Scope: dual access (staff roles + customer self-service), 6-section staff dashboard, device inventory with auto-SNMP template engine, customer marketplace
This commit is contained in:
root
+33
-59
@@ -1,74 +1,48 @@
|
||||
# CHANGELOG — Forefront Wireless Customer Portal
|
||||
# CHANGELOG — Forefront Wireless Operations Portal
|
||||
|
||||
---
|
||||
|
||||
## 2026-07-25 (PM) — Multi-Source Architecture Scoped
|
||||
## 2026-07-25 (PM) — Dual Access & Device Management Scoped
|
||||
|
||||
**Scope expansion:** The portal at my.forefrontwireless.com will aggregate data from four sources, not just Splynx:
|
||||
### Major Design Decisions
|
||||
|
||||
### Data Sources
|
||||
**Dual-access portal** — same domain, different views:
|
||||
- `/staff/*` — role-gated (Admin, Tech, View Only)
|
||||
- `/customer/*` — tied to Splynx customer record
|
||||
|
||||
| Source | Purpose | Auth | Location |
|
||||
|--------|---------|------|----------|
|
||||
| **Splynx v4.2** | Billing, CRM, customers, invoices, services | HMAC-SHA256 signature | Self-hosted at portal.forefrontwireless.com |
|
||||
| **UISP (UNMS)** | Network management, tower/AP inventory, link quality | API token | app2 Docker (unms.forefrontwireless.com) |
|
||||
| **MikroTik RouterOS** | Real-time bandwidth, DHCP leases, queue stats | REST API or SSH | 5 × CCR2004 routers on network |
|
||||
| **Zabbix / SNMP** | Infrastructure monitoring, SNMP for non-UISP devices, historical graphs | Zabbix API | Currently on-prem; may move to cloud |
|
||||
**Three staff roles:**
|
||||
| Role | Permissions |
|
||||
|------|------------|
|
||||
| Admin | Full CRUD — devices, billing, templates, users |
|
||||
| Tech | Troubleshoot, view all equipment, reboot CPEs — no billing |
|
||||
| View Only | Read-only dashboards |
|
||||
|
||||
### Architecture Decision
|
||||
The FastAPI backend is now an **aggregation layer** — read-only adapters for each source, normalizing data into a unified customer view. The backend never writes to Splynx/UISP/MikroTik/Zabbix directly; all mutations stay in the native tools.
|
||||
**Staff dashboard = 6 device sections:**
|
||||
1. MikroTik routers (5 × CCR2004) — status, CPU, throughput
|
||||
2. Ubiquiti backhauls — point-to-point link signal/capacity
|
||||
3. Customer CPEs — subscriber device health, reboot action
|
||||
4. MikroTik switches — port map, PoE budget
|
||||
5. Algcom PDUs & UPSs — SNMP-polled outlet/battery status
|
||||
6. TPDIN Web Monitor 3s — environmental (temp/humidity/contacts)
|
||||
|
||||
### Build Phases
|
||||
**Device inventory with auto-SNMP templates:**
|
||||
- Staff add devices with make, model, IP, SNMP community, web URL
|
||||
- Backend probes SNMP for unknown make/model combos
|
||||
- Maps discovered OIDs → widget suggestions
|
||||
- Staff approves → reusable template saved
|
||||
- Any new device with same make/model inherits template automatically
|
||||
|
||||
| Phase | Sources | V1? |
|
||||
|:---:|---|---|
|
||||
| 1 | Splynx (billing + CRM) | Yes — core self-service |
|
||||
| 2 | MikroTik (router telemetry) | Yes — data usage, device lists |
|
||||
| 3 | UISP (network management) | V2 — network status, outage awareness |
|
||||
| 4 | Zabbix/SNMP (infra monitoring) | V2+ — SLA dashboards, historical graphs |
|
||||
**Customer side:**
|
||||
- Account/billing management
|
||||
- Current package view
|
||||
- Marketplace — browse upgrade plans, compare, request change
|
||||
|
||||
### Zabbix Migration Options
|
||||
- **Recommended:** Cloud Zabbix + on-prem proxy — SNMP stays local, server moves to managed infra
|
||||
- **Alternative:** Keep on-prem, API tunnel via Tailscale — zero cost, simple
|
||||
- **For later:** Decision deferred until portal reaches Phase 4
|
||||
|
||||
### Page-to-Source Mapping
|
||||
Every customer-facing feature mapped to its backend data provider — see README Data Aggregation Model section.
