# EngageMobile MikroTik starter v1 - RouterOS 7, EXISTING isolated HotSpot only.
# Hardware compatibility is not yet field-verified. Read setup-guide.md first.
# This is a guarded configuration template, not an unattended installer.
# Review a redacted diff and rollback with the network operator before import.
# No factory reset, firmware install, DHCP/NAT/firewall changes or remote fetch.

:local siteReviewComplete false
:local hotspotProfile "REPLACE_PROFILE_NAME"
:local hotspotServer "REPLACE_HOTSPOT_SERVER_NAME"
:local htmlDirectory "REPLACE_DEDICATED_HTML_DIRECTORY"
:local tlsCertificate "REPLACE_VALID_TLS_CERTIFICATE_NAME"
:local radiusAddress "REPLACE_PRIVATE_RADIUS_IPV4"
:local radiusSecret "REPLACE_UNIQUE_NAS_SECRET"
:local authenticationPort 1812
:local accountingPort 1813

:if ($siteReviewComplete != true) do={ :error "STOP: complete the site guide, backup, redacted diff and rollback review first." }
:if (($hotspotProfile ~ "REPLACE") || ($hotspotServer ~ "REPLACE") || ($htmlDirectory ~ "REPLACE") || ($tlsCertificate ~ "REPLACE") || ($radiusAddress ~ "REPLACE") || ($radiusSecret ~ "REPLACE")) do={ :error "STOP: fill every site value privately before import." }
:if ([:len $radiusSecret] < 24) do={ :error "STOP: use the unique registered NAS secret (at least 24 characters)." }
:local profileIds [/ip hotspot profile find where name=$hotspotProfile]
:if ([:len $profileIds] != 1) do={ :error "STOP: expected exactly one reviewed HotSpot profile." }
:local serverIds [/ip hotspot find where name=$hotspotServer]
:if ([:len $serverIds] != 1) do={ :error "STOP: expected exactly one reviewed HotSpot server." }
:if ([/ip hotspot get $serverIds profile] != $hotspotProfile) do={ :error "STOP: the server does not use the selected profile." }
:if ([:len [/ip hotspot find where profile=$hotspotProfile]] != 1) do={ :error "STOP: the selected profile is shared; isolate the test server before continuing." }
:if ([:len [/certificate find where name=$tlsCertificate]] != 1) do={ :error "STOP: the selected TLS certificate is missing." }
:if ([:len [/radius find where service~"hotspot"]] > 0) do={ :error "STOP: existing HotSpot RADIUS configuration requires a manual migration review." }

# Prerequisites: fixed HTTPS origins, a private RADIUS path, registered NAS/client
# identity and observed source address, dedicated copied HotSpot HTML files,
# an exact portal allowlist, and reviewed guest IPv6 enforcement.
# Check the ports against the actual server; the development overlay uses
# 28120/28130 internally and does not establish deployed ports or reachability.
/radius add service=hotspot address=$radiusAddress authentication-port=$authenticationPort accounting-port=$accountingPort secret=$radiusSecret timeout=3s comment="EngageMobile-starter-v1"
/ip hotspot profile set $profileIds use-radius=yes radius-accounting=yes radius-interim-update=1m login-by=https ssl-certificate=$tlsCertificate html-directory=$htmlDirectory
:put "Configuration imported. This does not prove guest connectivity; complete every acceptance check."