router: make CrowdSec opt-in (crowdsec.enable, default off)

Not every site wants the ban engine (hub sync needs internet at activation, and it is one more moving part on a small box). Gate crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`. gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.
router/tests: cover the staging uplink as NATed fallback exit
2026-09-21 07:20:17 +00:00 · 2026-09-21 04:32:14 +00:00 · 2026-09-21 04:32:07 +00:00 · 2026-09-18 10:08:03 +00:00 · 2026-09-18 10:06:01 +00:00 · 2026-09-18 09:36:07 +00:00
63 changed files with 6442 additions and 610 deletions
@@ -1,3 +1,4 @@
+{ ... }:
 let
  hosts = import ./modules/hosts.nix;

@@ -17,12 +18,18 @@ let
  };
 in
 {
+  # Site gateways: the router service instance lives in inventory.nix.
+  imports = [ ./inventory.nix ];
+
  # Ensure this is unique among all clans you want to use.
  meta.name = "cnx-network-clan";
  meta.domain = "cnx-network.internal";

  inventory.machines = fleet;

+  # Services defined in this repo (module.input = "self"). See modules/clan/.
+  modules.router = ./modules/clan/router;
+
  inventory.instances = {

    # Admin SSH keys + root password, split per the clan-core migration off
@@ -3,25 +3,39 @@
 NixOS routers (OPNsense replacements) on Topton 1U fanless boxes — Intel N300,
 4x i226-V 2.5G ports (some units add 2x 10G SFP+), 16GB DDR5, 256GB mSATA.
 Four sites are planned; the first is `gw-cnx-1` (Chiang Mai). Everything lives
-in the reusable `modules/router/` module (`cnx.router.*` options); a site's
-machine config only sets port names, VLANs, and feature flags.
+in the `router` clan service (`modules/clan/router/`, registered as
+`modules.router` in `clan.nix`); a site joins by adding its machine to the
+`router` inventory instance in `inventory.nix` with settings for port names,
+VLANs, and feature flags (`roles.default.machines.<gw>.settings`).

 Naming: `gw-<city>-<n>`, e.g. `gw-cnx-1`.

+The service has a NixOS VM test (`modules/clan/router/tests/vm/`): an ISP
+node runs a PPPoE access concentrator, a `client` sits on the tagged lan/iot
+VLANs behind the trunk, an `admin` on the untagged mgmt access port, and a
+simulated radio (`mac80211_hwsim`) carries two SSIDs with a WPA3 station. It
+checks the PPPoE dial-in, leases/reservations, Blocky, NAT, `allowWan`, the
+mgmt-only trust model, SSH exposure and the Wi-Fi bridge ports. Run it with
+`nix build .#checks.x86_64-linux.router` (also part of `nix flake check`).
+
 ## What each gateway runs

