Zero-Touch Automated Config Sync
Manage MikroTik routers on remote sites.
Zacsync manages MikroTik routers on metered, unreliable links: vessels at sea, remote towers, sites a long drive away. Before any change runs, the router sets up its own automatic rollback.
The problem
Why remote sites are different
Links are metered, slow and sometimes down. Traffic from your management tool is billed to the site, so even a routine nightly update check adds to the bill.
Nobody is on site. If a router stops responding, someone has to travel to it.
One bad change can cut you off. A wrong firewall rule or address change can drop the management tunnel and leave the router unreachable.
Safeguards
Designed for when a change goes wrong
Automatic rollback for every change
Before running your commands, Change Guard takes a backup and sets a revert timer on the router itself. Afterwards, Zacsync opens a new connection to check the router still responds, then cancels the timer. If it can't confirm in time, the router restores the backup and reboots. A change that would have locked you out costs one reboot instead of a site visit.
Upgrades start with test devices
One device of each hardware model is upgraded first. If any of these fails to come back, the rest of the batch is skipped. Results show whether each device was skipped or attempted and failed, so the two are never confused.
No background traffic on metered links
Checking for a new RouterOS version uses the router's own connection, so Zacsync only does it when you ask. The regular poll reads the router's cached result instead. Cost estimates don't show a total if any device's download size is unknown, since a partial total would understate the bill.
What it does
Features
Monitoring
Polls every device for identity, version, board, uptime, interfaces and reboots, with live updates in the dashboard.
Built
Backups in git
Full configuration exports, saved only when something changed. Compare any two versions, download one device or the whole fleet. History is never rewritten.
Built
Guarded commands
Run RouterOS commands across the fleet with live output. Read-only commands run directly; anything that changes configuration is guarded automatically.
Built
Upgrades
Check for updates, estimate the download cost, then upgrade in stages with per-site maintenance windows. Each upgrade is checked to confirm the new version is running.
Built
Zero-touch enrolment
Paste one script into the router's terminal. It sets up the tunnel, a management user and a firewall rule, then waits for your approval. No manual WireGuard setup.
Built
Active/standby pairs
Two routers sharing one virtual IP. VRRP failover based on WAN health, configuration copied from master to standby, split-brain resolution, and crew logins that move with the failover. Tested in a lab.
Built · lab-tested
Alerts, graphs, usage
Telegram and email alerts with retries, alerts for an uplink that is up but passing no traffic, 90-day traffic graphs, and a usage report with CSV export.
Built
Crew hotspot RADIUS
Hotspot access sold on one site works on all of them. Accounts are stored centrally and the router enforces the quota, so sessions are handled correctly even when the link drops.
Built · optional
Where it fits
Built for ships, suited to any remote site
Zacsync was built for vessels on satellite links, where the connection is expensive, slow and often down for hours, and the nearest engineer may be far away.
The same approach works for WISP towers, rural ISP sites at the end of a long backhaul, and other remote locations with similar constraints.
How you run it
Self-hosted or hosted
Zacsync runs on your own server, and your router credentials stay on your own storage. A free hosted beta is also available at app.zaacsyn.com, by invitation.
# install
docker compose -f docker/docker-compose.yml up -d --build
docker compose -f docker/docker-compose.yml exec zacsync \
python -m zacsync.cli create-admin --username admin
# check it is running
curl http://localhost:8080/api/healthTesting
How Zacsync is tested
Zacsync is in early release and has no public customers yet. This is how it is tested.
Simulator tests
A fast test suite runs against a RouterOS simulator on every change.
Every change
Real hardware tests
A second suite runs the same code against real routers. Any difference from the simulator becomes a new test.
Bench suite
Real reboots
Upgrades and rollbacks are tested on hardware that actually restarts. A router that drops out mid-test is waited for, not skipped.
Reboot tests
Known limits
Router configuration backups on the hub are not yet encrypted at rest, commands run on one device at a time, and billing and passkeys are not available yet. These are listed here and in the README.
Limits
Try it on your own routers.
Read the documentation to install Zacsync and enrol your first router.