Feature: Multi Tenant

[johnnyq]

Netpulse looks like it has a real potential for MSP space. We use unifi self hosted controller for 27 clients it would be nice if netpulse was multi-tenanted and could easily switch between tenants in the UI. One day Unifi isnt always going to be self hostable i feel like they may go down like everyone else with their vendor lock in.

[crowedavid]

definitely on-board with this - i think of it as multi-site but same concept.

this might be better to move to a Discussion since @gnacho likes to keep the issues list clean. there was an opener for a discussion of this recently but it looks to have been pulled for some reason.

since you have a specific use case, if you can describe what features you'd need to replicate for the UniFi self-host controller feature set that would get the ball rolling on a plan.

[gnacho]

Yes please, it's interesting and I would like to go deeper, can any of you move it to a Discussion? @johnnyq @crowedavid

Sorry if I closed something by accident. And yes, that's exactly my workflow: every release starts from zero open issues, with a clean backlog on my side. Quick releases and iteration against real test environments.

Right now I'm heads-down on a new feature that's giving me some trouble. I'll probably cut a release with the bug fixes and the MCP connector, then keep testing until the new feature is better proven. It should be a nice surprise. Hopefully.

[crowedavid]

Yes please, it's interesting and I would like to go deeper, can any of you move it to a Discussion? @johnnyq @crowedavid

i think the project owner can convert Issues into Discussions - maybe @johnnyq can since they opened the issue. i am just a lowly commenter so i can only type comments madly.

Sorry if I closed something by accident. And yes, that's exactly my workflow: every release starts from zero open issues, with a clean backlog on my side. Quick releases and iteration against real test environments.

i think it was Discussion item #1072 but it shows as "[Superceded]" in the list. not sure how it reached that state but it appears blank.

Right now I'm heads-down on a new feature that's giving me some trouble. I'll probably cut a release with the bug fixes and the MCP connector, then keep testing until the new feature is better proven. It should be a nice surprise. Hopefully.

looking forward to it!

[gnacho]

#1072 was an idea a collaborator sent me by email. I initially opened it for him, then decided it was his to open himself, so it ended up in that state. He may get to it in the next few days.

[crowedavid]

ah, that makes sense and agreed.

if you want to move this item to a discussion we can continue the conversation there and get out of the issues list. i think only the project owner can make the issue->discussion move.

[MassiPi]

Hello,
i'm probably facing the same topic :) let me try to explain with my test topology

Access point, and the two RUTTOs are with agents installed. The CPE is not, since it's in the wan zone and i don't want reverse connections.
Basically, CPE is the modem used by the RUTTO in the low part of the image. They should be connected, instead it shows another client (that is RUTTO)
Also, CPE and the low RUTTO are remote, they are connected to the main RUTTO through those two wireguard channels.

basically, i understand now netpulse is not made to manage this :)
is this something you want to implement? this takes with it a lot of things (for example speedtest will need to be by fleet device, not general), but would be very cool!
thanks

[gnacho]

Hello @MassiPi, your diagram makes the question concrete, thanks.

Short answer: there is no multi-tenancy today. One NetPulse instance means one fleet. Nothing in the config model or the store separates tenants, so you cannot switch between clients in the UI, and the speedtest is a single global scheduler with no per-device dimension at all. You read that correctly.

Your picture mixes two different problems, and they have very different costs.

The first one is the CPE. What you need there is not a tenant, it is a unit that is never expected to run an agent. That changed this week: each unit now declares an inventory mode, auto, agent or ssh. In ssh mode the server stops treating a missing agent as a failure and reads the unit over SSH whenever it can reach it. It ships in the next release, 2.51.4.

One caveat I would rather state now than let you discover later. The mode decides how the unit is read, not whether it is reachable. If your server cannot open a session to the CPE because that CPE sits in the WAN zone with no route back, no mode helps and you need an inbound path you accept, for example a reverse tunnel. With no session, the honest answer is that there is no inventory from that unit.

The second one is the topology mistake in your screenshot, where the CPE shows up as a client of the lower RUTTO instead of as its uplink. That is a separate bug and 2.51.x changed leaf inference, so if you still see it on 2.51.3 open an issue with the version of the agent on each unit and I will look at it properly. Do not mix it with the multi-tenant question.

On multi-tenant itself, before designing anything I need to know which of these you actually mean:

1. Logical grouping: one instance, every client in the same database, a filter to focus on one client at a time.
2. Isolation: separate credentials and visibility per client, so one client cannot see another one's devices even by mistake.

Those are different products. The first is a view layer. The second reaches the data model, the API, alerts and the auth, and it is a large piece of work.

For your UniFi comparison it would also help to know what the switch between tenants changes in practice. Do you need different users per client, or just a way to not read 27 networks at once?

[MassiPi]

Hello,
i understand i have to elaborate more, and sorry for time and tokens lost.
Let me try

Context: i'm not looking for a proper "multi tenant" (i hope with this to answer many of your points), i'm looking to keep trace and control on ALL my fleet: i have lets say two homes, i want to have a single place showing both the infrastructures, starting from the assumption that a connections is up between the two locations.
No different admins, no different users, it's just my fleet, but it is distributed :)

One caveat I would rather state now than let you discover later. The mode decides how the unit is read, not whether it is reachable. If your server cannot open a session to the CPE because that CPE sits in the WAN zone with no route back, no mode helps and you need an inbound path you accept, for example a reverse tunnel. With no session, the honest answer is that there is no inventory from that unit.

Not sure we are on the same page. I well have a connection to my cpe, the point is that i don't want to allow the initiation of connections the other way around. That's why i'm monitoring it with only ssh. And this is ok.

On multi-tenant itself, before designing anything I need to know which of these you actually mean:

1. Logical grouping: one instance, every client in the same database, a filter to focus on one client at a time.
2. Isolation: separate credentials and visibility per client, so one client cannot see another one's devices even by mistake.

I'm not sure any of this is aligned with what i'm thinking. Let me try to explain better:

• My primary router and my remote router are connected with Wireguard tunnel site2site (indeed, two different tunnels). Site to site tunnels are shown in netpulse as wireguard peers, but they are very different things, probably this can be implemented better.. Tunnel is placed on the remote router, not on the remote CPE.
• The CPE is, indeed, just the modem. It is still remote. It has it's internet connection, its speedtest, its latency. (that's why i talked about speedtest by device and latency by device)
• Local router/AP and remote router have their specific clients. They see each other, yes, but they are phisically separated.

So i'm dreaming of the possibility to show something like that, with wireguard tunnels able to be shown as connection between fleet devices and the possibility to have different "locations" in the same topology. Yes if you want it would be nice to be able to filter by location, but not that essential. The core is always the local gateway.

What is less clear to me is how to show the CPE. It is NOT the connection to the main topology (wireguard is placed on the router..), maybe it could be a specific nature of "modem"? so, in the topology, it could be represented with the same form of todays "internet".
Just to try to explain myself..

Thanks a lot for listening to me 🤣

For your UniFi comparison it would also help to know what the switch between tenants changes in practice. Do you need different users per client, or just a way to not read 27 networks at once?

here i lost myself..