-| Function     | Implementation                                                                                                                                                                                |
-| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| WAN          | PPPoE (`pppd`), per-site ISP credentials via clan vars prompts; `wan.vlanId` when the ISP tags the session (AIS: 10); `wan.macAddress` to clone the old router's MAC if the ISP has it pinned |
-| LAN          | VLAN-filtering bridge `br0` over the trunk ports (networkd)                                                                                                                                   |
-| Firewall/NAT | nftables: default-deny WAN, no inter-VLAN, MSS clamp, v4 NAT                                                                                                                                  |
-| DHCP         | Kea, one subnet per VLAN                                                                                                                                                                      |
-| DNS          | Blocky (blocklist resolver), metrics on :4000 scraped by control                                                                                                                              |
-| IPv6         | DHCPv6-PD on ppp0, /64 per VLAN via SLAAC                                                                                                                                                     |
-| Bans         | CrowdSec + nftables bouncer (sshd log parsing)                                                                                                                                                |
-| Omada        | Optional per site: TP-Link Omada controller as a podman container                                                                                                                             |
-| Management   | ZeroTier mesh: SSH, node_exporter, journald upload — like the fleet                                                                                                                           |
-| Storage      | Single-disk ZFS (zstd, `/var` its own dataset for snapshots)                                                                                                                                  |
+| Function     | Implementation                                                                                                                                                                                                                                                                                                                |
+| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| WAN          | PPPoE (`pppd`), per-site ISP credentials via clan vars prompts; `wan.vlanId` when the ISP tags the session (AIS: 10); `wan.macAddress` to clone the old router's MAC if the ISP has it pinned                                                                                                                                 |
+| LAN          | VLAN-filtering bridge `br0` over the trunk ports (networkd); `accessPorts` pin a port untagged to one VLAN — convention: the last copper port is an untagged `mgmt` recovery port; `stagingPort` turns a spare port into a DHCP uplink into the old LAN while the box runs alongside the router it replaces (drop at cutover) |
+| Firewall/NAT | nftables: default-deny WAN, no inter-VLAN, MSS clamp, v4 NAT                                                                                                                                                                                                                                                                  |
+| DHCP         | Kea, one subnet per VLAN                                                                                                                                                                                                                                                                                                      |
+| DNS          | Blocky (blocklist resolver), metrics on :4000 scraped by control                                                                                                                                                                                                                                                              |
+| IPv6         | DHCPv6-PD on ppp0, /64 per VLAN via SLAAC                                                                                                                                                                                                                                                                                     |
+| Bans         | Optional per site (`crowdsec.enable`): CrowdSec + nftables bouncer (sshd log parsing)                                                                                                                                                                                                                                         |
+| Omada        | Optional per site: TP-Link Omada controller as a podman container                                                                                                                                                                                                                                                             |
+| Wi-Fi        | Optional: hostapd on the router's radios; each SSID (`wifi.networks`) is an untagged access port of its VLAN, passphrases via vars prompts — see `modules/clan/router/README.md`                                                                                                                                              |
+| Proxy        | Optional: Caddy reverse proxy for internal services under `*.<site><n>.cnx.network` with a real Let's Encrypt wildcard (DNS-01 against ns1)                                                                                                                                                                                   |
+| Diagnostics  | iperf3 server on 5201, reachable from every VLAN and the mesh (`iperf3 -c <router-vlan-addr>`); CLI toolkit: tcpdump, mtr, ethtool, conntrack, kdig, iftop, librespeed-cli                                                                                                                                                    |
+| Speed test   | Hourly librespeed run (`speedtest.timer`) → `speedtest_*` metrics via node_exporter; vmalert flags download < 50% of the link's own 7-day median (`WANSpeedDegraded`)                                                                                                                                                         |
+| Management   | ZeroTier mesh: SSH, node_exporter, journald upload — like the fleet                                                                                                                                                                                                                                                           |
+| Storage      | Single-disk ZFS (zstd, `/var` its own dataset for snapshots)                                                                                                                                                                                                                                                                  |

 ## Addressing plan

@@ -39,47 +53,97 @@ should also shorten `dhcp.leaseTime` (default 86400 s) so the pool recycles.
 First user: `gw-cnx-2` (site 2) runs the public WiFi — guest VLAN 30 at
 `10.2.128.0/22`, pool `10.2.128.100 – 10.2.131.250`, `dhcp.leaseTime = 3600`.

-| Site | siteId | mgmt           | lan            |
-| ---- | ------ | -------------- | -------------- |
-| cnx  | 1      | `10.1.10.0/24` | `10.1.20.0/24` |
+| Site | siteId | mgmt           | lan            | site-specific VLANs                                             |
+| ---- | ------ | -------------- | -------------- | --------------------------------------------------------------- |
+| cnx  | 1      | `10.1.10.0/24` | `10.1.20.0/24` | iot 40, voip 50, dmz 60, unit1–5 110/120/130/140/150 (all /24s) |
+
+Static DHCP leases are declared per VLAN via `dhcp.reservations` (attribute
+name = hostname, plus `hwAddress`/`ipAddress`); park them outside the pool,
+in the `.2–.99` infra range or `.200–.254`.

 Trust model: mgmt → everything; other VLANs → router DNS/DHCP + internet only
 (no inter-VLAN); WAN → nothing inbound; mesh → SSH, metrics, Omada UI.

