HTTPS support v2

Support is included in normal enrollment. The antenna initiates verified HTTPS over TCP 443, including behind carrier NAT. No Nginx change, inbound antenna port or companion computer is needed. This is a command queue, not interactive SSH or remote WebFig.

The v2 script and recovery guard need lab validation on RouterOS 7.23.7. Automated tests cover server behavior and simulated browser/device exchanges; they do not execute RouterOS. The earlier telemetry validation does not validate these new features.

Complete setup.rsc — fresh installation Support only — existing installation

Fresh installation

Use the standard setup guide. The combined file includes telemetry, support, undo and recovery scripts and disabled schedulers. Privately replace both device-token placeholders with the same enrolled token. Do not import it over existing scripts.

Upgrade an existing antenna

Leave pcsrt-poll unchanged. Download support.rsc, set pcsrtToken privately to the same device token, and check pcsrtLte. Use a separate placeholder-token copy for syntax checks:

/import file-name=support.rsc verbose=yes dry-run

If upgrading support v1, end its browser session, disable its scheduler and wait at least 20 seconds for its current fetch to finish. Inspect /system script job print and wait until no support job remains. Remove only the old support scheduler and script:

/system scheduler disable [find where name="pcsrt-support"]
/system scheduler remove [find where name="pcsrt-support"]
/system script remove [find where name="pcsrt-support"]

For future v2 upgrades, first finish or locally resolve any armed recovery guard. Do not remove recovery while armed. Review and remove the existing pcsrt-recovery scheduler and script and pcsrt-undo script before importing replacements. Never create duplicate names.

Upload the configured file using WinBox Files. Do not use verbose import with a real token:

/import file-name=support.rsc
/system script run pcsrt-support
/system scheduler enable [find where name="pcsrt-support"]

Support, recovery and undo scripts/schedulers must share the same full-permission owner. They request ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon, with permission checks enabled. Custom scripts execute with these privileges, subject to RouterOS/device-mode restrictions. Delete the uploaded token-bearing file after importing. Confirm the browser shows agent v2. The recovery scheduler starts disabled and enables itself when a guarded command is prepared.

Use the console

Sign in, select a device and open HTTPS support. Start a session. Read-only diagnostic mode retains the six existing shortcuts and works with v1 agents. Choose RouterOS script to submit arbitrary finite RouterOS code (up to 4,096 characters). Review it, acknowledge its privileges and click Run script. Clipboard paste only fills the editor.

Browser output comes from :return, not console print or :put. Examples:

:return [/system identity get name]
:return [/ip address print as-value]
/system identity set name="SXT-Lab"
:return [/system identity get name]

Returned values are JSON encoded and capped at approximately 2,000 characters. Empty returns report completion without a value. Errors report generic failure to avoid leaking source or secrets. Inspect state before retrying a failed script: earlier lines may already have taken effect. Avoid commands requiring prompts, continuous output or indefinite loops. Changing scripts, packages, credentials, firewall rules or device mode may interrupt support. Script text, undo text and returned output are administrator-visible database content; keep backups private. The application audits IDs/actions without logging command text or output.

Five-minute recovery

Recovery is selected by default in script mode. Supply an explicit undo script restoring the previous settings, or deliberately turn recovery off. There is no automatic configuration snapshot. For an identity change, first read the current identity; an undo might be:

/system identity set name="ORIGINAL-IDENTITY"

The antenna parses the command and undo script, persists the undo and enables an independent local watchdog before running the command. Successful authenticated support responses refresh an in-memory uptime heartbeat. If none arrives for five minutes, the watchdog attempts the undo once, within roughly another ten seconds. A short outage that recovers in time resets the timer. A reboot preserves the undo and armed flag; the router gets five minutes after boot to reconnect. Power-off time does not count.

After inspecting the result and connectivity, click Keep changes. Wait for the antenna to report committed; clicking alone does not disarm it. The guard stays armed until then, even after you close the browser, log out or end the support session. Idle support polling continues every 30 seconds. Token revocation/rotation, server downtime or disabling support polling can trigger the guard. Finish recovery before planned maintenance.

This is best-effort execution of your undo script, not RouterOS Safe Mode. It cannot recover from removed/disabled recovery scripts or schedulers, reset configuration, lost permissions, power loss, hardware failure or exhausted resources. It checks this support endpoint, not every LAN service or Internet destination. A command can partially succeed and defeat its own recovery. Never regard a reported rolled_back as proof every setting was restored; verify actual state. Failed undo is not automatically repeated.

Execution and session rules

Sessions expire after 15 minutes without real keyboard, click or scroll activity in the visible tab, with a four-hour maximum. Background polling and incoming output do not extend them. Queued commands expire after two minutes. Diagnostics may safely repeat. Arbitrary scripts require an atomic one-time claim; no command is resent after it is claimed, even if the permit or result is lost. A claimed script without a result becomes uncertain after 15 minutes. A reboot normally loses its in-memory result; verify uptime and router state.

Only one arbitrary script may be outstanding per device. New script claims wait until the prior result and recovery are settled; queued requests may expire meanwhile. Read-only diagnostics remain available. Stopping a session cancels unclaimed work; it cannot stop an already running script or disarm recovery. Results from claimed scripts are accepted after session expiry. Another administrator can keep changes or resolve uncertainty after local inspection.

For uncertain execution or rollback_failed, verify the actual router state locally, stop any unfinished command, and disarm the guard locally if still armed. Then use Resolve after local inspection; it clears the server block and never reruns the command. Local guard disarm, only after inspection:

/system scheduler set [find where name="pcsrt-recovery"] comment="committed" disabled=yes

Commands/results are normally retained for 24 hours, cleaned on support requests. Outstanding recovery records are retained until settled. They are not a permanent change log.

Lab checks before rollout

1. Verify placeholder-file dry-run and import, v2 check-in and existing telemetry.
2. Run :return [/system identity get name] with recovery off.
3. Change identity with a matching undo script. Verify the change; Keep changes and wait for committed.
4. Repeat with recovery armed, then locally disable only the support polling scheduler. After five minutes plus one watchdog tick, verify identity is restored and re-enable support polling. Do not cut off your local access.
5. Test an outage shorter than five minutes, restart while armed, failed undo, and duplicate delivery before production use.

Official scripting reference (:parse, :return, permissions) · Scheduler reference · Console Safe Mode

Normal enrollment · Dashboard