Monsieur Wifi

Monsieur Wifi is the cloud controller for WiFi routers — a separate product line from the Edge Gateway, sharing the same identity provider, design system and platform infrastructure.

It handles multi-location provisioning, captive portal management, guest authentication, traffic policy (QoS), domain blocking, firmware delivery, and e-commerce, served to OpenWRT-based routers via a device API.

Domain model

Organisation
  └── Zone
       └── Location
            └── Network (SSID)

A Location groups one or more Networks, and each network is an SSID with its own VLAN, captive portal design, idle timeout, bandwidth limits, and QoS policy (full or scavenger). Some tables are keyed by network_id, others by location_id.

Captive portal and guests

Portal designs are per network — logo, colours, terms, gradients — and working hours control when the portal is active.

Guests authenticate by MAC address plus OTP, and sessions are tracked in RADIUS accounting. Guest credentials are scoped by network_id, and the FreeRADIUS policy resolves that from the NAS identifier before looking up credentials and applying per-network bandwidth limits.

QoS

Priority only — SNI-based DSCP marking on the router, with no bandwidth shaping. There are four fixed classes:

Class	Label	Priority	DSCP
EF	Real-Time	Highest — lowest latency guaranteed	46
AF41	Streaming	High — less than Real-Time	34
BE	Default	Normal — unmatched traffic, and QoS-disabled	0
CS1	Background	Lowest — deferred when congested	8

The domain-to-class mapping is global and managed by superadmins. Admins toggle QoS per location, and each network independently selects full or scavenger.

Roles

Authorization is decided by the shared authz service; it is the only authority. Monsieur Wifi seeds its own roles in the 100–199 id band (app/Services/Authz/Roles.php), on mrwifi:* targets:

id	Role	Grants
101	mrwifi:location_owner	mrwifi:location → *
102	mrwifi:location_editor	mrwifi:location → read, write
105	mrwifi:location_viewer	mrwifi:location → read
108	mrwifi:zone_owner	mrwifi:zone → *
109	mrwifi:zone_editor	mrwifi:zone → read, write
110	mrwifi:zone_viewer	mrwifi:zone → read
106	mrwifi:device_owner	mrwifi:device → *
107	mrwifi:design_owner	mrwifi:design → *
103	mrwifi:platform_admin	mrwifi:system → * (superadmin)
104	mrwifi:platform_operator	mrwifi:system → resources:manage (admin: every resource, not users or settings)

Resource roles are granted on a specific id; the two platform roles on mrwifi:system with target id *. Authorizer.php memoizes results per request, so a page makes at most one authz call per subject and capability.

Device API

Routers authenticate with a key/secret pair in the path (/api/devices/{device_key}/{device_secret}/…) rather than a user session:

Endpoint	Purpose
v2-settings	Full router config: networks, captive portal, RADIUS, QoS block
settings	Older settings endpoint, still served
heartbeat	Router heartbeat / online status
firmware	Firmware for this device's model
clients	Push the connected client list

v2-settings is the important one: it compiles the whole configuration — including the QoS classes, domain mapping, per-network policy and a config version hash — and the router pulls it.

This is a pull model

Unlike the Edge Gateway, which is pushed configuration over a live channel and confirms it, Monsieur Wifi routers pull their configuration and compare a version hash. There is no apply/confirm window and no automatic rollback.

Where the code lives

Repo / path	Contains
platform/mr-wifi	The Laravel application (PHP), the device API
platform/mr-wifi/services/go	mr-wifi-go, the Connect service, and the source of truth for proto/mrwifi/v1
platform/mr-wifi/router	The Cloudflare Worker that splits one domain between the two frontends
platform/mr-wifi-svelte	The SvelteKit frontend for carved-out pages (carries an identical copy of the protos)

See Migration for how those fit together.