G-Tech ISP Billing System
G-Tech ISP Billing System (G-Tech OS) is a multi-tenant SaaS platform engineered for Internet Service Providers (ISPs), Wireless ISPs (WISPs), hotspot operators, and fiber networks. It unifies subscriber CRM, PPPoE and dynamic hotspot captive portal billing, MikroTik RouterOS v6/v7 fleet orchestration over WireGuard tunnels, FreeRADIUS 3.x AAA session control, Safaricom Daraja M-Pesa payment automation, technician field work orders, and a real-time Network Operations Center (NOC).
01 • Problem Statement
ISPs and WISPs in East Africa often rely on disconnected spreadsheets, manual WinBox router edits, and manual M-Pesa SMS verification, causing delayed subscriber reconnections, revenue leakage, and poor network visibility.
02 • Deployment & Runtime
Vercel Production Next.js App Router deployment (g-tech-isp-billing-system.vercel.app) backed by PostgreSQL / Supabase, FreeRADIUS 3.x SQL AAA, and WireGuard edge router tunnels.
System Architecture Pipeline
Tenant Admin & NOC Dashboard, Customer Self-Care Portal, and Captive Hotspot Portal
CRM, Service Plans, Voucher Generator, M-Pesa Daraja Webhooks, and NOC Telemetry Services
Multi-tenant relational tables, billing ledgers, and FreeRADIUS radcheck/radreply/radacct mapping
RouterOS v6/v7 provisioning, PPPoE queues, hotspot captive portal, and RFC 3576 CoA session control
Architecture & Core Features
- •Next.js 15 App Router & React 19 SaaS Control Plane
- •Multi-Tenant PostgreSQL & Supabase Row-Level Security (RLS)
- •FreeRADIUS 3.x SQL AAA Engine (radcheck, radreply, radacct & CoA)
- •MikroTik RouterOS API/REST Provisioning & WireGuard Control Plane
- •Safaricom Daraja M-Pesa STK Push & C2B Webhook Reconciliation Engine
- •Role-Based Access Control (RBAC) & Double-Entry Billing Ledger
- •PPPoE Subscriber CRM, Bandwidth Queues & Automated Suspension/Reconnection
- •Dynamic Hotspot Captive Portal, Batch Voucher Generation & Self-Checkout
- •Safaricom Daraja M-Pesa Express (STK Push) & C2B Paybill Automation
- •MikroTik RouterOS Fleet Management & Script Provisioning
- •Real-Time NOC Dashboard (Interface Traffic, CPU/RAM Telemetry & Alerts)
- •Field Operations, Technician Work Orders & Customer Self-Care Portal
Engineering Challenges & Solutions
- •Bridging asynchronous mobile money callbacks (M-Pesa STK Push and C2B Paybill) with deterministic FreeRADIUS AAA attribute updates and MikroTik session reactivation
- •Securing edge MikroTik router management without exposing RouterOS API or WinBox ports directly to the public internet
- •Enforcing strict multi-tenant data isolation and granular permissions across ISP owners, finance staff, network engineers, field technicians, and subscribers
- Engineered a payment reconciliation pipeline (MpesaService and /api/v1/mpesa-callback) that validates Daraja callbacks, records ledger transactions, and updates FreeRADIUS radcheck/radreply bandwidth profiles
- Designed a zero-trust WireGuard tunnel topology paired with MikroTikService and automated RouterOS provisioning script generation
- Implemented PostgreSQL Row-Level Security (RLS) across 12 SQL migration modules alongside a fine-grained RBAC permission matrix (src/lib/auth/rbac.ts)
Requirements & Technical Governance
- • Unify PPPoE subscriber management, dynamic hotspot voucher billing, and customer self-care in a multi-tenant SaaS architecture
- • Automate payment collection and instant service activation via Safaricom Daraja M-Pesa STK Push and C2B Paybill webhooks
- • Orchestrate MikroTik RouterOS routers, FreeRADIUS AAA policies, technician work orders, and live NOC telemetry
- • Zero-trust router management over encrypted WireGuard tunnels so RouterOS API ports remain unexposed to the public internet
- • PostgreSQL Row-Level Security (RLS) policies, RBAC permission guards across 7 operational roles, and server-side M-Pesa callback verification
- • Indexed PostgreSQL queries for subscriber lookups, voucher redemption, and RADIUS accounting aggregation
- • Decoupled network control and telemetry polling preventing router I/O from blocking web API requests
- • Real-time NOC monitoring for router CPU/memory load, interface RX/TX throughput, active PPPoE/Hotspot sessions, and immutable audit logs
Verified Outcomes & Technology Stack
- →Live production deployment at g-tech-isp-billing-system.vercel.app with interactive NOC, CRM, Billing, Router Fleet, Voucher, Captive Portal, and Self-Care modules
- →Verified by automated billing, revenue reconciliation, and settings validation test suites (node --test)
- →Mapping service plan bandwidth limits directly to FreeRADIUS Vendor-Specific Attributes (VSAs) eliminates manual per-router queue configuration drift
- →Idempotent mobile money webhook handling is critical to prevent duplicate ledger credits during payment gateway retries