Name: MikroDash
Availability: InStock
Author: SecOps-7

GitHub

DockerFull install guide

$ docker run -d --name mikrodash --restart unless-stopped -p 3081:3081 -v mikrodash-data:/data mikrodash:local

Updated15 hours ago

LanguageGo

Setup difficultyEasy

Stars: 632
Ports: 3081 (Web UI and WebSocket API), 13231 (UDP (userspace WireGuard) used only when zero-touch provisioning is switched on)

Docker

ghcr.io/secops-7/mikrodash

What is MikroDash?

MikroDash puts your MikroTik RouterOS v7 gear under one live web console, for homelab owners and network teams who would rather watch graphs than sit in Winbox. It talks to each router over the binary API (or API-SSL) and streams CPU load, traffic, wireless clients, DHCP leases, WireGuard peers, firewall state and geo-located connections into the browser through a WebSocket. On top of monitoring there is a drag-and-drop dashboard, more than fifty pages covering wireless, routing, tunnels, DNS, certificates and system settings, per-user roles with a read/write matrix that can scope access down to a single device, and OpenID Connect sign-in through providers such as Entra ID, Okta, Keycloak or Authentik. Alerts fire on up/down events, CPU, ping loss or configuration drift and travel over SMTP or webhooks to Telegram, Discord, Slack, ntfy and similar; scheduled backups keep diffs, a library of 21 configuration templates rolls out to the fleet with a canary router and auto-revert, history feeds CSV/PDF reports, and there is an embedded RouterOS terminal, a security audit with a score, an exportable audit log, and an optional AI assistant that works with any OpenAI-compatible endpoint, local models included. Zero-touch provisioning lets brand-new routers call home over a built-in userspace WireGuard server. Self-hosting takes one container that needs only a /data volume — a multi-arch ghcr.io image, a static Go binary, or even a container running on the router itself — though the app serves plain HTTP, so TLS belongs at a reverse proxy and the docs say never to expose it straight to the internet. It sits at version 0.8.x and is an independent community project, not affiliated with MikroTik SIA.

Should you self-host MikroDash?

MikroDash scores 49/100 on selfhost.directory (how scoring works) and ranks #27 of 48 in Network Monitoring. It has 632 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v0.8.77, came out on 23 October 2026. New versions land roughly every 3 days.

Setup is easy: most people get it running in one sitting. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is mitmproxy (86/100, 46 451 stars). It scores higher overall, so compare the two before you pick. See MikroDash vs mitmproxy side by side.

Features

Alerting
Audit Trail
Built-in AI agentOff by default.
Configuration Templates
Customizable dashboard
Geo connection map
History & reports
Multi-device fleet management
Real-time metrics streaming
Role-based Access Control
Scheduled configuration backups
Security audit
Single Sign-On (OIDC)
Web Terminal
Zero-touch provisioningOff by default; opens UDP 13231 when enabled.

How to configure MikroDash

-alert-dispatchonCommand-line flag: send alert notifications and scheduled report emails.
Command-line flag: send alert notifications and scheduled report emails.
values: on/off
-backup-scheduleronCommand-line flag: take scheduled configuration backups.
Command-line flag: take scheduled configuration backups.
values: on/off
-data/dataCommand-line flag: data directory.
Command-line flag: data directory.
DATA_SECRETKey for credentials at rest; overrides the key generated on first run and saved to /data/.secret.
Key for credentials at rest; overrides the key generated on first run and saved to /data/.secret.
FORCE_HTTPSMarks the session cookie Secure for use behind a TLS-terminating proxy; plain http sign-in stops working while set.
Marks the session cookie Secure for use behind a TLS-terminating proxy; plain http sign-in stops working while set.
values: true
-geo/app/geoCommand-line flag: directory with the bundled geo-IP database and city list.
Command-line flag: directory with the bundled geo-IP database and city list.
-historyonCommand-line flag: record traffic, ping and connectivity history for Reports.
Command-line flag: record traffic, ping and connectivity history for Reports.
values: on/off
-listen:3081Command-line flag (image CMD): address to serve on.
Command-line flag (image CMD): address to serve on.
LOG_HISTORY_SIZEHow many router log lines to keep in memory for the Logs page.
How many router log lines to keep in memory for the Logs page.
MIKRODASH_ORIGINSHostnames the browser uses to reach MikroDash, comma separated (wildcards like *.example.com work). Required behind a reverse proxy.
Hostnames the browser uses to reach MikroDash, comma separated (wildcards like *.example.com work). Required behind a reverse proxy.
MIKRODASH_ROUTER_CONCURRENCYCap on API commands in flight per router.
Cap on API commands in flight per router.
MIKRODASH_TRUSTED_PROXIESIPs or CIDR ranges of your reverse proxies; their X-Forwarded-For is trusted so the login limit and audit trail see real visitors. Empty trusts none.
IPs or CIDR ranges of your reverse proxies; their X-Forwarded-For is trusted so the login limit and audit trail see real visitors. Empty trusts none.
-no-pooloffCommand-line flag: do not hold background connections to routers nobody is watching.
Command-line flag: do not hold background connections to routers nobody is watching.
values: on/off
-originsemptyCommand-line flag: same as MIKRODASH_ORIGINS.
Command-line flag: same as MIKRODASH_ORIGINS.
-retentiononCommand-line flag: run the daily sweep that ages old data out of the database.
Command-line flag: run the daily sweep that ages old data out of the database.
values: on/off
-trusted-proxiesemptyCommand-line flag: same as MIKRODASH_TRUSTED_PROXIES.
Command-line flag: same as MIKRODASH_TRUSTED_PROXIES.
TZTimezone of the container's log lines; schedules follow the display timezone set in Settings.
Timezone of the container's log lines; schedules follow the display timezone set in Settings.