Managing config consistency across OpenWrt devices at scale?

Revisiting this topic from a slightly different angle.

A lot of setups seem to rely on SSH/scripts, which works well initially. But once you have more devices or mixed OpenWrt versions, things like:

  • config drift
  • tracking actual runtime state vs intended config
  • safely applying incremental updates

start becoming harder to manage over time.

Curious how people here are handling this in practice today — still mostly scripts, or something more structured?

OpenWISP is made for this.

Makes sense — OpenWISP is definitely one of the more complete options in this space.

Curious how it has worked for you in practice, especially around handling incremental changes and keeping runtime state aligned over time?

From what I’ve seen, getting the initial setup working is one thing, but maintaining consistency as things evolve can be a different challenge.

A big question would be what 'at scale' actually means to you. Managing router + 3-4 APs in a typical home is quite different than interacting with site2site VPNs across multiple branch offices or a university-like campus network.

For home network, the advice would be centralize all policy making to the central router - and dumbing switches/ APs down to the extent possible (making them blindly execute the router's decisions/ passing through VLANs to the desired targets). That way your focus can be on the router, the rest of the network will just follow its lead (or not work, which will be easy to fix).

I strongly advise against overcomplicating the situation for yourself on a home network, if you don't need to.

Good point - scale definitely changes the problem quite a bit.

I was thinking more in terms of multi-site or fleet scenarios (dozens to hundreds of devices), where you have different roles (routers, APs, gateways) and changes need to be applied incrementally rather than rebuilding everything each time.

In smaller/home setups, centralizing on a single router makes a lot of sense as you mentioned.

But once things are more distributed, it feels like keeping state consistent over time becomes the harder part than just pushing config.

Curious how you’d approach that in larger deployments?