System Overview

URUFI is a software-defined networking (SDN) platform for public and secure WiFi. A central control plane programs commodity Linux edge nodes that enforce access in the packet path: anonymous identity keyed to a phone number, guest access enforced at the DHCP and firewall layer, and secure WiFi delivered as per-device EAP-TLS certificates. There is no captive-portal appliance and no named-subscriber billing stack — the business owns the network end to end.

The model in one paragraph

Network access is a function of three things the platform already owns: a device MAC, an account (keyed only by a phone number — no names, no wallet), and a DHCP lease plus firewall state. A guest comes online by proving a phone number (free tier, optionally OTP-verified) or by redeeming a prepaid PIN. Access is time-boxed by a package expiry. Enforcement is not a tunnel or a concentrator — it is an nftables walled garden on a Linux edge node that redirects unauthenticated devices to the captive portal and opens the internet the instant the account activates. Devices that need secure WiFi receive a per-device EAP-TLS certificate and authenticate against an embedded RADIUS server. No shared password ever exists.

Access model

A site advertises two SSIDs and access happens in two steps. Both share the same account and package model but enforce access very differently.

Open SSID → captive portal. The guest gets online through a branded portal.
Secure SSID → EAP-TLS. Once online, a device can upgrade to certificate-based WiFi authenticated by the agent's RADIUS server.

Step 2 builds on step 1: a device downloads its certificate from the captive portal, so it must complete step 1 first.

Step 1 — Open SSID → captive portal → walled garden

An unauthenticated device is confined by the agent's nftables walled garden: forwarding to the internet is dropped, DNS and the portal host are allowed, and HTTP is redirected to the captive portal so the operating system's captive-portal assistant opens automatically.

The guest proves a phone number or redeems a PIN. On success the platform marks the account active and pushes a device-state event to the site's agent, which adds the device to the authorized nftables set — the internet opens within seconds, with no reconnect.

Step 2 — Secure SSID → EAP-TLS

An activated device can download a secure profile from the captive portal. The platform lazily bootstraps a per-tenant certificate authority, mints a client certificate, and returns a platform-appropriate bundle (.mobileconfig for Apple, PEM elsewhere). The device installs it and joins the secure SSID over 802.1X.

The Edge Agent is the RADIUS server. The access point is configured with the agent's LAN IP as its RADIUS server, and the agent verifies each device's certificate against the tenant CA — no shared password is ever used. Revocation is distributed to agents as a CRL over UFP. Access-point configuration is covered in Install the Edge Agent.

Identity and packages

A package is the single place commerce and networking meet. One package row carries commercial terms (price, duration), the network range (IP pool), the network gear (gateway, netmask, DNS), lease timing, and role flags. Every DHCP offer the agent sends is built from a package. Change the package, and the change reaches the edge on the next renewal — the database is the configuration.

Every device interaction is one turn of the same loop; only the chosen package changes:

Expiry is a timestamp, not a session timeout. On the next renewal an expired device simply falls back to the suspended pool and the captive portal, ready to redeem again.

Multi-tenancy

One deployment serves many business brands with hard data isolation, enforced at four layers:

Database — every row carries a tenant, and uniqueness is scoped per tenant.
Authentication — operator and captive credentials are bound to a tenant.
Request handling — the tenant is derived server-side, never from a request body, and threaded through every query.
Edge — each agent authenticates with a per-agent key tied to a tenant; the server refuses cross-tenant lookups.