tagged-pool), and addresses either pin an IP or take the next free host.

# Blocks self-organize by CIDR containment.
resource "dnswiz_ipam_block" "corp" {
  cidr   = "10.0.0.0/8"
  name   = "corp"
  origin = "rfc1918"
}

resource "dnswiz_ipam_block" "east" {
  cidr = "10.1.0.0/16"
  name = "us-east"
  # placed under corp automatically
}

# Next free /24 from ANY block tagged region:eu-central-1.
resource "dnswiz_ipam_network" "eu" {
  parent_tags   = ["region:eu-central-1"]
  prefix_length = 24
  name          = "eu-app"
  tags          = ["env:prod", "team:platform"]
}

# Next free host in that network. Concurrency-safe, allocated on create.
resource "dnswiz_ipam_ip_address" "vip" {
  network_id = dnswiz_ipam_network.eu.id
  hostname   = "vip"
}

Read-only peeks are data sources:

data "dnswiz_ipam_available_subnet" "next" {
  block_id      = dnswiz_ipam_block.east.id
  prefix_length = 24
}

output "next_free_subnet" {
  value = data.dnswiz_ipam_available_subnet.next.cidr
}

Resources: dnswiz_ipam_block, dnswiz_ipam_network, dnswiz_ipam_ip_address. Data sources: dnswiz_ipam_available_subnet, dnswiz_ipam_available_ip. Full reference on the Terraform Registry.