diff --git a/feeds/ucentral/ucentral-defaults/Makefile b/feeds/tip/certificates/Makefile
similarity index 57%
rename from feeds/ucentral/ucentral-defaults/Makefile
rename to feeds/tip/certificates/Makefile
index c3cec9dde..7da55720b 100644
--- a/feeds/ucentral/ucentral-defaults/Makefile
+++ b/feeds/tip/certificates/Makefile
@@ -1,6 +1,6 @@
 include $(TOPDIR)/rules.mk
 
-PKG_NAME:=ucentral-defaults
+PKG_NAME:=certificates
 PKG_RELEASE:=1
 
 PKG_LICENSE:=BSD-3-Clause
@@ -8,14 +8,10 @@ PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
 include $(INCLUDE_DIR)/package.mk
 
-define Package/ucentral-defaults
+define Package/certificates
   SECTION:=ucentral
   CATEGORY:=uCentral
-  TITLE:=ucentral-defaults
-endef
-
-define Package/ucentral-defaults/description
- The default configuration of the AP.
+  TITLE:=TIP DigiCer certificate store
 endef
 
 define Build/Prepare
@@ -27,8 +23,8 @@ define Build/Compile/Default
 endef
 Build/Compile = $(Build/Compile/Default)
 
-define Package/ucentral-defaults/install
+define Package/certificates/install
 	$(CP) ./files/* $(1)
 endef
 
-$(eval $(call BuildPackage,ucentral-defaults))
+$(eval $(call BuildPackage,certificates))
diff --git a/feeds/tip/certificates/files/etc/init.d/certificates b/feeds/tip/certificates/files/etc/init.d/certificates
new file mode 100755
index 000000000..3d2f96a9a
--- /dev/null
+++ b/feeds/tip/certificates/files/etc/init.d/certificates
@@ -0,0 +1,16 @@
+#!/bin/sh /etc/rc.common
+
+START=80
+
+boot() {
+	[ -f /etc/ucentral/dev-id ] && return
+	. /lib/functions.sh
+	mkdir -p /certificates /etc/ucentral/
+	local mtd=$(find_mtd_index certificates)
+	[ -n "$mtd" -a -f /sys/class/mtd/mtd15/oobsize ] && ubiattach -p /dev/mtd$mtd
+	[ -n "$(ubinfo -a | grep certificates)" ] && {
+		mount -t ubifs ubi0:certificates /certificates
+		mount -t ubifs ubi1:certificates /certificates
+	}
+	[ -f /certificates/dev-id ] && cp /certificates/* /etc/ucentral/
+}
diff --git a/feeds/tip/firstcontact/Makefile b/feeds/tip/firstcontact/Makefile
index 8aec489e9..3717c3f9e 100644
--- a/feeds/tip/firstcontact/Makefile
+++ b/feeds/tip/firstcontact/Makefile
@@ -13,7 +13,7 @@ define Package/firstcontact
   SECTION:=ucentral
   CATEGORY:=uCentral
   TITLE:=TIP DigiCert firstcontact
-  DEPENDS:=+libubox +libcurl +libopenssl
+  DEPENDS:=+libubox +libcurl +libopenssl +certificates
 endef
 
 define Package/firstcontact/install
diff --git a/feeds/tip/firstcontact/files/etc/init.d/firstcontact b/feeds/tip/firstcontact/files/etc/init.d/firstcontact
index ac08f666d..46fc6f22e 100755
--- a/feeds/tip/firstcontact/files/etc/init.d/firstcontact
+++ b/feeds/tip/firstcontact/files/etc/init.d/firstcontact
@@ -7,6 +7,7 @@ PROG=/usr/bin/ucode
 
 start_service() {
 	[ -f /etc/ucentral/capabilities.json ] || {
+		mkdir -p /etc/ucentral/
 		ucode -m ubus -E board=/etc/board.json /usr/share/ucentral/capabilities.uc > /etc/ucentral/capabilities.json 
 	}
 
