The Problem

MikroTik RouterOS v7 lacks a modern, real-time web dashboard. The built-in web interface is dated, and third-party tools typically poll SNMP or scrape logs, which means stale data, delayed alerts, and no live view of connections, traffic, or wireless clients. Operators need a live operational view without building custom polling infrastructure.

What This Does

MikroDash connects directly to the RouterOS binary API over a persistent TCP connection and streams live data to the browser via Socket.IO. The backend (src/index.js) handles router communication, data collection, and WebSocket broadcasting; the frontend (public/app.js) renders the dashboard with drag-and-drop cards, live charts, and geo-mapped connections. Docker support is first-class, with both a root docker-compose.yml and a hardware-specific deployment at deploy/r5s/docker-compose.yml.

How It Is Wired

Execution starts at run in src/index.js:1111, which reaches 30 functions. From there, the system connects to the router via src/routeros/client.js, which handles the binary protocol and reconnection logic. The emit function at src/index.js:93 is the hub for outbound events, reaching 24 functions.

Data flows through the collectors in src/collectors/ — one file per domain (arp.js, firewall.js, wireless.js, connections.js, etc.). Each collector polls the router, transforms data, and emits updates. The src/routers.js file manages router credentials, including encryption/decryption of stored secrets (_encrypt, _decrypt). src/db.js handles persistence with SQLite migrations.

The most-connected modules are src/index.js (imports 33 modules, instability 1.0) and src/settings.js (imported by 7 files, instability 0). The $ helper in the frontend is called from 41 places, and esc (HTML escaping) from 36 — both are critical to the UI layer.

The system touches the filesystem for persistence, performs cryptographic operations for credential storage, and makes outbound network calls to the router. A traced path: emit -> evaluateForRouter -> getById -> loadAll -> _uuid (crypto).

How To Use It

git clone https://github.com/moses-y/MikroDash
cd MikroDash
cp .env.example .env
# Edit .env with your router credentials
npm install
npm start

For Docker:

docker-compose up -d

Configuration lives in .env (root) — router IP, credentials, and dashboard settings. The first-run setup wizard in the UI can also configure routers without editing files.

Real-World Use

A small ISP or office with multiple MikroTik routers can run one MikroDash instance, add each router via the multi-router switcher, and monitor live connections, bandwidth, and wireless clients from a single pane. The firewall and connection cards give real-time visibility into traffic patterns, and the geo-map shows connection origins — useful for spotting anomalous traffic.

Code Health & Issues

Static analysis found 59 issues: 4 high, 55 medium.

  • High — Duplicated code blocks: 35 repeated 6-line blocks across 12 files in src/collectors/. Extract shared helpers.
  • High — Oversized files: public/app.js (5,933 lines), src/index.js, and test files exceed maintainable size. Split by responsibility.
  • Medium — Empty catch blocks (27 occurrences) in src/settings.js, src/routeros/client.js, src/collectors/connections.js. Errors are silently discarded.
  • Medium — High branching density (23 files), including src/alerter.js with 127 branch points over 241 lines.

SDLC observations: CI exists but never runs the 7 test files. GitHub Actions are pinned to mutable tags (@v3) instead of commit SHAs. No Dependabot configuration. Dockerfile uses node:20-alpine without a digest pin or non-root user. No dependency vulnerability scan in CI.

The Bottom Line

MikroDash is a functional, feature-rich dashboard with real-time streaming and a solid collector architecture. The main risks are maintainability — oversized files and duplicated logic — and CI that doesn't test anything. It's suitable for production use by MikroTik operators who accept the maintenance burden; the security hardening items should be addressed before exposing it beyond a trusted network.