 ## Adding a site

-1. Copy `machines/gw-cnx-1/` to `machines/gw-<city>-<n>/`; set `site`,
-   `siteId` (next free number), port names, VLANs, and `omada.enable`.
-   Fill the real disk id in `disko.nix` (from the installer:
-   `ls -l /dev/disk/by-id/`). Keep the `mgmt`/`lan` VLANs.
-2. Add the machine to `inventory.machines` in `clan.nix` and to the machine
-   list in `modules/mesh-hosts.nix`. Do **not** add it to `modules/hosts.nix`
-   (dynamic PPPoE IP; clan connects over the mesh).
+1. Copy `machines/gw-cnx-1/` to `machines/gw-<city>-<n>/` (disko, facter,
+   hostId, timezone). Fill the real disk id in `disko.nix` (from the
+   installer: `ls -l /dev/disk/by-id/`).
+2. Add the machine to `inventory.machines` in `clan.nix`, to the `router`
+   instance in `inventory.nix` (`roles.default.machines.gw-<city>-<n>.settings`: `site`,
+   `siteId` (next free number), port names, VLANs, `omada.enable`, `crowdsec.enable`; keep the
+   `mgmt`/`lan` VLANs), and to the machine list in `modules/mesh-hosts.nix`.
+   Do **not** add it to `modules/hosts.nix` (dynamic PPPoE IP; clan connects
+   over the mesh).
 3. Add its node_exporter and Blocky scrape targets in
   `modules/monitoring/server.nix`.
-4. `git add` the new machine directory — flake evaluation only sees
+4. If the site uses the internal proxy (`proxy.enable` in its settings), wire
+   ns1: import `(import ../../modules/clan/router/acme-secret.nix
+"gw-<city>-<n>")` in ns1's configuration (the gateway declares the same
+   shared generator itself), and on ns1 add the `dns-acme-gw-<city>-<n>-knot`
+   generator, its `keyFiles` entry, and an `acl_acme_gw_<city>_<n>` scoped to
+   `_acme-challenge.<city><n>` on the `cnx.network` zone (copy the `gw-cnx-1`
+   blocks). Then `clan vars generate ns1` and redeploy ns1.
+5. `git add` the new machine directory — flake evaluation only sees
   git-tracked files, so an untracked `machines/gw-…/` is silently ignored.
-5. `clan vars generate gw-<city>-<n>` — prompts for the site's PPPoE
+6. `clan vars generate gw-<city>-<n>` — prompts for the site's PPPoE
   credentials, mints the ZeroTier identity etc. (`nix flake check` fails
   until this has run, because mesh-hosts reads the ZeroTier IP var.)
-6. Boot the box from a NixOS installer USB on the local network, then:
+7. Boot the box from a NixOS installer USB on the local network, then:
   `clan machines install gw-<city>-<n> --target-host root@<lan-ip>`
-7. Check `facter.json` for the real NIC names, fix `wan.interface` /
+8. Check `facter.json` for the real NIC names, fix `wan.interface` /
   `trunkPorts` if the enumeration differs, and
   `clan machines update gw-<city>-<n>` (rides the mesh from then on).
-8. Add a row to the site table above and to the machines table in
+9. Add a row to the site table above and to the machines table in
   [Overview](./overview.md).

 ## Omada controller

-Sites with TP-Link Omada APs/switches set `cnx.router.omada.enable = true`.
-The controller runs as a podman container (`mbentley/omada-controller` — there
-is no nixpkgs package) with host networking on the mgmt VLAN, where adoption
+Sites with TP-Link Omada APs/switches set `omada.enable = true` in their
+router settings. The controller runs as a podman container
+(`mbentley/omada-controller` — there is no nixpkgs package) with host
+networking on the mgmt VLAN, where adoption
 broadcasts (UDP 29810) live. UI: `https://<mgmt-addr>:8043` from mgmt, or the
 gateway's mesh address from an admin machine. Controller state is under
 `/var/lib/omada`, declared as clan state (`clan.core.state.omada`); wiring it
 into the borgbackup instance is still a follow-up.