|
||||
**Portal auth separate from Splynx** — Splynx is billing source-of-truth; the portal runs its own user table with roles. Customer accounts are linked to Splynx customer IDs.
|
||||
|
||||
---
|
||||
|
||||
## 2026-07-25 (AM) — Splynx API Connection
|
||||
## 2026-07-25 (AM) — 4-Source Architecture
|
||||
|
||||
**Context:** Germaine shared Splynx API credentials for Forefront Wireless, his WISP company. The self-hosted Splynx instance (v4.2) runs at `portal.forefrontwireless.com/admin/`. The goal is to build a branded customer portal at `my.forefrontwireless.com`.
|
||||
Multi-source aggregation architecture: Splynx (billing/CRM), UISP (network management), MikroTik (router telemetry), Zabbix/SNMP (infrastructure monitoring). Build phases 1-4 defined. Zabbix migration options documented.
|
||||
|
||||
### Completed
|
||||
|
||||
- **API connection established** — Splynx API v2.0 at `/api/2.0/` verified working
|
||||
- **Authentication cracked** — Signature-based auth (HMAC-SHA256) with microtime nonce. Three methods tested:
|
||||
- ✅ Signature: `Splynx-EA (key=K&nonce=N&signature=S)` — works
|
||||
- ✅ Access Token: POST `/admin/auth/tokens` — generates token with 30-min expiry
|
||||
- ⚠️ Basic Auth: returns 403 unless "Unsecure access" is enabled on the API key
|
||||
- **API key configured** — Full permissions on all resources (customers, services, finance, networking, support, tariffs, scheduling, inventory)
|
||||
- **Endpoint reconnaissance** — Verified working:
|
||||
- `GET /admin/customers/customer` — 43 customers (33 active, 9 disabled)
|
||||
- `GET /admin/customers/customer-internet-services/{id}` — per-customer services
|
||||
- `GET /admin/networking/routers` — 5 MikroTik CCR2004 routers
|
||||
- `GET /admin/tariffs/internet` — 9 plans ($59.95-$299.95/mo)
|
||||
- `GET /admin/finance/invoices` — billing records
|
||||
- **Splynx quirks documented** — 405 on query-param service endpoints, tariff name resolution, signature nonce format
|
||||
|
||||
### Decisions
|
||||
|
||||
- **Stack:** React SPA → FastAPI backend → Splynx API v2.0. Same pattern as IntelSight and VoIPSimplicity.
|
||||
- **Hosting:** CloudPanel on app3 (152.53.241.111) — keeps customer portals together
|
||||
- **Auth pattern:** Server-to-server signature auth (not per-user Access Tokens) — portal handles its own user auth, backend proxies to Splynx
|
||||
- **Domain:** my.forefrontwireless.com (follows ITPP product convention: my.*.com)
|
||||
- **Building after:** IntelSight + LaunchCheck (shared infrastructure, shared auth patterns, reusable Super Search engine)
|
||||
|
||||
### Reference: API Credentials
|
||||
|
||||
```
|
||||
Key: 5a8dc490716424f435306f2c18b4fdcb
|
||||
Secret: 5773f779e5ae5aac965845a66bd857a0
|
||||
Base: https://portal.forefrontwireless.com/api/2.0/
|
||||
```
|
||||
See earlier CHANGELOG entry for Splynx API reconnaissance details.
|
||||
|
||||
Reference in New Issue
Block a user