# Vimify Edge

Vimify Edge is a small RADIUS authentication and accounting service for a Linux gateway on the same private network as a hotspot router. It works with routers that can use an external RADIUS server; the router itself does not need to be MikroTik.

The cloud keeps the voucher and payment records. Edge stores only renewable 15-minute device authorizations and queued usage events. It never downloads a TID, phone number, or voucher database.

Version 0.3 adds optional WireGuard health telemetry. The management tunnel is independent of RADIUS: local authentication continues when the VPN is disabled, stale, or offline. Edge reports only the interface state, tunnel address, hub endpoint, and last handshake time. It never reports WireGuard private keys.

## Install from a Linux terminal

Requirements: Linux with systemd, Node.js 20 or newer, and a router that supports RADIUS MAC authentication/accounting.

1. Download and extract the Vimify Edge release on the gateway.
2. Run `sudo ./install.sh`.
3. Edit `/etc/vimify-edge.env` using the values from the Vimify device enrollment screen.
4. Configure the router to use the gateway IP on UDP 1812 for authentication and UDP 1813 for accounting, with the same RADIUS secret.
5. Run `sudo systemctl start vimify-edge` and inspect it with `systemctl status vimify-edge`.

Keep both UDP ports on the private LAN. Do not expose RADIUS directly to the internet. The cloud connection must use HTTPS.

## Optional management VPN

After Edge is working locally, an operator may run `/opt/vimify-edge/install-vpn-peer.sh` with the hub endpoint, hub public key, and a unique tunnel `/32` address. The site generates and stores its private key locally. The default peer configuration routes only the Vimify management range and does not replace the site's internet route.

The matching hub package is installed separately on an Ubuntu or Debian VPS. Site-to-site IP forwarding is disabled by default. Use the hub as a controlled bastion rather than exposing router management ports publicly.

## Current compatibility boundary

This first agent implements standard RADIUS MAC authorization, `Session-Timeout`, `Idle-Timeout`, and start/interim/stop accounting. It is suitable for captive-portal hotspots where Vimify has already associated an approved payment with the connecting device. EAP/802.1X, RadSec, and direct packages for closed router operating systems are later adapters.

The MikroTik adapter also supports the RADIUS `Message-Authenticator`, the `Class` accounting attribute, and MikroTik's vendor-specific rate-limit attribute. RouterOS remains the HotSpot controller; the agent runs on the nearby Linux gateway.

## Test

Run `npm test` inside this directory. The agent has no production package dependencies.