+## Internal reverse proxy
+
+`proxy.enable` in a site's router settings puts Caddy on the gateway,
+terminating TLS for `<service>.<site><n>.cnx.network` (e.g.
+`https://omada.cnx1.cnx.network`) and forwarding to internal backends:
+
+```nix
+proxy = {
+  enable = true;
+  services.omada = {
+    backend = "https://127.0.0.1:8043";
+    insecureSkipVerify = true; # Omada's cert is self-signed
+  };
+};
+```
+
+- **Cert**: one real Let's Encrypt wildcard `*.<site><n>.cnx.network` per
+  gateway, issued via ACME DNS-01 (lego/RFC2136) against ns1 — works behind
+  PPPoE with zero inbound reachability, and browsers trust it without a CA
+  install. Each gateway has its own TSIG key (`acme_gw_<city>_<n>`) that ns1
+  scopes to `_acme-challenge.<site><n>` TXT records only. The zone, ns1's
+  address and the ACME contact are fleet-wide role settings in `inventory.nix`
+  (`proxy.domain`, `proxy.acme.nameserver`, `proxy.acme.email`).
+- **Resolution**: the names exist only internally — Blocky answers
+  `*.<site><n>.cnx.network` with the router's `lan` address; the public
+  `cnx.network` zone never carries them.
+- **Access**: `proxy.allowVlans` (default `mgmt` + `lan`) get 443 (and 80 for
+  the HTTP→HTTPS redirect). Not exposed to WAN, guest VLANs, or the mesh.
+
+## Using the service from another clan
+
+The service is exported as `clan.modules.router` of this flake; add this
+repo as a flake input and reference it with `module.input = "<input name>"`.
+`modules/clan/router/README.md` is the consumer-facing description (it is
+also the module's manifest readme, shown by `clan modules`).
+
 ## Runbook

 - **PPPoE down**: `systemctl status pppd-wan`, `journalctl -u pppd-wan` on the
@@ -89,6 +153,10 @@ into the borgbackup instance is still a follow-up.
  port's `bridgeVLANs` tagging and that the switch trunk carries the VLAN.
 - **DNS/blocklist issues**: Blocky metrics are in VictoriaMetrics (job
  `blocky`); `journalctl -u blocky` on the gateway.
+- **Slow internet reported / `WANSpeedDegraded` firing**: check the
+  `speedtest_download_mbps` / `speedtest_ping_ms` trend in VictoriaMetrics,
+  then `librespeed-cli` and `mtr <isp-gw>` on the gateway to separate ISP
+  degradation from local saturation (`iftop` on ppp0 shows who's eating it).
 - **Banned yourself**: `cscli decisions list` / `cscli decisions delete --ip <ip>`
  on the gateway. The ZeroTier mesh `/88` is whitelisted at the parser stage
  (`cnx/mesh-whitelist`), so admin access over the mesh can never be banned.
@@ -52,6 +52,10 @@ there is picked up):
 - **CNX Uptime** (`uptime.json`) — per-host up/down status, current uptime,
  availability over the selected window, and up/down history. Label-driven, so
  every scraped host appears automatically.
+- **CNX WAN Speed** (`wan.json`) — per-gateway WAN speed from the hourly
+  librespeed runs: latest download/upload/ping, throughput history with each
+  link's 7-day median as reference, latency/jitter, and test status. See
+  [Site gateways](./gateways.md).
 - **parsedmarc** — DMARC aggregate/forensic report viewer. Auto-provisioned by
  the `parsedmarc` module (not from `dashboards/`); reads its own Elasticsearch
  datasource, not VictoriaMetrics. See [DMARC reports](#dmarc-reports) below.
@@ -247,6 +247,10 @@
    "root": {
      "inputs": {
        "clan-core": "clan-core",
+        "flake-parts": [
+          "clan-core",
+          "flake-parts"
+        ],
        "nixos-mailserver": "nixos-mailserver",
        "nixpkgs": [
          "clan-core",
@@ -7,13 +7,16 @@
  inputs.nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05";
  inputs.nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";

+  inputs.flake-parts.follows = "clan-core/flake-parts";
+
  outputs =
-    {
+    inputs@{
      self,
      clan-core,
      nixpkgs,
+      flake-parts,
      ...
-    }@inputs:
+    }:
    let
      # Usage see: https://docs.clan.lol
      clan = clan-core.lib.clan {
@@ -36,38 +39,34 @@
          "age-plugin-fido2-hmac"
        ];
      };
-
+    in
+    flake-parts.lib.mkFlake { inherit inputs; } {
      systems = [
        "x86_64-linux"
        "aarch64-linux"
        "aarch64-darwin"
        "x86_64-darwin"
      ];
-      forAllSystems = nixpkgs.lib.genAttrs systems;
-      pkgsFor = system: clan-core.inputs.nixpkgs.legacyPackages.${system};
-      treefmtFor = system: inputs.treefmt-nix.lib.evalModule (pkgsFor system) ./fmt.nix;
-    in
-    {
-      inherit (clan.config) nixosConfigurations nixosModules clanInternals;
-      clan = clan.config;

