Admin Guide¶

The admin lives at https://admin.jumorouter.com (dev: https://dev.admin.jumorouter.com). Sign in with your staff account.

Staff accounts¶

Staff lists who can sign in. Add a staff member creates the account with a temporary password shown once: give it to them directly. They change it in My account (other sessions are signed out). Disable signs an account out everywhere and blocks sign-in until re-enabled; nobody can disable their own account. Reset password issues a new temporary one.

Prepare a batch of routers¶

Enroll codes → Create a fleet code, labelled with the batch (e.g. batch-2026-11), optionally capped to the number of routers.
Build the images with that code (firmware/scripts/build-images.sh, see the developer guide) and flash the routers (FLASHING.md next to the images).
Power the routers on with internet access: each one appears in Devices by its MAC within a minute. Give it the label printed on its sticker (device page → Label).
Revoke the fleet code once the batch is done. Enrolled routers keep working, and a router reset later can still come back as long as one fleet code is active.

Pair two routers¶

Pairs → Pair two routers: name (usually the customer), home router, travel router. Both routers configure themselves within a minute; the pair shows Connected over IPv6 (or IPv4 port mapping) once the tunnel is up.

Watch for¶

Enrollments "N times, check it": a router that keeps re-enrolling has a reset loop or a cloned MAC.
Configuration "Apply failed" or "Rolled back": the router refused or undid a change because it lost the control plane afterwards. Open the device page and use the debug console.

Debug console¶

Every router page has a Debug console: it runs one shell command as root through the router's realtime link and records who ran what. Useful commands:

Command	Shows
`ea status`	Role, config version, last sync, endpoints, tunnel paths
`ea doctor`	Enroll code, identity, DNS, HTTPS, token checks with hints
`logread -e edge-agent \\| tail -30`	Agent log
`wg show`	WireGuard peers, endpoints, handshakes
`ifstatus wan`	Uplink state

The router must be online (realtime link up) for the console to work.

Technician kit¶

To work on routers at a technician's site, the technician runs the kit (the agent in a container, edge/agent/deploy/kit/README.md):

docker run -d --name jumo-kit --restart unless-stopped \
  -e JUMO_ENROLL_CODE=XXXX-XXXX-XXXX-XXXX \
  -e JUMO_CONTROL_PLANE=https://api.jumorouter.com \
  -v jumo-kit:/etc/jumo jumo/kit

It appears in Devices; label it (e.g. "KIT Paris - Alex"). Its debug console reaches the routers on that network: ssh root@192.168.1.1 ea status, flash.sh 192.168.1.1 /tmp/image.bin. On a Mac it reaches routers over IP only; for recovery modes (TFTP, failsafe) run it on a Linux box with --network host.

API (scripts, CI)¶

Every admin action is a Connect call, authenticated with the admin API key:

curl -X POST https://dev.api.jumorouter.com/jumo.admin.v1.FleetService/ListDevices \
  -H "Authorization: Bearer $ADMIN_API_KEY" -H "Content-Type: application/json" -d '{}'