@@ -15,10 +16,3 @@ start_service() {
 	procd_set_param respawn 1 10 0
 	procd_close_instance
 }
-
-boot() {
-	mkdir /digicert
-	mount -t ubifs ubi:tip_data /digicert
-	[ $? -eq 0 ] && cp /digicert/* /etc/ucentral/
-	start
-}
diff --git a/feeds/tip/maverick/src/maverick.c b/feeds/tip/maverick/src/maverick.c
index 3805b8cf6..cbc88156c 100644
--- a/feeds/tip/maverick/src/maverick.c
+++ b/feeds/tip/maverick/src/maverick.c
@@ -13,7 +13,7 @@ maverick_cb(struct uloop_timeout *delay)
 {
 	char link[PATH_MAX] = { };
 
-	if (!readlink("/etc/ucentral/ucentral.active", link, PATH_MAX) &&
+	if (readlink("/etc/ucentral/ucentral.active", link, PATH_MAX) != -1 &&
 	    strcmp(link, "/etc/ucentral/ucentral.cfg.0000000001")) {
 		ULOG_INFO("found an active symlink\n");
 		uloop_end();
diff --git a/feeds/ucentral/rtty/files/rtty.init b/feeds/ucentral/rtty/files/rtty.init
index b73c1b5d6..7569c954c 100644
--- a/feeds/ucentral/rtty/files/rtty.init
+++ b/feeds/ucentral/rtty/files/rtty.init
@@ -16,7 +16,7 @@ validate_rtty_section() {
 		'token:maxlength(32)' \
 		'verbose:bool:0' \
 		'enable:bool:0' \
-		'interval:uinteger:0'
+		'timeout:uinteger:0'
 }
 
 start_rtty() {
@@ -54,8 +54,8 @@ start_rtty() {
 	[ "$ssl" = "1" ] && procd_append_param command -s
 	[ -n "$token" ] && procd_append_param command -t "$token"
 	[ "$verbose" = "1" ] && procd_append_param command -v
-	[ "$interval" -eq "0" ] || procd_append_param command -e $interval
-	[ "$interval" -eq "0" ] && procd_set_param respawn
+	[ "$timeout" -eq "0" ] || procd_append_param command -e $timeout
+	[ "$timeout" -eq "0" ] && procd_set_param respawn
 	procd_close_instance
 }
 
diff --git a/feeds/ucentral/rtty/patches/100-max_timeout.patch b/feeds/ucentral/rtty/patches/100-max_timeout.patch
index ee686c0eb..dab345349 100644
--- a/feeds/ucentral/rtty/patches/100-max_timeout.patch
+++ b/feeds/ucentral/rtty/patches/100-max_timeout.patch
@@ -2,30 +2,32 @@ Index: rtty-7.1.4/src/main.c
 ===================================================================
 --- rtty-7.1.4.orig/src/main.c
 +++ rtty-7.1.4/src/main.c
-@@ -37,6 +37,8 @@ enum {
+@@ -37,6 +37,9 @@ enum {
      LONG_OPT_HELP = 1
  };
  
-+static int force_exit;
++int force_exit = 0;
++int connected = 0;
 +
  static void signal_cb(struct ev_loop *loop, ev_signal *w, int revents)
  {
      if (w->signum == SIGINT) {
-@@ -53,6 +55,7 @@ static struct option long_options[] = {
+@@ -53,6 +56,7 @@ static struct option long_options[] = {
      {"token",       required_argument, NULL, 't'},
      {"verbose",     no_argument,       NULL, 'v'},
      {"version",     no_argument,       NULL, 'V'},
-+    {"exit",        required_argument, NULL, 'V'},
++    {"exit",        required_argument, NULL, 'e'},
      {"help",        no_argument,       NULL, LONG_OPT_HELP},
      {0, 0, 0, 0}
  };
-@@ -79,10 +82,16 @@ static void usage(const char *prog)
+@@ -79,10 +83,17 @@ static void usage(const char *prog)
      exit(1);
  }
  
 +static void timeout_cb(EV_P_ ev_timer *w, int revents)
 +{
-+    exit(1);
++    if (!connected)
++	    exit(1);
 +}
 +
  int main(int argc, char **argv)
@@ -36,7 +38,7 @@ Index: rtty-7.1.4/src/main.c
      bool background = false;
      bool verbose = false;
      struct rtty rtty = {
-@@ -95,7 +104,7 @@ int main(int argc, char **argv)
+@@ -95,7 +106,7 @@ int main(int argc, char **argv)
      int c;
  
      while (true) {
@@ -45,7 +47,7 @@ Index: rtty-7.1.4/src/main.c
          if (c == -1)
              break;
  
