CHANGELOG — Forefront Wireless Customer Portal

2026-07-25 (PM) — Multi-Source Architecture Scoped

Scope expansion: The portal at my.forefrontwireless.com will aggregate data from four sources, not just Splynx:

Data Sources

Source	Purpose	Auth	Location
Splynx v4.2	Billing, CRM, customers, invoices, services	HMAC-SHA256 signature	Self-hosted at portal.forefrontwireless.com
UISP (UNMS)	Network management, tower/AP inventory, link quality	API token	app2 Docker (unms.forefrontwireless.com)
MikroTik RouterOS	Real-time bandwidth, DHCP leases, queue stats	REST API or SSH	5 × CCR2004 routers on network
Zabbix / SNMP	Infrastructure monitoring, SNMP for non-UISP devices, historical graphs	Zabbix API	Currently on-prem; may move to cloud

Architecture Decision

The FastAPI backend is now an aggregation layer — read-only adapters for each source, normalizing data into a unified customer view. The backend never writes to Splynx/UISP/MikroTik/Zabbix directly; all mutations stay in the native tools.

Build Phases

Phase	Sources	V1?
1	Splynx (billing + CRM)	Yes — core self-service
2	MikroTik (router telemetry)	Yes — data usage, device lists
3	UISP (network management)	V2 — network status, outage awareness
4	Zabbix/SNMP (infra monitoring)	V2+ — SLA dashboards, historical graphs

Zabbix Migration Options

Recommended: Cloud Zabbix + on-prem proxy — SNMP stays local, server moves to managed infra
Alternative: Keep on-prem, API tunnel via Tailscale — zero cost, simple
For later: Decision deferred until portal reaches Phase 4

Page-to-Source Mapping

Every customer-facing feature mapped to its backend data provider — see README Data Aggregation Model section.

2026-07-25 (AM) — Splynx API Connection

Context: Germaine shared Splynx API credentials for Forefront Wireless, his WISP company. The self-hosted Splynx instance (v4.2) runs at portal.forefrontwireless.com/admin/. The goal is to build a branded customer portal at my.forefrontwireless.com.

Completed

API connection established — Splynx API v2.0 at /api/2.0/ verified working
Authentication cracked — Signature-based auth (HMAC-SHA256) with microtime nonce. Three methods tested:
- ✅ Signature: Splynx-EA (key=K&nonce=N&signature=S) — works
- ✅ Access Token: POST /admin/auth/tokens — generates token with 30-min expiry
- ⚠️ Basic Auth: returns 403 unless "Unsecure access" is enabled on the API key
API key configured — Full permissions on all resources (customers, services, finance, networking, support, tariffs, scheduling, inventory)
Endpoint reconnaissance — Verified working:
- GET /admin/customers/customer — 43 customers (33 active, 9 disabled)
- GET /admin/customers/customer-internet-services/{id} — per-customer services
- GET /admin/networking/routers — 5 MikroTik CCR2004 routers
- GET /admin/tariffs/internet — 9 plans ($59.95-$299.95/mo)
- GET /admin/finance/invoices — billing records
Splynx quirks documented — 405 on query-param service endpoints, tariff name resolution, signature nonce format

Decisions

Stack: React SPA → FastAPI backend → Splynx API v2.0. Same pattern as IntelSight and VoIPSimplicity.
Hosting: CloudPanel on app3 (152.53.241.111) — keeps customer portals together
Auth pattern: Server-to-server signature auth (not per-user Access Tokens) — portal handles its own user auth, backend proxies to Splynx
Domain: my.forefrontwireless.com (follows ITPP product convention: my.*.com)
Building after: IntelSight + LaunchCheck (shared infrastructure, shared auth patterns, reusable Super Search engine)

Reference: API Credentials

Key:    5a8dc490716424f435306f2c18b4fdcb
Secret: 5773f779e5ae5aac965845a66bd857a0
Base:   https://portal.forefrontwireless.com/api/2.0/

4.0 KiB Raw Blame History Unescape Escape