# MikroTik WISP Router Backup Pipeline

## Pipeline Architecture

```
Core (netcup) → L2TP/IPsec VPN → MikroTik Router (WireGuard tunnel interface)
                            ↓
              SSH export config → gzip → S3 upload (mikrotik-ccr-backups)
```

## Key Configuration

| Setting | Value |
|---------|-------|
| Router IP (via VPN tunnel) | 10.77.0.2 |
| LAN IP (NOT via VPN) | 192.168.88.1 |
| SSH port | 22 (restricted to 10.77.0.0/24) |
| Backup frequency | 6:00 AM daily |
| S3 bucket | `mikrotik-ccr-backups` |
| Script | `/root/.hermes/scripts/run-wisp-backup.sh` |
| Config | `/root/.hermes/scripts/wisp-backup/config.yaml` |
| Method | paramiko SSH → `/export` → gzip → S3 upload |

## Diagnosis

When the backup fails:
1. Check cron: `cronjob action=list` — look for `home-router-daily-backup` status
2. Check VPN: `ipsec status` or `xl2tpd` — tunnel must be up
3. Check IP: router must be reachable on `10.77.0.2` (tunnel), NOT `192.168.88.1` (LAN)
4. Check for stuck exports: SSH in and check for `.in_progress` files
5. Check paramiko: `python3 -c "import paramiko"`

## Pitfalls

- **Wrong IP in config** — The tower IP was set to `192.168.88.1` (LAN) instead of `10.77.0.2` (VPN tunnel). SSH is restricted to 10.77.0.0/24.
- **Missing paramiko** — `wisp-backup.py` requires paramiko. Install with `pip install paramiko`.
- **Missing VPN stack** — `xl2tpd` and `strongswan-starter` packages may not be installed on the backup server.
- **Stuck exports** — If a previous export failed, the router retains a `.in_progress` file. Clean it via SSH: `ssh admin@10.77.0.2 /file remove [filename].in_progress`
- **Wrong cron script** — The cron was using `home-router-backup.sh` (old WireGuard script) instead of `run-wisp-backup.sh`.

## Verification

```bash
aws s3 ls s3://mikrotik-ccr-backups/wisp-backups/configs/home/ \
  --endpoint-url https://s3.us-east-1.wasabisys.com
```
Files are named: `home-gateway-YYYY-MM-DD.rsc.gz`