-@@ -146,6 +155,9 @@ int main(int argc, char **argv)
+@@ -146,6 +157,9 @@ int main(int argc, char **argv)
          case LONG_OPT_HELP:
              usage(argv[0]);
              break;
@@ -55,7 +57,7 @@ Index: rtty-7.1.4/src/main.c
          default: /* '?' */
              usage(argv[0]);
              break;
-@@ -167,6 +179,10 @@ int main(int argc, char **argv)
+@@ -167,6 +181,10 @@ int main(int argc, char **argv)
  
      ev_signal_init(&signal_watcher, signal_cb, SIGINT);
      ev_signal_start(loop, &signal_watcher);
@@ -66,3 +68,51 @@ Index: rtty-7.1.4/src/main.c
  
      if (rtty_start(&rtty) < 0)
          return -1;
+Index: rtty-7.1.4/src/rtty.c
+===================================================================
+--- rtty-7.1.4.orig/src/rtty.c
++++ rtty-7.1.4/src/rtty.c
+@@ -36,6 +36,9 @@
+ #include "utils.h"
+ #include "command.h"
+ 
++extern int force_exit;
++extern int connected;
++
+ static char login_path[128];       /* /bin/login */
+ 
+ static void del_tty(struct tty *tty)
+@@ -57,6 +60,8 @@ static void del_tty(struct tty *tty)
+     log_info("delete tty: %d\n", tty->sid);
+ 
+     free(tty);
++    if (force_exit)
++	    exit(0);
+ }
+ 
+ static inline struct tty *find_tty(struct rtty *rtty, int sid)
+@@ -69,6 +74,7 @@ static inline struct tty *find_tty(struc
+ static inline void tty_logout(struct rtty *rtty, int sid)
+ {
+     struct tty *tty = find_tty(rtty, sid);
++
+     if (tty)
+         del_tty(tty);
+ }
+@@ -136,6 +142,8 @@ static void pty_on_exit(struct ev_loop *
+     ev_io_start(loop, &rtty->iow);
+ 
+     del_tty(tty);
++    if (force_exit)
++	    exit(0);
+ }
+ 
+ static void tty_login(struct rtty *rtty)
+@@ -188,6 +196,7 @@ static void tty_login(struct rtty *rtty)
+     buffer_put_u8(&rtty->wb, sid);
+     ev_io_start(rtty->loop, &rtty->iow);
+ 
++    connected = 1;
+     log_info("new tty: %d\n", sid);
+ }
+ 
diff --git a/feeds/ucentral/ucentral-client/Makefile b/feeds/ucentral/ucentral-client/Makefile
index 6ea64fcc9..1649b3a49 100644
--- a/feeds/ucentral/ucentral-client/Makefile
+++ b/feeds/ucentral/ucentral-client/Makefile
@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-client.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=d58e7ed0424e98a9dcc4e07d3b8ace83aae8fb5f
+PKG_SOURCE_VERSION:=746239b4ccaed373f946f472b47184cd937d6551
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
@@ -18,8 +18,7 @@ define Package/ucentral-client
   SECTION:=ucentral
   CATEGORY:=uCentral
   TITLE:=OpenWrt uCentral websocket client
-  DEPENDS:=+ucentral-schema \
-  	   +ucode +ucode-mod-fs +ucode-mod-ubus +ucode-mod-uci +ucode-mod-math \
+  DEPENDS:=+ucode +ucode-mod-fs +ucode-mod-ubus +ucode-mod-uci +ucode-mod-math \
 	   +libubox +libwebsockets-openssl +libblobmsg-json +libubus
 endef
 
diff --git a/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral b/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
index 4d2e671c5..d4f7e87bd 100755
--- a/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
+++ b/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
@@ -18,6 +18,8 @@ start_service() {
 	
 	[ -f /tmp/ucentral.version ] || cat /etc/openwrt_release | grep DISTRIB_REVISION= | cut -d\' -f2 > /tmp/ucentral.version
 	
