# WavePass Cloud Provisioning Script (RouterOS v7)
# Generated dynamically for Gateway ID: 

# 1. HotSpot Server Profile
/ip hotspot profile add name="wavepass-profile" \
  hotspot-address=10.5.50.1 \
  dns-name="login.nexawavepass.com" \
  login-by=mac,mac-cookie,http-chap,http-pap \
  login-page="https://nexawavepass.com/portal"

# 2. HotSpot Server Instance
/ip hotspot add name="wavepass-hotspot" \
  interface=bridge1 \
  profile=wavepass-profile \
  addresses-per-mac=1 \
  disabled=no

# 2b. DHCP Server Lease Time (1d lease prevents IP churn & duplicate host table entries)
/ip dhcp-server set [find] lease-time=1d

# 3. Walled Garden Rules (Bypass for authentication & checkout)
/ip hotspot walled-garden add dst-host="*.paystack.co" action=allow comment="Paystack API"
/ip hotspot walled-garden add dst-host="*.paystack.com" action=allow comment="Paystack Checkout"
/ip hotspot walled-garden add dst-host="checkout.paystack.com" action=allow comment="Paystack Hosted"
/ip hotspot walled-garden add dst-host="*.supabase.co" action=allow comment="Supabase Cloud"
/ip hotspot walled-garden add dst-host="nexawavepass.com" action=allow comment="WavePass Domain"
/ip hotspot walled-garden add dst-host="*.nexawavepass.com" action=allow comment="WavePass Venues"
/ip hotspot walled-garden add dst-host="api.nexawavepass.com" action=allow comment="WavePass API"

# 3b. Walled Garden IP Rules — dst-host matching never fires for clients using
# DNS-over-HTTPS (private DNS), so the critical hosts are also allowed by IP.
# The API address is the current A record of api.nexawavepass.com; keep in sync
# with the app's provisioning script when the server IP changes.
/ip hotspot walled-garden ip
add comment="WavePass API Static IP (HTTPS)" dst-address=134.209.116.20 action=accept
add comment="WavePass Root Portal (HTTPS)" dst-host="nexawavepass.com" action=accept
add comment="WavePass Portal (HTTPS)" dst-host="*.nexawavepass.com" action=accept
add comment="Google Fonts (HTTPS)" dst-host="fonts.googleapis.com" action=accept
add comment="Google Fonts Static (HTTPS)" dst-host="fonts.gstatic.com" action=accept
add comment="Paystack Wildcard (HTTPS)" dst-host="*.paystack.com" action=accept
add comment="Paystack Checkout Co (HTTPS)" dst-host="*.paystack.co" action=accept
add comment="Paystack API (HTTPS)" dst-host="api.paystack.co" action=accept
add comment="Paystack Checkout UI (HTTPS)" dst-host="checkout.paystack.com" action=accept

# 4. Standard & Multi-Device User Profiles with Rate Limiting (Mikhmon Parity)
/ip hotspot user profile add name="profile_1h" session-timeout=1h keepalive-timeout=2m shared-users=1 status-autorefresh=1m rate-limit="10M/5M" add-mac-cookie=yes mac-cookie-timeout=3d comment="WavePass 1-Hour Tier"
/ip hotspot user profile add name="profile_12h" session-timeout=12h keepalive-timeout=2m shared-users=1 status-autorefresh=1m rate-limit="15M/5M" add-mac-cookie=yes mac-cookie-timeout=3d comment="WavePass 12-Hour Tier"
/ip hotspot user profile add name="profile_1d" session-timeout=1d keepalive-timeout=2m shared-users=1 status-autorefresh=1m rate-limit="20M/10M" add-mac-cookie=yes mac-cookie-timeout=3d comment="WavePass 24-Hour Tier"
/ip hotspot user profile add name="profile_duo" session-timeout=1d keepalive-timeout=2m shared-users=2 status-autorefresh=1m rate-limit="15M/5M" add-mac-cookie=yes mac-cookie-timeout=3d comment="WavePass Duo Tier (2 Devices)"
/ip hotspot user profile add name="profile_family" session-timeout=1d keepalive-timeout=2m shared-users=5 status-autorefresh=1m rate-limit="25M/10M" add-mac-cookie=yes mac-cookie-timeout=3d comment="WavePass Family Tier (5 Devices)"

# 5. Anti-Tethering Firewall Mangle Rule (Blocks Phone Hotspot Forwarding)
/ip firewall mangle add chain=postrouting action=change-ttl new-ttl=set:1 out-interface=bridge1 comment="WavePass: Anti-Tethering"

# 6. Low-RAM Memory Auto-Cleanup Script & Scheduler (Mikhmon Parity)
:if ([:len [/system/script find name="wavepass-cleanup"]] = 0) do={
  /system script add name="wavepass-cleanup" source={/ip hotspot user remove [find comment="expired"]; /ip hotspot ip-binding remove [find type=bypassed comment~"expired"]} comment="WavePass expired user purge"
}
:if ([:len [/system/scheduler find name="wavepass-cleanup"]] = 0) do={
  /system scheduler add name="wavepass-cleanup" interval=2h on-event="wavepass-cleanup" comment="WavePass 2-hour user cleanup"
}