I run 49 MikroTik routers across shops, canteens and oilfield sites in
Siberia, reachable over WireGuard with SSTP as a fallback. Doing routine
work on them through WinBox, one window per router, stopped scaling a
while ago. So I built a panel for it and put it on GitHub under MIT.
Site with screenshots and install notes: https://tikpilot.ru
Latest: v1.69.0 (22 Aug) - status is now reachability-first, a
needs-attention list on the dashboard, and speed tests between two of your
own sites. Release notes
What it does
- Needs attention: one list at the top of the dashboard instead of six
pages - offline and flapping sites, packet loss, stale backups, syslog
that stopped arriving, armed rollbacks, failed jobs, CPU and memory
pressure, services open to any address, available updates. When
everything is calm the block is not there. - One action for the whole fleet: reboot, run a script that is already
on the router, upload or remove a script, take a backup, set identity,
check for RouterOS updates, upgrade, measure the bandwidth to another
site. Every action becomes a job with a per-device result, so you see
which 3 of 49 failed and why. - Availability monitoring: a site counts as up when it answers, over
the API or over ICMP. If only ICMP answers it stays up and gets a "no
API" marker, because a broken tunnel is not a dead shop. Uptime per
site, latency and packet loss measured from the router itself, a fleet
map and reports by group, device and date range. - Backups on a schedule: binary
.backupand text.rsc, N copies
kept per device, diff between any two configs, full-text search across
all stored configs. Plus an archive of the panel itself, for the day the
server dies. - Script library: keep your scripts in one place and see which router
actually has which one, without walking the fleet. - WireGuard: router-to-router links through a hub, with handshakes,
traffic and routes. The spoke config is generated for you. - Syslog receiver: logs from the whole fleet with filters and rules for
hiding the noise. - Clients behind the routers: what is connected at each site, wired or
wireless, with vendor by MAC. - Users and rights: every capability is granted separately, and an
account can be limited to certain groups or devices. - Interface in English and Russian, switchable from the menu.
A fleet-wide speed test, one line per site, measured by the routers
themselves rather than from the server:
ВСТАВИТЬ КАРТИНКУ: speedtest.png
What it is not
- Not an NMS. It does not scan your network, does not draw topology, does
not poll SNMP. If you need that, you want Zabbix, LibreNMS or The Dude. - Not a WinBox replacement. It does the repetitive fleet-wide work; the
fine tuning still happens in WinBox. - Not a cloud service. It runs on your own machine, the data stays in a
local SQLite file, and nothing is sent anywhere.
Install
git clone https://github.com/maximdr86/tikpilot
cd tikpilot
cp .env.example .env
docker compose up -d
Then open the panel, add devices by hand or import a CSV, and create an
API user on the routers. It talks to RouterOS over the API (8728/8729)
and over SSH for the terminal.
A few details you may care about
- Router passwords are encrypted at rest with a key kept outside the
database, and the panel can be limited to trusted networks. - Session pooling: the fleet is polled over persistent API sessions, not a
new login per check, so the routers do not see a login storm. - 300+ tests run in CI on Python 3.10, 3.12 and 3.13.
- There is a screenshot mode: it replaces site names, addresses, client
names and MACs with made-up ones on the fly, so you can show the panel
without showing your network. All screenshots above are made with it.
The code was written by Claude, an AI model, under my direction, as a
sysadmin scratching his own itch. It has been running my fleet for weeks,
but I would rather say that up front than have someone find out from the
commit history.
Feedback welcome, especially from anyone running more than a handful of
routers. What would you expect from a tool like this that is missing here?