+	ucode -m fs -i /usr/share/ucentral/crashlog.uc
+	
 	. /lib/functions.sh
 	cp /etc/config-shadow/ucentral /etc/config/
 	config_load 'ucentral'
@@ -37,12 +39,8 @@ start_service() {
 	[ "$debug" -eq 0 ] || procd_append_param command -d
 	[ "$insecure" -eq 0 ] || procd_append_param command -i
 	[ -z "$interval" ] || procd_append_param command -H $interval
+	[ -z "$(mount | grep 'tmpfs on / type tmpfs')" ] || procd_append_param command -r
 	procd_append_param command -f "$(cat /tmp/ucentral.version)"
 	procd_set_param respawn 3600 5 0
 	procd_close_instance
 }
-
-boot() {
-	ucode -m fs -i /usr/share/ucentral/crashlog.uc
-	start
-}
diff --git a/feeds/ucentral/ucentral-schema/Makefile b/feeds/ucentral/ucentral-schema/Makefile
index 88d6bf2c5..628895d24 100644
--- a/feeds/ucentral/ucentral-schema/Makefile
+++ b/feeds/ucentral/ucentral-schema/Makefile
@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-schema.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=dc2a7d17842c44a0d3150bf3f6ab47c80baa3ce1
+PKG_SOURCE_VERSION:=50693a71ead9a5a2907b25a3ef13b5d235b32dbc
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=BSD-3-Clause
@@ -19,6 +19,12 @@ define Package/ucentral-schema
   TITLE:=OpenWrt uCentral schema
 endef
 
+define Package/ucentral-recovery
+  SECTION:=ucentral
+  CATEGORY:=uCentral
+  TITLE:=OpenWrt uCentral recovery tooling
+endef
+
 define Build/Compile
 
 endef
@@ -29,6 +35,15 @@ define Package/ucentral-schema/install
 	$(CP) $(PKG_BUILD_DIR)/renderer/* $(1)/usr/share/ucentral
 	$(CP) $(PKG_BUILD_DIR)/command/*.uc $(1)/usr/share/ucentral
 	$(CP) $(PKG_BUILD_DIR)/system/*.uc $(1)/usr/share/ucentral
+	$(CP) ./files/* $(1)
 endef
 
