the-other-dude/docs/README.md

The Other Dude

Fleet management for MikroTik RouterOS devices. Built for MSPs who manage hundreds of routers across multiple tenants. Think "UniFi Controller, but for MikroTik."

The Other Dude is a self-hosted, multi-tenant platform that gives you centralized visibility, configuration management, real-time monitoring, and zero-knowledge security across your entire MikroTik fleet -- from a single pane of glass.

---

Features

Fleet

• Dashboard -- At-a-glance fleet health with device counts, uptime sparklines, and status breakdowns per organization.
• Device Management -- Detailed device pages with system info, interfaces, routes, firewall rules, DHCP leases, and real-time resource metrics.
• Fleet Table -- Virtual-scrolled table (TanStack Virtual) that handles hundreds of devices without breaking a sweat.
• Device Map -- Geographic view of device locations.
• Subnet Scanner -- Discover new RouterOS devices on your network and onboard them in clicks.

Configuration

• Config Editor -- Browse and edit RouterOS configuration sections with a structured command interface. Two-phase config push with automatic panic-revert ensures you never brick a remote device.
• Batch Config -- Apply configuration changes across multiple devices simultaneously with template support.
• Bulk Commands -- Execute arbitrary RouterOS commands across device groups.
• Templates -- Reusable configuration templates with variable substitution.
• Simple Config -- A Linksys/Ubiquiti-style simplified interface covering Internet, LAN/DHCP, WiFi, Port Forwarding, Firewall, DNS, and System settings. No RouterOS CLI knowledge required.
• Config Backup & Diff -- Git-backed configuration storage with full version history and side-by-side diffs. Restore any previous configuration with one click.

Monitoring

• Network Topology -- Interactive topology map (ReactFlow + Dagre layout) showing device interconnections and shared subnets.
• Real-Time Metrics -- Live CPU, memory, disk, and interface traffic via Server-Sent Events (SSE) backed by NATS JetStream.
• Alert Rules -- Configurable threshold-based alerts for any metric (CPU > 90%, interface down, uptime reset, etc.).
• Notification Channels -- Route alerts to email, webhooks, or Slack.
• Audit Trail -- Immutable log of every action taken in the portal, with user attribution and exportable records.
• Transparency Dashboard -- KMS access event monitoring for tenant admins (who accessed what encryption keys, when).
• Reports -- Generate PDF reports (fleet summary, device detail, security audit, performance) with Jinja2 + WeasyPrint.

Security

• Zero-Knowledge Architecture -- 1Password-style hybrid design. SRP-6a authentication means the server never sees your password. Two-Secret Key Derivation (2SKD) with PBKDF2 (650K iterations) + HKDF + XOR.
• Secret Key -- 128-bit A3-XXXXXX format key stored in IndexedDB with Emergency Kit PDF export.
• OpenBao KMS -- Per-tenant envelope encryption via Transit secret engine. Go poller uses LRU cache (1024 keys / 5-min TTL) for performance.
• Internal Certificate Authority -- Issue and deploy TLS certificates to RouterOS devices via SFTP. Three-tier TLS fallback: CA-verified, InsecureSkipVerify, plain API.
• WireGuard VPN -- Manage WireGuard tunnels for secure device access across NAT boundaries.
• Credential Encryption -- AES-256-GCM (Fernet) encryption of all stored device credentials at rest.
• RBAC -- Four roles: super_admin, admin, operator, viewer. PostgreSQL Row-Level Security enforces tenant isolation at the database layer.

Administration

• Multi-Tenancy -- Full organization isolation with PostgreSQL RLS. Super admins manage all tenants; tenant admins see only their own devices and users.
• User Management -- Per-tenant user administration with role assignment.
• API Keys -- Generate mktp_-prefixed API keys with SHA-256 hash storage and operator-level RBAC for automation and integrations.
• Firmware Management -- Track RouterOS versions across your fleet, plan upgrades, and push firmware updates.
• Maintenance Windows -- Schedule maintenance periods with automatic alert suppression.
• Setup Wizard -- Guided 3-step onboarding for first-time deployment.

UX

• Command Palette -- Cmd+K / Ctrl+K quick navigation (cmdk).
• Keyboard Shortcuts -- Vim-style sequence shortcuts (g d for dashboard, g t for topology, [ to toggle sidebar).
• Dark / Light Mode -- Class-based theming with flicker-free initialization.
• Page Transitions -- Smooth route transitions with Framer Motion.
• Skeleton Loaders -- Shimmer-gradient loading states throughout the UI.