-      # `nix fmt` and the `nix flake check` formatting gate.
-      formatter = forAllSystems (system: (treefmtFor system).config.build.wrapper);
-      checks = forAllSystems (system: {
-        formatting = (treefmtFor system).config.build.check self;
-      });
+      # perSystem.clan.nixosTests: NixOS VM tests of our own clan services.
+      imports = [ clan-core.flakeModules.testModule ];

-      # Add the Clan cli tool to the dev shell.
-      # Use "nix develop" to enter the dev shell.
-      devShells = forAllSystems (
-        system:
+      flake = {
+        inherit (clan.config) nixosConfigurations nixosModules clanInternals;
+        clan = clan.config;
+      };
+
+      perSystem =
+        { system, ... }:
        let
+          pkgs = clan-core.inputs.nixpkgs.legacyPackages.${system};
+          treefmtEval = inputs.treefmt-nix.lib.evalModule pkgs ./fmt.nix;
          clanCli = clan-core.packages.${system}.clan-cli;
          # `clan machines update a b c` normally runs machines in parallel,
          # which interleaves their output and buries the YubiKey PIN prompts.
          # This wrapper (first in PATH) runs them one at a time instead; any
          # flags fall through to the real CLI untouched.
-          clanSequential = (pkgsFor system).writeShellScriptBin "clan" ''
+          clanSequential = pkgs.writeShellScriptBin "clan" ''
            if [ "$#" -gt 3 ] && [ "$1" = machines ] && [ "$2" = update ]; then
              shift 2
              for arg in "$@"; do
@@ -84,14 +83,25 @@
          '';
        in
        {
-          default = (pkgsFor system).mkShell {
+          # `nix fmt` and the `nix flake check` formatting gate.
+          formatter = treefmtEval.config.build.wrapper;
+          checks.formatting = treefmtEval.config.build.check self;
+
+          # `nix build .#checks.x86_64-linux.router` (VM test, Linux only).
+          clan.nixosTests.router = {
+            imports = [ ./modules/clan/router/tests/vm ];
+            clan.modules.router = ./modules/clan/router;
+          };
+
+          # Add the Clan cli tool to the dev shell.
+          # Use "nix develop" to enter the dev shell.
+          devShells.default = pkgs.mkShell {
            packages = [
              clanSequential
              clanCli
-              (treefmtFor system).config.build.wrapper
+              treefmtEval.config.build.wrapper
            ];
          };
-        }
-      );
+        };
    };
 }
@@ -14,6 +14,9 @@
    },
    "web01": {
      "installedAt": 1781983723
+    },
+    "gw-cnx-1": {
+      "installedAt": 1785494267
    }
  }
 }
@@ -0,0 +1,95 @@
+# Site gateways: the `router` service instance (modules/clan/router). One
+# instance for the fleet; each site adds its machine with the site's port /
+# VLAN layout under roles.default.machines.<gw>.settings. Everything else
+# (PPPoE, Kea/Blocky, nftables, IPv6-PD, CrowdSec, iperf3, speedtest) follows
+# from the service. Imported by clan.nix.
+{ config, lib, ... }:
+let
+  hosts = import ./modules/hosts.nix;
+  mesh = import ./modules/mesh-hosts.nix {
+    dir = config.directory;
+    inherit lib;
+  };
+in
+{
+  inventory.instances.router = {
+    module = {
+      name = "router";
+      input = "self";
+    };
+
+    # Fleet-wide settings: admin paths (SSH, scrapes, iperf3, Omada UI) are
+    # opened to the mesh; internal proxy names live under
+    # <site><n>.cnx.network with wildcard certs issued via DNS-01 against
+    # ns1 (which must declare the gateway's acme-secret.nix generator).
+    roles.default.settings = {
+      mesh.subnet = mesh.subnet;
+      proxy = {
+        domain = "cnx.network";
+        acme.nameserver = hosts.ns1.ipv4;
+        acme.email = "postmaster@cnx.email";
+      };
+    };
+
+    # Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G. Port roles
+    # use the expected igc names — verify against facter.json after the
+    # first install and adjust if the box enumerates differently.
+    roles.default.machines.gw-cnx-1.settings = {
+      site = "cnx";
+      siteId = 1;
+      wan.interface = "enp1s0";
+      wan.vlanId = null; # this ISP runs PPPoE untagged on the port
+      wan.macAddress = "a8:b8:e0:01:06:87";
+      trunkPorts = [ "enp2s0" ];
+      # STAGING (remove at cutover, move enp3s0 back into trunkPorts):
+      # DHCP-client uplink into the existing OPNsense LAN so the box has
+      # internet + mesh while it runs alongside the old router.
+      stagingPort = "enp3s0";
+      # Dedicated on-site recovery port: untagged mgmt, always available even
+      # if the switch config is broken.
+      accessPorts.enp4s0 = "mgmt";
+      # Replaces the newedge.house OPNsense box; renumbered to the fleet
+      # convention (10.1.<vlanId>.0/24, router .1, pool .100-.199). The old
+      # untagged LAN becomes tagged mgmt — infra switch ports get PVID 10.
+      vlans = {
+        mgmt = {
+          id = 10; # 10.1.10.0/24 — servers, APs, switches, Omada, admin
+          dhcp.reservations.storinator01 = {
+            hwAddress = "7c:c2:55:e0:d6:40";
+            ipAddress = "10.1.10.53";
+          };
+        };
+        lan.id = 20; # 10.1.20.0/24 — trusted clients
+        iot.id = 40; # 10.1.40.0/24
+        voip.id = 50; # 10.1.50.0/24
+        dmz.id = 60; # 10.1.60.0/24
+        unit1.id = 110; # 10.1.110.0/24
+        unit2.id = 120; # 10.1.120.0/24
+        unit3.id = 130; # 10.1.130.0/24
+        unit4.id = 140; # 10.1.140.0/24
+        unit5 = {
+          id = 150; # 10.1.150.0/24
+          dhcp.reservations.newt = {
+            hwAddress = "7c:d3:0a:21:58:0b";
+            ipAddress = "10.1.150.22";
+          };
+        };
+      };
+      # This site runs the Omada controller for its APs/switches.
+      omada.enable = true;
+      # sshd ban engine (was unconditional before the option existed).
+      crowdsec.enable = true;
+
+      # Internal reverse proxy: real wildcard cert *.cnx1.cnx.network; Blocky
+      # resolves the names to the router's LAN address for mgmt+lan clients.
+      proxy = {
+        enable = true;
+        services.omada = {
+          # Omada's UI is HTTPS with a self-signed cert on the host network.
+          backend = "https://127.0.0.1:8043";
+          insecureSkipVerify = true;
+        };
+      };
+    };
+  };
+}
@@ -1,12 +1,9 @@
 # Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
-# Port roles below use the expected igc names — verify against facter.json
-# after the first install and adjust if the box enumerates differently.
+# The router itself (ports, VLANs, features) is the `router` service instance
+# in clan.nix; only machine-local bits live here.
 { config, lib, ... }:
 {
-  imports = [
-    ../../modules/router
-    ../../modules/monitoring/exporters.nix
-  ];
+  imports = [ ../../modules/monitoring/exporters.nix ];

