Auto-Provisioning Architecture

{
  "schema_version": 2,
  "device": {
    "mac": "11:22:33:44:55:66",
    "type": "switch-crs",
    "model": "CRS354-48P-4S+",
    "property_id": "prop-001",
    "hostname": "SW-GRANDPALACE-01"
  },
  "vlans": [
    { "id": 10, "name": "GUEST", "tagged_ports": ["ether1"], "untagged_ports": ["ether3","ether4"] },
    { "id": 20, "name": "STAFF", "tagged_ports": ["ether1"], "untagged_ports": ["ether5","ether6"] }
  ],
  "poe_ports": [
    { "port": "ether3", "poe_out": "auto-on", "priority": "high", "name": "AP-Floor1" },
    { "port": "ether4", "poe_out": "auto-on", "priority": "high", "name": "AP-Floor2" },
    { "port": "ether5", "poe_out": "forced-on", "priority": "low", "name": "Camera-Lobby" }
  ],
  "mqtt": {
    "broker": "mqtt.hotelnet.io",
    "port": 1883,
    "username": "device-SW-112233445566",
    "client_id": "SW-112233445566",
    "cmd_topic": "cmd/11:22:33:44:55:66/#",
    "status_topic": "status/11:22:33:44:55:66",
    "status_interval_sec": 60
  }
}

// Config file URL pattern hosted on S3:
// https://config.hotelnet.io/devices/{MAC_ADDRESS}.json
// https://config.hotelnet.io/devices/AA:BB:CC:DD:EE:FF.json

// Config file also has a version hash for change detection:
{
  "schema_version": 2,
  "config_version": "20260520-143022",  // timestamp of last change
  "config_hash": "sha256:abc123...",     // device skips apply if hash matches
  "force_apply": false,               // set true to force re-apply even if same hash
  "device": { ... },
  // ... rest of config
}

// S3 bucket structure:
// s3://hotelnet-device-configs/
//   devices/
//     AA:BB:CC:DD:EE:FF.json   ← gateway
//     11:22:33:44:55:66.json   ← switch
//   templates/
//     gateway-template.json    ← base template
//     crs-switch-template.json
//   history/
//     AA:BB:CC:DD:EE:FF/       ← versioned backups
//       20260520-143022.json

# ============================================================
# mqtt-subscribe.rsc
# Run once on boot via /system/scheduler startup=yes
# Sets up MQTT broker connection and topic subscription
# ============================================================

:local mac [/interface get [find name="ether1"] mac-address]
:local clientId ("ROS-" . [:pick $mac 9 17])  # last 8 chars of MAC

# Remove existing broker config (clean setup)
/iot/mqtt/brokers/remove [find name="hotelnet"]

# Add EMQX broker — username/password auth (no certificates needed)
# Read credentials stored by initial-setup.rsc
:local mqttBroker   [/system/script/environment/get [find name="mqtt_broker"]   value]
:local mqttPort     [/system/script/environment/get [find name="mqtt_port"]     value]
:local mqttUser     [/system/script/environment/get [find name="mqtt_user"]     value]
:local mqttPassword [/system/script/environment/get [find name="mqtt_password"] value]

/iot/mqtt/brokers/remove [find name="hotelnet"]
/iot/mqtt/brokers/add \
  name="hotelnet" \
  address=$mqttBroker \
  port=$mqttPort \
  client-id=$clientId \
  username=$mqttUser \
  password=$mqttPassword \
  ssl=no

# Connect to broker
/iot/mqtt/brokers/connect hotelnet
:delay 3s

# Subscribe to command topics for this device
/iot/mqtt/subscribe \
  broker="hotelnet" \
  topic=("cmd/" . $mac . "/#") \
  qos=1 \
  on-message=cmd-handler

# Subscribe to global broadcast commands
/iot/mqtt/subscribe \
  broker="hotelnet" \
  topic=("cmd/broadcast/#") \
  qos=0 \
  on-message=cmd-handler

:log info ("MQTT: subscribed to cmd/" . $mac . "/#")

# ============================================================
# cmd-handler.rsc
# Called by MQTT on-message event
# Variables: $topic, $message (JSON string)
# ============================================================

:local mac [/interface get [find name="ether1"] mac-address]

# Extract command from topic (last segment after final /)
:local topicLen [:len $topic]
:local lastSlash 0
:for i from=0 to=($topicLen - 1) do={
  :if ([:pick $topic $i ($i+1)] = "/") do={ :set lastSlash $i }
}
:local cmd [:pick $topic ($lastSlash + 1) $topicLen]

:log info ("CMD received: " . $cmd . " | payload: " . $message)

# ── REBOOT ──────────────────────────────────
:if ($cmd = "reboot") do={
  /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
    message=("{\"cmd\":\"reboot\",\"status\":\"executing\"}")
  :delay 2s
  /system/reboot
}

# ── POE TOGGLE ──────────────────────────────
:if ($cmd = "poe-toggle") do={
  # Parse port and state from JSON payload
  :local portStart ([:find $message "\"port\":\""] + 8)
  :local portEnd [:find $message "\"" $portStart]
  :local port [:pick $message $portStart $portEnd]

  :local stateStart ([:find $message "\"state\":\""] + 9)
  :local stateEnd [:find $message "\"" $stateStart]
  :local state [:pick $message $stateStart $stateEnd]