+define Package/ucentral-recovery/install
+	$(INSTALL_DIR) $(1)/usr/share/ucentral $(1)/etc/uci-defaults/
+	$(CP) $(PKG_BUILD_DIR)/command/*.uc $(1)/usr/share/ucentral
+	$(CP) $(PKG_BUILD_DIR)/system/{capabilities,crashlog}.uc $(1)/usr/share/ucentral
+	$(CP) ./files/etc/uci-defaults/99-ucentral-hostname $(1)/etc/uci-defaults/
+endef
+
+$(eval $(call BuildPackage,ucentral-recovery))
 $(eval $(call BuildPackage,ucentral-schema))
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/sysctl.d/20-oom-reboot.conf b/feeds/ucentral/ucentral-schema/files/etc/sysctl.d/20-oom-reboot.conf
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/sysctl.d/20-oom-reboot.conf
rename to feeds/ucentral/ucentral-schema/files/etc/sysctl.d/20-oom-reboot.conf
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/big.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/big.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/big.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/big.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/captive.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/captive.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/captive.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/captive.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/default.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/default.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/default.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/default.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/dhcpsnoop.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/dhcpsnoop.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/dhcpsnoop.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/dhcpsnoop.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/gre.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/gre.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/gre.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/gre.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/ieee8021x.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/ieee8021x.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/ieee8021x.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/ieee8021x.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/igmp.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/igmp.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/igmp.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/igmp.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/lldp.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/lldp.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/lldp.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/lldp.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/maverick.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/maverick.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/maverick.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/maverick.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/mesh.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/mesh.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/mesh.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/mesh.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/metrics.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/metrics.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/metrics.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/metrics.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/multi-psk.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/multi-psk.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/multi-psk.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/multi-psk.json
diff --git a/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/radius-proxy.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/radius-proxy.json
new file mode 100644
index 000000000..44ae719eb
--- /dev/null
+++ b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/radius-proxy.json
@@ -0,0 +1,108 @@
+{
+	"uuid": 1,
+	"radios": [
+		{
+			"band": "5G",
+			"country": "CA",
+			"channel-mode": "HE",
+			"channel-width": 80,
+			"channel": 32
+		}
+	],
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			},
+			"ssids": [
+				{
+					"name": "OpenWifi",
+					"wifi-bands": [
+						"5G"
+					],
+					"bss-mode": "ap",
+					"encryption": {
+						"proto": "wpa2",
+						"ieee80211w": "optional"
+					},
+					"radius": {
+						"authentication": {
+							"host": "localhost",
+							"port": 1812,
+							"secret": "secret"
+						},
+						"accounting": {
+							"host": "localhost",
+							"port": 1813,
+							"secret": "secret"
+						}
+					}
+				}
+			]
+		},
+		{
+			"name": "LAN",
+			"role": "downstream",
+			"services": [ "ssh" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"LAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "static",
+				"subnet": "192.168.1.1/24",
+				"dhcp": {
+					"lease-first": 10,
+					"lease-count": 100,
+					"lease-time": "6h"
+				}
+			},
+			"ssids": [
+				{
+					"name": "OpenWifi",
+					"wifi-bands": [
+						"5G"
+					],
+					"bss-mode": "ap",
+					"encryption": {
+						"proto": "psk2",
+						"key": "OpenWifi",
+						"ieee80211w": "optional"
+					}
+				}
+			]
+
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"ssh": {
+			"port": 22
+		},
+		"radius-proxy": {
+			"host": "192.168.1.10",
+			"secret": "secret"
+		}
+	}
+}
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/rate-limit.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/rate-limit.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/rate-limit.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/rate-limit.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/ssh.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/ssh.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/ssh.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/ssh.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/steering.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/steering.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/steering.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/steering.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/vlan.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/vlan.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/vlan.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/vlan.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/vxlan.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/vxlan.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/vxlan.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/vxlan.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/wds-ap.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/wds-ap.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/wds-ap.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/wds-ap.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/wds-repeater.json b/feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/wds-repeater.json
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/examples/wds-repeater.json
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/wds-repeater.json
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/ucentral/ucentral.cfg.0000000001 b/feeds/ucentral/ucentral-schema/files/etc/ucentral/ucentral.cfg.0000000001
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/ucentral/ucentral.cfg.0000000001
rename to feeds/ucentral/ucentral-schema/files/etc/ucentral/ucentral.cfg.0000000001
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-hostname b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-hostname
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-hostname
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-hostname
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-lldp b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-lldp
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-lldp
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-lldp
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-network b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-network
similarity index 87%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-network
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-network
index 9509e061e..08b140ec7 100755
--- a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-network
+++ b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-network
@@ -21,3 +21,6 @@ config_foreach section_del forwarding firewall
 