  clan.core.sops.defaultGroups = [ "admins" ];

@@ -19,25 +16,6 @@
    builtins.hashString "sha256" config.networking.hostName
  );

-  cnx.router = {
-    enable = true;
-    site = "cnx";
-    siteId = 1;
-    wan.interface = "enp1s0";
-    wan.vlanId = 10; # AIS delivers PPPoE tagged on VLAN 10
-    trunkPorts = [
-      "enp2s0"
-      "enp3s0"
-      "enp4s0"
-    ];
-    vlans = {
-      mgmt.id = 10; # 10.1.10.0/24 — APs, switches, Omada, admin
-      lan.id = 20; # 10.1.20.0/24 — trusted clients
-    };
-    # This site runs the Omada controller for its APs/switches.
-    omada.enable = true;
-  };
-
  time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
  services.chrony.enable = true;
 }
@@ -6,7 +6,10 @@
 }:
 let
  domains = import ../../modules/dns/domains.nix;
-  mesh = import ../../modules/mesh-hosts.nix { inherit config lib; };
+  mesh = import ../../modules/mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  hosts = import ../../modules/hosts.nix;
 in
 {
@@ -14,6 +17,8 @@ in
    ../../modules/dns/authoritative.nix
    ../../modules/dns/acme-mx1-secret.nix
    ../../modules/dns/acme-web01-secret.nix
+    # Same shared TSIG secret the gateway's router service declares (proxy).
+    (import ../../modules/clan/router/acme-secret.nix "gw-cnx-1")
    ../../modules/static-ipv6.nix
    ../../modules/monitoring/exporters.nix
  ];
@@ -93,10 +98,29 @@ in
    '';
  };