---

Architecture

                         +-----------+
                         |  Frontend |
                         | React/nginx|
                         +-----+-----+
                               |
                          /api/ proxy
                               |
                         +-----v-----+
                         |    API    |
                         |  FastAPI  |
                         +--+--+--+--+
                            |  |  |
              +-------------+  |  +--------------+
              |                |                 |
        +-----v------+  +-----v-----+   +-------v-------+
        | PostgreSQL  |  |   Redis   |   |     NATS      |
        | TimescaleDB |  |  (locks,  |   |  JetStream    |
        |   (RLS)     |  |  caching) |   |  (pub/sub)    |
        +-----^------+  +-----^-----+   +-------^-------+
              |                |                 |
        +-----+-------+-------+---------+-------+
        |             Poller (Go)                |
        |  Polls RouterOS devices via binary API |
        |        port 8729 TLS                   |
        +----------------------------------------+
              |
     +--------v---------+
     |  RouterOS Fleet   |
     |  (your devices)   |
     +-------------------+

• Frontend serves the React SPA via nginx and proxies /api/ to the backend.
• API handles all business logic, authentication, and database access with RLS-enforced tenant isolation.
• Poller is a Go microservice that polls RouterOS devices on a configurable interval using the RouterOS binary API, publishing results to NATS and persisting to PostgreSQL.
• PostgreSQL + TimescaleDB stores all relational data with hypertables for time-series metrics.
• Redis provides distributed locks (one poller per device) and rate limiting.
• NATS JetStream delivers real-time events from the poller to the API (and onward to the frontend via SSE).
• OpenBao provides Transit secret engine for per-tenant envelope encryption (zero-knowledge key management).

---

Tech Stack

Layer	Technology
Frontend	React 19, TanStack Router + Query, Tailwind CSS 3.4, Vite, Framer Motion
Backend	Python 3.12, FastAPI 0.115, SQLAlchemy 2.0 async, asyncpg, Pydantic v2
Poller	Go 1.24, go-routeros/v3, pgx/v5, nats.go
Database	PostgreSQL 17 + TimescaleDB 2.17, Row-Level Security
Cache	Redis 7
Message Bus	NATS with JetStream
KMS	OpenBao 2.1 (Transit secret engine)
VPN	WireGuard
Auth	SRP-6a (zero-knowledge), JWT (15m access / 7d refresh)
Reports	Jinja2 + WeasyPrint (PDF generation)
Containerization	Docker Compose (dev, staging, production profiles)

---

Quick Start

See the full Quick Start Guide for detailed instructions.

# Clone and configure
cp .env.example .env

# Start infrastructure
docker compose up -d

# Build app images (one at a time to avoid OOM)
docker compose build api
docker compose build poller
docker compose build frontend

# Start the full stack
docker compose up -d

# Verify
curl http://localhost:8001/health
open http://localhost:3000

Three environment profiles are available:

Environment	Frontend	API	Notes
Dev	localhost:3000	localhost:8001	Hot-reload, volume-mounted source
Staging	localhost:3080	localhost:8081	Built images, staging secrets
Production	localhost (port 80)	Internal (proxied)	Gunicorn workers, log rotation

---

Documentation

Document	Description
Quick Start	Get running in minutes
Deployment Guide	Production deployment, TLS, backups
Architecture	System design, data flows, multi-tenancy
Security Model	Zero-knowledge auth, encryption, RLS, RBAC
User Guide	End-user guide for all features
API Reference	REST API endpoints and authentication
Configuration	Environment variables and tuning

---

Screenshots

See the documentation site for screenshots.

---

Project Structure

backend/            Python FastAPI backend
frontend/           React TypeScript frontend
poller/             Go microservice for device polling
infrastructure/     Helm charts, Dockerfiles, OpenBao init
docs/               Documentation
docker-compose.yml  Base compose (infrastructure services)
docker-compose.override.yml   Dev overrides (hot-reload)
docker-compose.staging.yml    Staging profile
docker-compose.prod.yml       Production profile
docker-compose.observability.yml  Prometheus + Grafana

---

License

Open-source. Self-hosted. Your data stays on your infrastructure.