guix-router/docs/STATUS.md

guix-router status (2026-10-16)

Where the project stands, what was done to get here, and what is open. Details: plans/guix-openwrt-mt6000-plan.md (§0b), docs/PITFALLS.md (#49-#57), docs/INSTALL.md. No passwords or WiFi keys in this file: read them from the routers (commands below).

Summary

Guix System with the OpenWrt userland (netifd, firewall4, dnsmasq, odhcpd, hostapd, LuCI, nodogsplash) and TollGate runs on both devices, installs from a release, updates with guix copy deploys, and rolls back.

	Raspberry Pi 4	GL.iNet GL-MT6000
Installed from	release e5efea8 (fresh SD card)	release e5efea8 (install-mt6000.sh)
Running now	generation 2 (ipcalc fix, 519ccdb)	ipcalc fix (519ccdb)
WAN	eth0, 192.168.2.223 from the MT6000 (lan4)	eth1 2.5G, 10.42.0.3 from the workstation's eno1
SSH from the workstation	ssh pirouter-mt6000	ssh mt6000 (192.168.2.1, enp2s0 on lan3)
WiFi	TollGate-CD88, open	TollGate-F93C, open; c08r4d0r-F93C, WPA2
TollGate	fresh identity, empty wallet	identity + wallet restored from backup (pubkey b5fd495d...)
Root password	lab default guix: change it	lab default guix: change it

Private WiFi key: ssh mt6000 uci get wireless.private_radio0.key.

What was done

MT6000 port (commits 5de6046 .. dcd8a8f)

• Kernel: nonguix linux + OpenWrt's block-NVMEM, mac-base and bootargs-append patches; OpenWrt's board DTS plus our mt7986a-glinet-gl-mt6000-guix.dtsi (secmon 256 KiB, mainline WO reserved regions deleted and WED off -- they reset the kernel --, gpt-partitions binding for the factory NVMEM, ramoops for crash logs).
• clk_ignore_unused: mtk_eth_soc is a module, its MDIO timed out otherwise.
• Boot: GL's stock U-Boot boots a FIT from p6; root ext4 "Guix" on p7. deploy-mt6000.sh (deploy / --no-reboot / list / switch N).
• Recovery: U-Boot TFTP-fetches openwrt-gl-mt6000.bin from 192.168.1.2 on every power-on (PITFALLS #51) -- no button needed.

TollGate (1582670, 7322b07)

• Wallet and Nostr identity restored from the OpenWrt backup (~/mt6000-backup-20261015/).
• Payments failed on both devices: gonuts-tollgate didn't understand short v2 keyset IDs (NUT-02). Patched (gonuts-tollgate-short-keyset-ids.patch); mint URL https://mint.minibits.cash/Bitcoin. A test payment worked; the 20 sats were returned to you as a Cashu token, which you redeemed.

Performance (1928d26)

• Packet steering: Ethernet IRQs on CPU1/CPU2, RPS on the others. Bidirectional routing 1.06 -> ~1.46 Gbit/s, no core saturated.
• Hardware flow offload tested and left off: it bypasses nodogsplash and the WiFi APs can't use it without WED (PITFALLS #56).

Hardening (d968403)

• SSH keys only on both devices (files/workstation.pub).
• MT6000: wired ports lan1-5 are the private network (192.168.2.1, admin); the open TollGate SSID (br-lan, 192.168.1.1) can't reach SSH/LuCI.
• sysctls: no redirects, rp_filter=2, kptr_restrict, bpf_jit_harden.

Release tooling (b4393cc .. e5efea8)

• build-release.sh [all|rpi|mt6000] -> release/guix-router-DATE-REV/: zstd images, SHA256SUMS (+ uncompressed sums/sizes), BUILD-INFO, installers, INSTALL.md.
• install-mt6000.sh IFACE: TFTP-boots OpenWrt's initramfs, writes and verifies p7 and p6 over SSH, reboots into Guix.
• flash-rpi.sh takes .zst.
• uci "late defaults": TollGate's setup runs after the WiFi config exists, then one automatic reboot (fresh installs used to miss TollGate's WiFi).

Release tested end to end (today)

• MT6000: wiped and installed with install-mt6000.sh from the release; matched INSTALL.md (two boots, networks, DHCP, admin block, key-only SSH). TollGate identity and wallet then restored from backup.
• Pi: fresh card from the release; one first-boot reboot (it waits ~90 s for resize2fs on a 64 GB card); TollGate up; key-only SSH.
• The Pi's WiFi chip allows one AP: TollGate's open one; its private network (br-private) stays down. Documented in INSTALL.md.

ipcalc fix (519ccdb)

• netifd's DHCP script logged ipcalc.sh: not found at every lease: functions.sh ran it by name without it on PATH. Now by store path. Deployed to both routers, verified with forced renewals.
• New release with it: release/guix-router-20261016-519ccdb/ (the old e5efea8 release is deleted).

Open / next

• Change the root password on both routers (ssh mt6000 passwd, ssh pirouter-mt6000 passwd).
• The Pi's TollGate has a new identity; restore the old one if you have a backup of its /etc/tollgate.
• Fresh MT6000 installs have LuCI on HTTP :8080 only (no HTTPS).
• Parked: narrowing clk_ignore_unused; WED (WiFi offload); flow offload with per-zone flowtables.
• When deploying both routers in a row: wait until the MT6000 is fully back before deploying the Pi behind it (the Pi's copy timed out once).
• Nothing is pushed: commits are local, you push them.