hermes-skills/skills/devops/infrastructure-automation/references/mikrotik-router-backup-pipeline.md

MikroTik WISP Router Backup Pipeline

Pipeline Architecture

Core (netcup) → L2TP/IPsec VPN → MikroTik Router (WireGuard tunnel interface)
                            ↓
              SSH export config → gzip → S3 upload (mikrotik-ccr-backups)

Key Configuration

Setting	Value
Router IP (via VPN tunnel)	10.77.0.2
LAN IP (NOT via VPN)	192.168.88.1
SSH port	22 (restricted to 10.77.0.0/24)
Backup frequency	6:00 AM daily
S3 bucket	mikrotik-ccr-backups
Script	/root/.hermes/scripts/run-wisp-backup.sh
Config	/root/.hermes/scripts/wisp-backup/config.yaml
Method	paramiko SSH → /export → gzip → S3 upload

Diagnosis

When the backup fails:

1. Check cron: cronjob action=list — look for home-router-daily-backup status
2. Check VPN: ipsec status or xl2tpd — tunnel must be up
3. Check IP: router must be reachable on 10.77.0.2 (tunnel), NOT 192.168.88.1 (LAN)
4. Check for stuck exports: SSH in and check for .in_progress files
5. Check paramiko: python3 -c "import paramiko"

Pitfalls

• Wrong IP in config — The tower IP was set to 192.168.88.1 (LAN) instead of 10.77.0.2 (VPN tunnel). SSH is restricted to 10.77.0.0/24.
• Missing paramiko — wisp-backup.py requires paramiko. Install with pip install paramiko.
• Missing VPN stack — xl2tpd and strongswan-starter packages may not be installed on the backup server.
• Stuck exports — If a previous export failed, the router retains a .in_progress file. Clean it via SSH: ssh admin@10.77.0.2 /file remove [filename].in_progress
• Wrong cron script — The cron was using home-router-backup.sh (old WireGuard script) instead of run-wisp-backup.sh.

Verification

aws s3 ls s3://mikrotik-ccr-backups/wisp-backups/configs/home/ \
  --endpoint-url https://s3.us-east-1.wasabisys.com

Files are named: home-gateway-YYYY-MM-DD.rsc.gz