 config_load igmpproxy
 config_foreach section_del phyint igmpproxy
+
+config_load radsecproxy
+config_foreach section_del options radsecproxy
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-opennds b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-opennds
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-opennds
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-opennds
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-rtty b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-rtty
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-rtty
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-rtty
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-uhttpd b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-uhttpd
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-uhttpd
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-uhttpd
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-umdns b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-umdns
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-umdns
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-umdns
diff --git a/feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-wifi b/feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-wifi
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/etc/uci-defaults/99-ucentral-wifi
rename to feeds/ucentral/ucentral-schema/files/etc/uci-defaults/99-ucentral-wifi
diff --git a/feeds/ucentral/ucentral-defaults/files/usr/libexec/ucentral/ucentral_apply.sh b/feeds/ucentral/ucentral-schema/files/usr/libexec/ucentral/ucentral_apply.sh
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/usr/libexec/ucentral/ucentral_apply.sh
rename to feeds/ucentral/ucentral-schema/files/usr/libexec/ucentral/ucentral_apply.sh
diff --git a/feeds/ucentral/ucentral-defaults/files/usr/libexec/ucentral/ucentral_led_blink.sh b/feeds/ucentral/ucentral-schema/files/usr/libexec/ucentral/ucentral_led_blink.sh
similarity index 100%
rename from feeds/ucentral/ucentral-defaults/files/usr/libexec/ucentral/ucentral_led_blink.sh
rename to feeds/ucentral/ucentral-schema/files/usr/libexec/ucentral/ucentral_led_blink.sh
diff --git a/feeds/ucentral/ucentral-wifi/Makefile b/feeds/ucentral/ucentral-wifi/Makefile
index 5b45cbc71..506429855 100644
--- a/feeds/ucentral/ucentral-wifi/Makefile
+++ b/feeds/ucentral/ucentral-wifi/Makefile
@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-wifi.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-04-13
-PKG_SOURCE_VERSION:=a710d2f318caa8a41ad9833078c492539eb29106
+PKG_SOURCE_VERSION:=6b9129154507559edcb298680a84c9c0c6fa1449
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=BSD-3-Clause
diff --git a/patches/0003-pending-scripts-add-gen_config.py.patch b/patches/0003-pending-scripts-add-gen_config.py.patch
index 31f110aa3..c074ed801 100644
--- a/patches/0003-pending-scripts-add-gen_config.py.patch
+++ b/patches/0003-pending-scripts-add-gen_config.py.patch
@@ -1,22 +1,22 @@
-From 79dadbe5f9d74b3bca49e50a51f1a62be71b17a5 Mon Sep 17 00:00:00 2001
+From 585f94ec3a6ec51348b72c99740c41c635e30876 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Fri, 19 Jun 2020 10:45:22 +0200
-Subject: [PATCH 01/31] pending: scripts: add gen_config.py
+Subject: [PATCH 01/35] pending: scripts: add gen_config.py
 
 This script is used to setup the tree based on the profiles/.
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- scripts/gen_config.py | 193 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 193 insertions(+)
+ scripts/gen_config.py | 196 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 196 insertions(+)
  create mode 100755 scripts/gen_config.py
 
