Document the home network's out-of-band devices that aren't managed by
this flake:
- `home-aps.md` — the two dumb APs (`vibe` MikroTik cAP ax, `wave` Cudy
AX3000 on OpenWrt): shared VLAN-trunk design (`hi`/`lo` are both
trusted client VLANs differing only by MTU), SSIDs, per-AP management
addressing, roaming (802.11k/v), and the OpenWrt flash + on-device
config for `wave` (incl. the `mtk_eth_soc` eth0 2026-byte MTU cap that
keeps it off the jumbo `hi` VLAN, wpad-mbedtls swap, HE160).
- `home-switches.md` — the hand-configured switches (`jim`/`dave`
MikroTik, `brian` UniFi) topology, VLAN map, and ONT/WAN path.
Add the `home-aps.md` pointer to AGENTS.md alongside the existing
switches reference.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New Cudy AX3000 AP `wave` takes host `.14` on core (backup) and lo
(primary); replaces the decommissioned AP of the same name. It's managed
on `lo`, not `hi`, because its 2.5GbE (`mtk_eth_soc` eth0) caps at MTU
2026 and so can't join `hi`'s jumbo (9000) fabric — and `hi`/`lo` are
both trusted client VLANs differing only by MTU.
Renumber the MikroTik AP `vibe` from `.13` to `.15` and give it the same
core/hi/lo records as `jim`/`dave` (was `hi`-only), matching its
on-device reconfiguration. `vibe` stays on `hi` since it can do jumbo.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Note `CLAUDE.md` is a symlink to `AGENTS.md` (edit the real file).
- Policy: prefer recording durable guidance here over agent memory.
- Add the "Home switches" section (`jim`/`dave`/`brian`, access,
confirm-before-apply) pointing at `home-switches.md`.
- Document `deploy --boot` for staging a config without live-switching.
- Note the `ssh-agent` hang workaround for outbound SSH (`ssh-machine`/`deploy`).
- Add a comment convention: comment where useful, not for trivial code, and
describe general purpose rather than the one-off reason for a change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With a single ONT the ISP's VLAN 10 is unique on the fabric, so there's no
need to swap it to a private fabric VLAN. Carry pon-isp (10) trunked straight
through the switches to river and run PPPoE directly on it, dropping the old
wan-pon-isp (141) translation. The ONT's untagged management is PVID'd onto
wan-pon-ont (140) at its edge switch (brian).
wan-pon-isp (141) is kept as a constant, reserved for the future multi-ONT
case where per-port VLAN translation disambiguates two VLAN-10 ONTs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The modem management subnet is stream-specific (it shares stream's `wan`
interface), so it no longer belongs in the shared routing-common. Drop the
`modem` network assignment and configure the address directly on stream's
`wan` (modemV4). The firewall reject and DNS wan-A-record skipBroadcasts that
existed only because of the modem move to per-box options
`my.homeRouter.{firewall.untrustedRejectV4,dns.wanSkipBroadcasts}`, set solely
by stream. river needs neither: its ONT sits on a separate interface already
blocked by the interface-based forward rules.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Digiweb's ONT delivers its untagged management traffic (192.168.100.0/24)
alongside the tagged ISP VLAN 10. The switch feeding river now tags the ONT's
untagged port as wan-pon-ont (140) and swaps the ISP VLAN 10 to wan-pon-isp
(141) on ingress, so both reach river single-tagged: river takes an address in
the ONT's /24 on 140 to reach its web UI, and PPPoE runs directly on 141.
Replaces the old QinQ-into-131 (wanStacked) transport; the wan-pon (131) VLAN
constant is dropped and prefixes.ont added.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The routers' IPv6 default route runs over the as211024 mesh as a
proto-static route that blackholes rather than withdrawing when the mesh
flaps (e.g. during ipsec churn on a deploy). With "::" in the recursor's
outgoing.source_address, pdns-recursor kept selecting IPv6 to reach
authoritative servers, stalled on timeouts, and took recursion down with
it whenever the mesh bounced. Drop "::" so upstream recursion goes out
the WAN over IPv4 and stays up; AAAA records are still served fine.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Digiweb assigned river a static IPv4 (84.203.124.128). Point river's
public address at it and have pppd actively request it as the IPCP local
address (local:remote form) rather than passively accepting whatever the
peer offers via noipdefault. The address stays sourced from the
routersPubV4 constant, so the ipsec l2 mesh peer, the nft DNS redirect,
and the cross-router route all follow.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fmt reindents non-canonically-formatted files wholesale, burying logical
changes in whitespace churn. Note to match surrounding style by hand.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Digiweb's BRAS answers PADI only on a single-tagged ISP VLAN (pon-isp,
10); the double-stacked wan-pon (131) transport never got a PADO because
the UniFi access switch can't push the outer tag onto already-tagged
ingress frames (no QinQ/tag-stacking). Attach VLAN 10 directly to the
physical `lan` link for now.
Kept reversible via a `wanStacked` flag: flip it back to true to restore
the 131->10 stack once a QinQ-capable device sits in front of the ONT.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The outer WAN VLAN carries the inner VLAN's frames, whose 4B 802.1Q tag
counts as payload at this layer. To fit the inner's 1508B baby-jumbo
payload plus that tag it needs 1512, not 1508. Harmless before only
because the physical `lan` (9000) absorbed the extra bytes; this makes
the outer's MTU literally reflect what it transports.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture what this session surfaced: the routing-common indexed-module
active/backup pattern, VRRP VIPs for gateway+DNS, the wan-online.target
convention, the networkd helper locations, and the "boxes not fleet"
terminology. Also note the fish login shell caveat for ssh scripting.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Clients were handed both routers' real addresses as resolvers, so a downed
router meant per-query resolver timeouts. Serve pdns-recursor on the VRRP
VIPs (with non-local bind so the backup can pre-bind them) and advertise the
VIP via kea and radvd, so DNS follows the master. untrusted advertises
Cloudflare over v6 to match its v4 config.
ipsec started before the WAN's public IP was up: stream's wan carries a
static modem address that satisfies wait-online before the DHCP lease, so
libreswan loaded its mesh conns (left=<public IP>) unoriented and never
initiated. Gate stream's wan-online.target on the DHCP default route
instead, and mkForce ipsec onto wan-online.target only (dropping the
strongswan/libreswan multi-user.target pull-in) so the gate actually holds
on both boxes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
river's WAN moves to a PPPoE session (Digiweb, over VLAN 10 with baby-jumbo
1508 MTU) driven by pppd, with its ip-up/ip-down hooks toggling a new
wan-online.target. stream keeps its DHCP WAN, so the existing 50-wan /
50-wan-ifb networkd config moves out of routing-common into stream, and the
shared consumers (ipsec, ipv6-clear-default-route) now attach to
wan-online.target instead of depending on systemd-networkd-wait-online@wan
directly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bump runner labels to node 24 / Trixie and Ubuntu 26.04. The upstream
module now generates the runner config from the `settings` option and
wires `ExecStart` itself, so drop the hand-written config file and
`ExecStart` override.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`check-system` evaluates a NixOS config without building it; `ssh-machine`
SSHs to a system or home by name, resolving the target and ssh options
from its `deploy-rs` node. Document both in `AGENTS.md`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jackos1998