+  # ACME DNS-01, dedicated gateway keys. Same pattern as web01: each gateway
+  # holds its own TSIG key (acme_gw_<site>_<n>), rendered from the shared
+  # secret generator imported above. acl_acme_gw_<site>_<n> scopes it to TXT
+  # updates at _acme-challenge.<site><n> on cnx.network — the owner its internal
+  # wildcard *.<site><n>.cnx.network challenge uses — and nothing else.
+  clan.core.vars.generators.dns-acme-gw-cnx-1-knot = {
+    files."acme.conf" = {
+      secret = true;
+      owner = "knot";
+      group = "knot";
+    };
+    dependencies = [ "dns-acme-gw-cnx-1-secret" ];
+    script = ''
+      printf 'key:\n  - id: acme_gw_cnx_1\n    algorithm: hmac-sha256\n    secret: %s\n' \
+        "$(cat "$in"/dns-acme-gw-cnx-1-secret/secret)" > "$out"/acme.conf
+    '';
+  };
+
  services.knot.keyFiles = [
    config.clan.core.vars.generators.dns-acme-tsig.files."acme.conf".path
    config.clan.core.vars.generators.dns-acme-mx1-knot.files."acme.conf".path
    config.clan.core.vars.generators.dns-acme-web01-knot.files."acme.conf".path
+    config.clan.core.vars.generators.dns-acme-gw-cnx-1-knot.files."acme.conf".path
  ];

  services.knot.settings.acl = [
@@ -133,6 +157,17 @@ in
      # i.e. _acme-challenge at the cnx.network apex (where this acl is attached).
      "update-owner-name" = [ "_acme-challenge" ];
    }
+    {
+      id = "acl_acme_gw_cnx_1";
+      key = "acme_gw_cnx_1";
+      action = [ "update" ];
+      "update-type" = [ "TXT" ];
+      "update-owner" = "name";
+      "update-owner-match" = "sub-or-equal";
+      # The internal wildcard *.cnx1.cnx.network places its challenge at
+      # _acme-challenge.cnx1.cnx.network.
+      "update-owner-name" = [ "_acme-challenge.cnx1" ];
+    }
  ];

