# guix-router status (2026-10-16)

Where the project stands, what was done to get here, and what is open.
Details: `plans/guix-openwrt-mt6000-plan.md` (§0b), `docs/PITFALLS.md`
(#49-#57), `docs/INSTALL.md`.  No passwords or WiFi keys in this file: read
them from the routers (commands below).

## Summary

Guix System with the OpenWrt userland (netifd, firewall4, dnsmasq, odhcpd,
hostapd, LuCI, nodogsplash) and TollGate runs on both devices, installs from
a release, updates with `guix copy` deploys, and rolls back.

| | Raspberry Pi 4 | GL.iNet GL-MT6000 |
|---|---|---|
| Installed from | release e5efea8 (fresh SD card) | release e5efea8 (`install-mt6000.sh`) |
| Running now | generation 2 (ipcalc fix, 519ccdb) | ipcalc fix (519ccdb) |
| WAN | eth0, 192.168.2.223 from the MT6000 (lan4) | eth1 2.5G, 10.42.0.3 from the workstation's eno1 |
| SSH from the workstation | `ssh pirouter-mt6000` | `ssh mt6000` (192.168.2.1, enp2s0 on lan3) |
| WiFi | `TollGate-CD88`, open | `TollGate-F93C`, open; `c08r4d0r-F93C`, WPA2 |
| TollGate | fresh identity, empty wallet | identity + wallet restored from backup (pubkey b5fd495d...) |
| Root password | lab default `guix`: change it | lab default `guix`: change it |

Private WiFi key: `ssh mt6000 uci get wireless.private_radio0.key`.

## What was done

### MT6000 port (commits 5de6046 .. dcd8a8f)
- Kernel: nonguix `linux` + OpenWrt's block-NVMEM, mac-base and
  bootargs-append patches; OpenWrt's board DTS plus our
  `mt7986a-glinet-gl-mt6000-guix.dtsi` (secmon 256 KiB, mainline WO
  reserved regions deleted and WED off -- they reset the kernel --,
  gpt-partitions binding for the `factory` NVMEM, ramoops for crash logs).
- `clk_ignore_unused`: mtk_eth_soc is a module, its MDIO timed out otherwise.
- Boot: GL's stock U-Boot boots a FIT from p6; root ext4 "Guix" on p7.
  `deploy-mt6000.sh` (deploy / `--no-reboot` / `list` / `switch N`).
- Recovery: U-Boot TFTP-fetches `openwrt-gl-mt6000.bin` from 192.168.1.2
  on every power-on (PITFALLS #51) -- no button needed.

### TollGate (1582670, 7322b07)
- Wallet and Nostr identity restored from the OpenWrt backup
  (`~/mt6000-backup-20261015/`).
- Payments failed on both devices: gonuts-tollgate didn't understand short
  v2 keyset IDs (NUT-02).  Patched (`gonuts-tollgate-short-keyset-ids.patch`);
  mint URL `https://mint.minibits.cash/Bitcoin`.  A test payment worked; the
  20 sats were returned to you as a Cashu token, which you redeemed.

### Performance (1928d26)
- Packet steering: Ethernet IRQs on CPU1/CPU2, RPS on the others.
  Bidirectional routing 1.06 -> ~1.46 Gbit/s, no core saturated.
- Hardware flow offload tested and left off: it bypasses nodogsplash and
  the WiFi APs can't use it without WED (PITFALLS #56).

### Hardening (d968403)
- SSH keys only on both devices (`files/workstation.pub`).
- MT6000: wired ports lan1-5 are the private network (192.168.2.1, admin);
  the open TollGate SSID (br-lan, 192.168.1.1) can't reach SSH/LuCI.
- sysctls: no redirects, rp_filter=2, kptr_restrict, bpf_jit_harden.

### Release tooling (b4393cc .. e5efea8)
- `build-release.sh [all|rpi|mt6000]` -> `release/guix-router-DATE-REV/`:
  zstd images, SHA256SUMS (+ uncompressed sums/sizes), BUILD-INFO,
  installers, INSTALL.md.
- `install-mt6000.sh IFACE`: TFTP-boots OpenWrt's initramfs, writes and
  verifies p7 and p6 over SSH, reboots into Guix.
- `flash-rpi.sh` takes `.zst`.
- uci "late defaults": TollGate's setup runs after the WiFi config exists,
  then one automatic reboot (fresh installs used to miss TollGate's WiFi).

### Release tested end to end (today)
- MT6000: wiped and installed with `install-mt6000.sh` from the release;
  matched INSTALL.md (two boots, networks, DHCP, admin block, key-only
  SSH).  TollGate identity and wallet then restored from backup.
- Pi: fresh card from the release; one first-boot reboot (it waits ~90 s for
  resize2fs on a 64 GB card); TollGate up; key-only SSH.
- The Pi's WiFi chip allows one AP: TollGate's open one; its private
  network (br-private) stays down.  Documented in INSTALL.md.

### ipcalc fix (519ccdb)
- netifd's DHCP script logged `ipcalc.sh: not found` at every lease:
  functions.sh ran it by name without it on PATH.  Now by store path.
  Deployed to both routers, verified with forced renewals.
- New release with it: `release/guix-router-20261016-519ccdb/` (the old
  e5efea8 release is deleted).

## Open / next

- Change the root password on both routers (`ssh mt6000 passwd`,
  `ssh pirouter-mt6000 passwd`).
- The Pi's TollGate has a new identity; restore the old one if you have a
  backup of its `/etc/tollgate`.
- Fresh MT6000 installs have LuCI on HTTP :8080 only (no HTTPS).
- Parked: narrowing `clk_ignore_unused`; WED (WiFi offload); flow offload
  with per-zone flowtables.
- When deploying both routers in a row: wait until the MT6000 is fully back
  before deploying the Pi behind it (the Pi's copy timed out once).
- Nothing is pushed: commits are local, you push them.