  :do {
    /interface/poe/set [find name=$port] poe-out=$state
    /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
      message=("{\"cmd\":\"poe-toggle\",\"port\":\"".$port."\",\"state\":\"".$state."\",\"status\":\"ok\"}")
    :log info ("PoE " . $port . " set to " . $state)
  } on-error={
    /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
      message=("{\"cmd\":\"poe-toggle\",\"status\":\"error\",\"port\":\"".$port."\"}")
  }
}

# ── POE STATUS REQUEST ───────────────────────
:if ($cmd = "poe-status") do={
  :local poeJson "["
  :local first true
  :foreach iface in=[/interface/poe/find] do={
    :local name [/interface/poe/get $iface name]
    :local watts [/interface/poe/monitor $iface once as-value]
    :if (!$first) do={ :set poeJson ($poeJson . ",") }
    :set poeJson ($poeJson . "{\"port\":\"".$name."\",\"watts\":".(($watts->"poe-out-power"))."}")
    :set first false
  }
  :set poeJson ($poeJson . "]")
  /mqtt/publish broker="hotelnet" topic=("status/".$mac."/poe") message=$poeJson
}

# ── PROVISION NOW ───────────────────────────
:if ($cmd = "provision") do={
  /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
    message=("{\"cmd\":\"provision\",\"status\":\"starting\"}")
  /system/script/run provision-check
}

# ── KICK GUEST ──────────────────────────────
:if ($cmd = "kick-guest") do={
  :local sidStart ([:find $message "\"session_id\":\""] + 14)
  :local sidEnd [:find $message "\"" $sidStart]
  :local sid [:pick $message $sidStart $sidEnd]
  :do {
    /ip/hotspot/active/remove [find .id=$sid]
    /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
      message=("{\"cmd\":\"kick-guest\",\"session_id\":\"".$sid."\",\"status\":\"ok\"}")
  } on-error={
    /mqtt/publish broker="hotelnet" topic=("cmd/".$mac."/ack") \
      message=("{\"cmd\":\"kick-guest\",\"status\":\"error\"}")
  }
}

# ============================================================
# status-publish.rsc
# Scheduled every 60 seconds
# Publishes full device telemetry to MQTT status topic
# ============================================================

:local mac [/interface get [find name="ether1"] mac-address]

# System resources
:local res [/system/resource/get]
:local cpu ($res->"cpu-load")
:local freeMem ($res->"free-memory")
:local totalMem ($res->"total-memory")
:local uptime ($res->"uptime")
:local version ($res->"version")

# Active hotspot sessions count
:local sessionCount [:len [/ip/hotspot/active/find]]

# DHCP leases count
:local leaseCount [:len [/ip/dhcp-server/lease/find status=bound]]

# WAN interface status
:local wanUp [/interface/get ether1 running]

# Build JSON payload
:local payload ("{")
:set payload ($payload . "\"mac\":\"".$mac."\"")
:set payload ($payload . ",\"cpu\":".$cpu)
:set payload ($payload . ",\"mem_free\":".$freeMem)
:set payload ($payload . ",\"mem_total\":".$totalMem)
:set payload ($payload . ",\"uptime\":\"".$uptime."\"")
:set payload ($payload . ",\"version\":\"".$version."\"")
:set payload ($payload . ",\"wan_up\":".$wanUp)
:set payload ($payload . ",\"hotspot_sessions\":".$sessionCount)
:set payload ($payload . ",\"dhcp_leases\":".$leaseCount)
:set payload ($payload . ",\"ts\":".[/system/clock/get time])
:set payload ($payload . "}")

# Publish to MQTT status topic
/iot/mqtt/publish broker="hotelnet" \
  topic=("status/" . $mac) \
  message=$payload \
  qos=0

:log debug ("Status published for " . $mac)

# ============================================================
# initial-setup.rsc
# Run ONCE when installing device at new property
# Creates all scripts and schedulers
# ============================================================

# Upload .rsc files via Winbox Files, SCP, or FTP:
# No certificates needed — EMQX uses username/password auth!
# Just upload the .rsc script files.

# Store EMQX credentials as environment variables
/system/script/environment/add name="mqtt_broker"   value="mqtt.hotelnet.io"
/system/script/environment/add name="mqtt_port"     value=1883
/system/script/environment/add name="mqtt_user"     value="PASTE_MQTT_USERNAME_HERE"
/system/script/environment/add name="mqtt_password" value="PASTE_MQTT_PASSWORD_HERE"
/system/script/environment/add name="mqtt_use_tls"  value=false

# Create scripts (content loaded from individual .rsc files)
/system/script/add name="provision-check"  source=[/file/get provision-check.rsc contents]
/system/script/add name="apply-config"     source=[/file/get apply-config.rsc contents]
/system/script/add name="mqtt-subscribe"   source=[/file/get mqtt-subscribe.rsc contents]
/system/script/add name="cmd-handler"      source=[/file/get cmd-handler.rsc contents]
/system/script/add name="status-publish"   source=[/file/get status-publish.rsc contents]

# Create schedulers
/system/scheduler/add \
  name="mqtt-connect" \
  start-time=startup \
  on-event="/system/script/run mqtt-subscribe" \
  comment="Connect to MQTT broker on boot"

/system/scheduler/add \
  name="provision-check" \
  interval=5m \
  on-event="/system/script/run provision-check" \
  comment="Poll config from cloud every 5 minutes"

/system/scheduler/add \
  name="status-publish" \
  interval=1m \
  on-event="/system/script/run status-publish" \
  comment="Publish telemetry to cloud every 60 seconds"

:log info "Initial setup complete — device registered"
:put "Setup complete! Rebooting to start MQTT connection..."
:delay 3s
/system/reboot