c2eea6847f
- Bind tunnel listeners to 0.0.0.0 instead of 127.0.0.1 so tunnels are reachable through reverse proxies and container networks - Reduce port range to 49000-49004 (5 concurrent tunnels) - Derive WinBox URI host from request Host header instead of hardcoding 127.0.0.1, enabling use behind reverse proxies - Add README security warning about default encryption keys Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
129 lines
5.0 KiB
Markdown
129 lines
5.0 KiB
Markdown
# The Other Dude
|
|
|
|
**Self-hosted MikroTik fleet management for MSPs.**
|
|
|
|
> **Warning**
|
|
> This software is in active development and testing. It is **not yet ready for production use**. APIs, database schemas, and features may change without notice. Use at your own risk.
|
|
|
|
TOD is a multi-tenant platform for managing RouterOS devices at scale. It replaces
|
|
the chaos of juggling WinBox sessions and SSH terminals across hundreds of routers
|
|
with a single, centralized web interface -- fleet visibility, configuration management,
|
|
real-time monitoring, and zero-knowledge security, all self-hosted on your infrastructure.
|
|
|
|
---
|
|
|
|
## Key Features
|
|
|
|
- **Fleet Management** -- Dashboard with device health, uptime sparklines, virtual-scrolled fleet table, geographic map, and subnet discovery.
|
|
- **Configuration Push with Panic-Revert** -- Two-phase config deployment ensures you never brick a remote device. Batch config, templates, and git-backed version history with one-click restore.
|
|
- **Real-Time Monitoring** -- Live CPU, memory, disk, and interface traffic via Server-Sent Events backed by NATS JetStream. Configurable alert rules with email, webhook, and Slack notifications.
|
|
- **Zero-Knowledge Security** -- 1Password-style architecture. SRP-6a authentication (server never sees your password), per-tenant envelope encryption via Transit KMS, Emergency Kit export.
|
|
- **Multi-Tenant with PostgreSQL RLS** -- Full organization isolation enforced at the database layer. Four roles: super_admin, admin, operator, viewer.
|
|
- **Internal Certificate Authority** -- Issue and deploy TLS certificates to RouterOS devices via SFTP. Three-tier TLS fallback for maximum compatibility.
|
|
- **Remote Access** -- WinBox TCP tunnels and browser-based SSH terminal for managing devices behind NAT. One-click connection through the WireGuard VPN overlay.
|
|
- **WireGuard VPN Onboarding** -- Create device + VPN peer in one transaction. Generates ready-to-paste RouterOS commands for devices behind NAT.
|
|
- **PDF Reports** -- Fleet summary, device detail, security audit, and performance reports generated server-side.
|
|
- **Command Palette UX** -- Cmd+K quick navigation, keyboard shortcuts, dark/light mode, smooth page transitions, and skeleton loaders throughout.
|
|
|
|
---
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Routers
|
|
↓
|
|
Pollers (Go)
|
|
↓
|
|
NATS Event Bus
|
|
↓
|
|
API + TimescaleDB
|
|
↓
|
|
Web UI
|
|
```
|
|
|
|
---
|
|
|
|
## Tech Stack
|
|
|
|
| Layer | Technology |
|
|
|-------|------------|
|
|
| Frontend | React 19, TanStack Router + Query, Tailwind CSS, Vite |
|
|
| Backend | Python 3.12, FastAPI, SQLAlchemy 2.0 async, asyncpg |
|
|
| Poller | Go 1.24, go-routeros/v3, pgx/v5, nats.go |
|
|
| Database | PostgreSQL 17 + TimescaleDB, Row-Level Security |
|
|
| Cache / Locks | Redis 7 |
|
|
| Message Bus | NATS with JetStream |
|
|
| KMS | OpenBao (Transit secret engine) |
|
|
| VPN | WireGuard |
|
|
| Auth | SRP-6a (zero-knowledge), JWT |
|
|
| Reports | Jinja2 + WeasyPrint |
|
|
|
|
---
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# Clone and configure
|
|
git clone https://github.com/staack/the-other-dude.git && cd the-other-dude
|
|
cp .env.example .env
|
|
```
|
|
|
|
**Edit `.env` before starting** -- at minimum, generate unique values for:
|
|
|
|
```bash
|
|
# Generate a JWT signing key
|
|
JWT_SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_urlsafe(64))")
|
|
|
|
# Generate a Fernet encryption key (used to encrypt device credentials at rest)
|
|
CREDENTIAL_ENCRYPTION_KEY=$(python3 -c "import secrets, base64; print(base64.b64encode(secrets.token_bytes(32)).decode())")
|
|
```
|
|
|
|
> **Warning**
|
|
> The `.env.example` ships with **hard-coded dev defaults** for both keys. These are fine for local development but **must be replaced before exposing the instance to any network**. Anyone with the default `JWT_SECRET_KEY` can forge authentication tokens, and the default `CREDENTIAL_ENCRYPTION_KEY` leaves all stored device credentials readable.
|
|
|
|
```bash
|
|
# Build images sequentially (avoids OOM on low-RAM machines)
|
|
docker compose --profile full build api
|
|
docker compose --profile full build poller
|
|
docker compose --profile full build frontend
|
|
|
|
# Start the full stack
|
|
docker compose --profile full up -d
|
|
|
|
# Open the UI
|
|
open http://localhost:3000
|
|
```
|
|
|
|
On first launch, the setup wizard walks you through creating a super admin account,
|
|
enrolling your Secret Key, adding your first organization, and onboarding your first device.
|
|
|
|
---
|
|
|
|
## Documentation
|
|
|
|
Full documentation is available at [theotherdude.net](https://theotherdude.net).
|
|
|
|
See the documentation site for screenshots and feature walkthroughs.
|
|
|
|
---
|
|
|
|
## License
|
|
|
|
[Business Source License 1.1](LICENSE)
|
|
|
|
Free for production use managing up to 1,000 devices with no limitations. Deployments
|
|
exceeding 1,000 managed devices require a commercial license. See the LICENSE file
|
|
for full terms.
|
|
|
|
For commercial licensing inquiries: [license@theotherdude.net](mailto:license@theotherdude.net)
|
|
|
|
For support: [support@theotherdude.net](mailto:support@theotherdude.net) — support inquiries are best-effort unless covered by a support license.
|
|
|
|
---
|
|
|
|
## The Name
|
|
|
|
"The Other Dude" -- because every MSP needs one. When the network is down at 2 AM
|
|
and someone has to fix it, TOD is the other dude on the job. The Big Lebowski inspired,
|
|
the rug really ties the room together.
|