Radius Lucy: setup and advanced provisioning

Integration architecture

Lucy stores authentication and accounting while ISP Billing links account, customer, address, and service and normalizes returned technical details. The integration supports synchronization, creation, editing, association, and live state.

Host and token

Enter only the Lucy base URL, without /api.php, and the API token. ISP Billing appends the path and sends Bearer authentication. Use HTTPS and a dedicated revocable token with only required operations.

Profiles

Synchronization imports Lucy profiles. Select the profile that matches speed, policy, and network design; the commercial service name does not replace the technical profile. Synchronize again after remote changes.

Realms and credential generation

Before creating accounts, configure the domains authorized for the current ISP under Settings → Realms. A realm starts with @, is normalized to lowercase, and cannot be removed while local accounts still use it.

On creation, the wand button previews customercode-[id]@realm. Once the database assigns the account ID, saving produces the final login such as customercode-0001@realm, padded to at least four digits. Lucy usernames are immutable after creation. The dice button requests a secure random password from the backend and is available both when creating and editing.

Create or associate an account

Creation requires customer, installation address, a username with an authorized realm, password, IP, profile, and state. Association links an existing Lucy account without recreating it, so verify username and identity before confirmation.

When a Processing service has no account yet, its detail offers Create new Lucy account and Associate existing account. The creation action is separated from the information card and opens a dedicated embedded panel without the dashboard navigation, with the service customer and address preselected; after saving, the new account is linked automatically. Unlink Radius account also stays outside the card and removes only the service relationship, without deleting or disabling the Lucy account.

Password is required on creation; during editing, an empty field must not be treated as a replacement. Manually synchronize details when live data has not refreshed.

Connection state and equipment

Detail shows online/offline, assigned IPv4, profile, Lucy customer code, last activity, and device MAC. The MAC can link to known Network Management equipment without replacing Radius state. Compare timestamps and sessions before declaring an outage.

CPE SNMP diagnostics

The card stores device type and a per-account SNMP community, defaulting to public. Without an override, Lucy must report link=ONLINE and a current address. For a bridged CPE, enable Query a different IP, enter its static address, and press OK: the stored target remains usable while PPPoE is offline. Disable the flag and confirm to restore the live address.

With an operational Edge Agent or configured MikroTik bridge, page opening always starts one unsaved live check: Generic runs ten pings, while specific device types run ping and SNMP independently. Verify stores one valid sample. Temporary monitoring collects up to 20 samples and needs the LucyRadius job after the page closes.

Line data and advanced security

Advanced fields include Lucy customer code, location and circuit IDs, S-VLAN, C-VLAN, and enhanced security. Populate them from the network design. Enhanced security is creation-only and must be decided before provisioning.

IPv4 routing and IPv6

Accounts can store multiple IPv4 routes, assigned and delegated IPv6 prefixes, management IP, and loopback. Use valid CIDR notation, avoid overlap, and document edge routing. Modified routes are tracked so only intentional changes are sent.

CPE and custom attributes

Outdoor/indoor CPE MAC, serial, and equipment data support reconciliation with UISP, Warehouse, or Network Management. Custom attributes require name, operator, and value and should be used only with known Lucy/vendor semantics.

Dashboard and accounting

The dashboard summarizes linked Lucy accounts and the accounting information available to the tenant. Use status and recency together: online/offline indicators, last activity, sessions, and traffic can have different update times.

Investigate missing or stale accounting by checking the Lucy account, remote synchronization, NAS reporting, and the selected period. Limit exports and detailed usage information to authorized operational roles.

Service and Customer Area

The customer service connects Lucy’s technical account with activation, billing, suspension, reactivation, and termination. Keep local and remote state aligned and verify both sides after each lifecycle change; disconnecting a session is not the same as suspending an account.

Customer Area uses a lightweight widget and must expose only the authenticated subscriber’s intended status and connection information. Never return the API token, password, internal routes, management addresses, advanced security data, or reserved custom attributes.

Scheduled synchronization and unbilled services

Automatic profile synchronization runs only for enabled tenants and keeps the local catalog aligned with Lucy; monitor logs and dependent accounts after remote changes. Remote-account synchronization and manual detail refresh reconcile existing records and must not create duplicates.

The unbilled-services view identifies technical access without a correct commercial link. Credential email uses the linked customer and configured template, so verify the recipient before transmitting access data.

Checklist

• Enter the base URL without /api.php
• Protect the Bearer token
• Synchronize profiles
• Link the correct customer and address
• Distinguish creation from association
• Check live-state timestamps
• Define VLANs and security before provisioning
• Validate routes and IPv6 prefixes
• Store real MAC addresses and serials
• Use only understood attributes