 diff --git a/scripts/gen_config.py b/scripts/gen_config.py
 new file mode 100755
-index 0000000000..124dfd596a
+index 0000000000..260abeef8f
 --- /dev/null
 +++ b/scripts/gen_config.py
-@@ -0,0 +1,193 @@
+@@ -0,0 +1,196 @@
 +#!/usr/bin/env python3
 +
 +from os import getenv
@@ -97,11 +97,11 @@ index 0000000000..124dfd596a
 +        Path("./.config").unlink()
 +
 +
-+def merge_profiles(profiles):
++def merge_profiles(profiles, include=True):
 +    profile = {"packages": [], "description": [], "diffconfig": "", "feeds": {}}
 +
 +    for p in profiles:
-+        profile = load_yaml(p, profile)
++        profile = load_yaml(p, profile, include)
 +
 +    return profile
 +
@@ -196,7 +196,10 @@ index 0000000000..124dfd596a
 +        print("Tree is now clean")
 +        quit(0)
 +
-+    profile = merge_profiles(sys.argv[1:])
++    if "recovery" in sys.argv:
++        profile = merge_profiles([ "ucentral-recovery", sys.argv[1] ], False)
++    else:
++        profile = merge_profiles(sys.argv[1:])
 +
 +    print("Using the following profiles:")
 +    for d in profile.get("description"):
diff --git a/patches/0036-certificates-add-ability-to-persistently-store-certi.patch b/patches/0036-certificates-add-ability-to-persistently-store-certi.patch
new file mode 100644
index 000000000..3b4484c67
--- /dev/null
+++ b/patches/0036-certificates-add-ability-to-persistently-store-certi.patch
@@ -0,0 +1,56 @@
+From 33334a615a88591e3b1f8954ba5a1122c5a9111d Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Sun, 23 May 2021 09:59:53 +0200
+Subject: [PATCH] certificates: add ability to persistently store certificates
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/base-files/files/lib/upgrade/nand.sh             | 9 +++++++++
+ .../files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi     | 3 +--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
+index ab3db4cdf2..36977244bc 100644
+--- a/package/base-files/files/lib/upgrade/nand.sh
++++ b/package/base-files/files/lib/upgrade/nand.sh
+@@ -157,6 +157,8 @@ nand_upgrade_prepare_ubi() {
+ 	local kern_ubivol="$( nand_find_volume $ubidev $CI_KERNPART )"
+ 	local root_ubivol="$( nand_find_volume $ubidev $CI_ROOTPART )"
+ 	local data_ubivol="$( nand_find_volume $ubidev rootfs_data )"
++	local cert_ubivol="$( nand_find_volume $ubidev certificates )"
++	local cert_mtd="$(find_mtd_index certificates)"
+ 
+ 	local ubiblk ubiblkvol
+ 	for ubiblk in /dev/ubiblock*_? ; do
+@@ -196,6 +198,13 @@ nand_upgrade_prepare_ubi() {
+ 		fi
+ 	fi
+ 
++	if [ -z "$cert_ubivol" -a ! "$cert_mtd" ]; then
++		if ! ubimkvol /dev/$ubidev -N certificates -s 2MiB; then
++			echo "cannot create certificates volume"
++			return 1;
++		fi
++	fi
++
+ 	# create rootfs_data for non-ubifs rootfs
+ 	if [ "$rootfs_type" != "ubifs" ]; then
+ 		local availeb=$(cat /sys/devices/virtual/ubi/$ubidev/avail_eraseblocks)
+diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
+index 8f971e505c..0f1f083a5b 100644
+--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
++++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-xx8300.dtsi
+@@ -229,9 +229,8 @@
+ 			};
+ 
+ 			partition@b880000 {
+-				label = "syscfg";
++				label = "certificates";
+ 				reg = <0xb880000 0x4680000>;
+-				read-only;
+ 			};
+ 		};
+ 	};
+-- 
+2.25.1
+
diff --git a/profiles/linksys_e8450-ubi.yml b/profiles/linksys_e8450-ubi.yml
index 47df24c1e..ba247a354 100644
--- a/profiles/linksys_e8450-ubi.yml
+++ b/profiles/linksys_e8450-ubi.yml
@@ -8,3 +8,4 @@ include:
   - ucentral-ap
 diffconfig: |
   CONFIG_TESTING_KERNEL=y
+  CONFIG_TARGET_ROOTFS_INITRAMFS=y
diff --git a/profiles/ucentral-ap-light.yml b/profiles/ucentral-ap-light.yml
index 053cb3606..bbc379de2 100644
--- a/profiles/ucentral-ap-light.yml
+++ b/profiles/ucentral-ap-light.yml
@@ -22,7 +22,6 @@ packages:
   - ucentral-event
   - ucentral-schema
   - ucentral-wifi
-  - ucentral-defaults
   - ucentral-tools
   - ucode
   - udhcpsnoop
diff --git a/profiles/ucentral-ap.yml b/profiles/ucentral-ap.yml
index 943b11f60..50b8a7de8 100644
--- a/profiles/ucentral-ap.yml
+++ b/profiles/ucentral-ap.yml
@@ -33,7 +33,6 @@ packages:
   - ucentral-event
   - ucentral-schema
   - ucentral-wifi
-  - ucentral-defaults
   - ucentral-tools
   - ucode
   - udhcpsnoop
diff --git a/profiles/ucentral-recovery.yml b/profiles/ucentral-recovery.yml
new file mode 100644
index 000000000..81f30d942
--- /dev/null
+++ b/profiles/ucentral-recovery.yml
@@ -0,0 +1,19 @@
+---
+description: Add the ucentral recovery dependencies
+feeds:
+  - name: ucentral
+    path: ../../feeds/ucentral
+  - name: tip
+    path: ../../feeds/tip
+
+packages:
+  - firstcontact
+  - tip-defaults
+  - ucentral-client
+  - ucentral-recovery
+  - ucode
+diffconfig: |
+  CONFIG_IMAGEOPT=y
+  CONFIG_PREINITOPT=y
+  CONFIG_TARGET_PREINIT_SUPPRESS_STDERR=y
+  CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE=y
diff --git a/profiles/ucentral-switch.yml b/profiles/ucentral-switch.yml
index b628f0cf0..213fe6dfe 100644
--- a/profiles/ucentral-switch.yml
+++ b/profiles/ucentral-switch.yml
@@ -15,7 +15,6 @@ packages:
   - maverick
   - ucentral-client
   - ucentral-schema
-  - ucentral-defaults
   - ucode
   - rtty-openssl
   - tcpdump