radvd's DNSSL and kea's domain-search hardcoded the same list of
search domains in two places. Hoist it to lib.my.c.home.searchDomains
so there is a single source of truth (and so other consumers, such as
statically-configured boxes, can reuse it). No change to what is
advertised.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New Cudy AX3000 AP `wave` takes host `.14` on core (backup) and lo
(primary); replaces the decommissioned AP of the same name. It's managed
on `lo`, not `hi`, because its 2.5GbE (`mtk_eth_soc` eth0) caps at MTU
2026 and so can't join `hi`'s jumbo (9000) fabric — and `hi`/`lo` are
both trusted client VLANs differing only by MTU.
Renumber the MikroTik AP `vibe` from `.13` to `.15` and give it the same
core/hi/lo records as `jim`/`dave` (was `hi`-only), matching its
on-device reconfiguration. `vibe` stays on `hi` since it can do jumbo.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The modem management subnet is stream-specific (it shares stream's `wan`
interface), so it no longer belongs in the shared routing-common. Drop the
`modem` network assignment and configure the address directly on stream's
`wan` (modemV4). The firewall reject and DNS wan-A-record skipBroadcasts that
existed only because of the modem move to per-box options
`my.homeRouter.{firewall.untrustedRejectV4,dns.wanSkipBroadcasts}`, set solely
by stream. river needs neither: its ONT sits on a separate interface already
blocked by the interface-based forward rules.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The routers' IPv6 default route runs over the as211024 mesh as a
proto-static route that blackholes rather than withdrawing when the mesh
flaps (e.g. during ipsec churn on a deploy). With "::" in the recursor's
outgoing.source_address, pdns-recursor kept selecting IPv6 to reach
authoritative servers, stalled on timeouts, and took recursion down with
it whenever the mesh bounced. Drop "::" so upstream recursion goes out
the WAN over IPv4 and stays up; AAAA records are still served fine.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Clients were handed both routers' real addresses as resolvers, so a downed
router meant per-query resolver timeouts. Serve pdns-recursor on the VRRP
VIPs (with non-local bind so the backup can pre-bind them) and advertise the
VIP via kea and radvd, so DNS follows the master. untrusted advertises
Cloudflare over v6 to match its v4 config.
ipsec started before the WAN's public IP was up: stream's wan carries a
static modem address that satisfies wait-online before the DHCP lease, so
libreswan loaded its mesh conns (left=<public IP>) unoriented and never
initiated. Gate stream's wan-online.target on the DHCP default route
instead, and mkForce ipsec onto wan-online.target only (dropping the
strongswan/libreswan multi-user.target pull-in) so the gate actually holds
on both boxes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
river's WAN moves to a PPPoE session (Digiweb, over VLAN 10 with baby-jumbo
1508 MTU) driven by pppd, with its ip-up/ip-down hooks toggling a new
wan-online.target. stream keeps its DHCP WAN, so the existing 50-wan /
50-wan-ifb networkd config moves out of routing-common into stream, and the
shared consumers (ipsec, ipv6-clear-default-route) now attach to
wan-online.target instead of depending on systemd-networkd-wait-online@wan
directly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jackos1998