Flosoft2006 — Multi-Site Provisioner

API · Test database connection

For testing only. The browser can send the client record to the local FastAPI server. The API/database becomes the authoritative allocator; localStorage remains available as a local backup.

Test API URL

API not tested yet.

00 · Site identity

Every client/MikroTik gets a unique identity. The registry below is used locally to prevent collisions before a new configuration is generated.

Client / site ID

Client display name

01 · New public endpoint

New dedicated public IPv4

No comprobada

Existing VPS IP

Existing WG UDP port

VPS SSH port

Dedicated full DMZ
Only this public IP is mapped to this site's WireGuard peer.

02 · New WireGuard peer

The VPS keeps one shared wg0. This site is added as a separate peer. Never reuse tunnel addresses or keys.

✓ WireGuard allocation is automatic
Calculating the next free isolated /30…

Existing VPS public key NEW MikroTik public key NEW MikroTik private key

Persistent keepalive 25s (recommended behind CGNAT)

03 · Automatic isolated allocation

Each client gets its own /30 WireGuard subnet. The first client uses 10.0.0.0/30 (VPS .1, MikroTik .2), the next uses 10.0.0.4/30, then 10.0.0.8/30, etc. CGNAT range 100.64.0.0/10 is never allocated.

Allocation mode

WireGuard base network

04 · Internal LAN

Each client should have a non-overlapping LAN subnet. This is critical for clean separation and future routed management.

LAN / CIDR

Gateway

DHCP start

DHCP end

Primary device IP

Primary device port

WinBox port

Remote WinBox port

05 · Active Ethernet ports

ether1 is treated as WAN. Select the physical LAN ports for this MikroTik.

06 · Virtual / forwarded ports

These rules are generated on the MikroTik. If DMZ is enabled, the VPS does not need a separate rule for each service. Public port uniqueness is checked per public IP; target ports can be reused on different client LANs.

07 · Isolation & collision check

Fill in the new site details to run collision checks.

08 · Existing sites / allocations

Stored only in this browser. Import the registry on a new admin PC before generating configurations there.

09 · Database-ready record

The future API/database should use these stable fields. The browser registry already exports them in JSON.

Suggested table: client_sites
site_id · client_name · public_ip · wg_network · wg_vps_ip · wg_mikrotik_ip · mikrotik_public_key · mikrotik_private_key · vps_public_key · winbox_port · winbox_external_port · lan_subnet · lan_gateway · dhcp_start · dhcp_end · dmz · created_at

10 · Generate safely

The VPS file is an additive change: new public-IP alias + one new wg0 peer + site-scoped DMZ/forward rules. It does not replace wg0 or existing peers. The MikroTik file is a complete site RSC.