  # Automatic DNSSEC signing policy (primary only). ECDSA P-256/SHA-256 with
@@ -168,6 +203,9 @@ in
      "acl_acme"
    ]
    ++ lib.optionals (d == "cnx.email") [ "acl_acme_mx1" ]
-    ++ lib.optionals (d == "cnx.network") [ "acl_acme_web01" ];
+    ++ lib.optionals (d == "cnx.network") [
+      "acl_acme_web01"
+      "acl_acme_gw_cnx_1"
+    ];
  }) domains;
 }
@@ -0,0 +1,92 @@
+# router
+
+Turns a machine with several NICs into a site gateway: PPPoE WAN (ISP
+credentials via vars prompts), a VLAN-filtering bridge over the LAN ports with
+one L3 interface per VLAN, Kea DHCP and Blocky DNS per VLAN, nftables
+firewall/NAT, DHCPv6-PD, an iperf3 server and a WAN speed-test timer.
+Optional: a Wi-Fi access point on the router's own radios (hostapd), CrowdSec
+with the nftables bouncer (sshd log parsing), the TP-Link Omada controller
+(podman) and an internal Caddy reverse proxy with a real wildcard certificate
+(ACME DNS-01).
+
+Addressing convention: a site owns `10.<siteId>.0.0/16`; VLAN `<id>` defaults
+to `10.<siteId>.<id>.0/24`, router at `.1`, DHCP pool `.100-.199`. The `mgmt`
+and `lan` VLANs are mandatory. Trust model: mgmt reaches everything; other
+VLANs get router DNS/DHCP and (with `allowWan`) the internet, no inter-VLAN;
+WAN nothing inbound; the admin mesh (`mesh.subnet`) gets SSH, metrics, iperf3
+and the Omada UI.
+
+## Usage from another clan
+
+```nix
+# flake.nix
+inputs.cnx-network.url = "git+https://<host>/B4L/cnx-network-clan";
+
+# clan.nix
+inventory.instances.router = {
+  module = { name = "router"; input = "cnx-network"; };
+  roles.default.settings.mesh.subnet = "fd..::/88"; # your admin overlay
+  roles.default.machines.gw-1.settings = {
+    site = "ams";
+    siteId = 1;
+    wan.interface = "enp1s0";
+    wan.vlanId = 10;                 # or null for untagged PPPoE
+    trunkPorts = [ "enp2s0" ];
+    accessPorts.enp4s0 = "mgmt";     # untagged on-site recovery port
+    # stagingPort = "enp3s0";       # DHCP uplink into the old LAN until cutover
+    vlans = {
+      mgmt.id = 10;
+      lan.id = 20;
+      iot = { id = 40; allowWan = false; };
+    };
+  };
+};
+```
+
+Then `clan vars generate gw-1` prompts for the PPPoE username/password.
+
+### Wi-Fi access point
+
+If the box has wireless cards, the router can be the site's AP. An SSID is
+defined once and behaves like an untagged access port of its VLAN; radios
+choose what to broadcast, so a dual-band card serves the same SSID twice:
+
+```nix
+wifi = {
+  enable = true;
+  countryCode = "TH";
+  networks = {
+    home.vlan = "lan";                                   # WPA3 with WPA2 fallback
+    things = { vlan = "iot"; security = "wpa2"; };       # legacy IoT
+    guest = { vlan = "guest"; isolateClients = true; };
+  };
+  radios = {
+    wlp5s0 = { band = "2g"; channel = 6; macAddress = "…"; networks = [ "home" "things" ]; };
+    wlp6s0 = { band = "5g"; channel = 36; networks = [ "home" ]; };
+  };
+};
+```
+
+Passphrases are vars prompts (`wifi-<name>-passphrase`), asked once at `clan
+vars generate`. A radio broadcasting more than one SSID needs its hardware
+`macAddress`: hostapd wants a fixed BSSID per extra SSID, derived from it.
+`security = "wpa3-transition"` (the default) offers SAE and WPA2-PSK-SHA256;
+devices that only speak classic WPA2-PSK need `security = "wpa2"`.
+
+### Internal proxy
+
+`proxy.enable` serves `<name>.<site><siteId>.<proxy.domain>` under a wildcard
+certificate obtained via RFC 2136 DNS-01 against `proxy.acme.nameserver`. The
+gateway signs updates with TSIG key `acme_<hostname with _>`, whose secret is
+the shared `dns-acme-<hostname>-secret` generator declared by this service.
+The nameserver machine must declare the same generator so both sides hold one
+secret — import `acme-secret.nix` from this directory with the gateway's name:
+
+```nix
+imports = [ (import "${inputs.cnx-network}/modules/clan/router/acme-secret.nix" "gw-1") ];
+```
+
+and load the key with an acl scoped to `_acme-challenge.<site><siteId>`.
+
+The service does not open the WAN to anything; reach gateways over your mesh.
+One instance per machine.
@@ -0,0 +1,22 @@
+# Shared TSIG secret for a gateway's dedicated ACME key (function: machine
+# name -> NixOS module). The acme_<machine> key lets that gateway — and only
+# it — write _acme-challenge.<site><siteId> TXT records on the authoritative
+# nameserver to obtain its internal wildcard cert via DNS-01 (proxy.nix).
+#
+# The router service declares it on the gateway automatically when
+# proxy.enable is set. The nameserver machine must declare the very same
+# generator so both sides share one secret:
+#   imports = [ (import <router-service>/acme-secret.nix "gw-cnx-1") ];
+# and then load it into its DNS server as key acme_gw_cnx_1 (hmac-sha256)
+# with an acl scoped to that gateway's _acme-challenge label.
+machine:
+{ pkgs, ... }:
+{
+  clan.core.vars.generators."dns-acme-${machine}-secret" = {
+    share = true;
+    files."secret".secret = true;
+    runtimeInputs = [ pkgs.openssl ];
+    # 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
+    script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
+  };
+}
@@ -1,17 +1,14 @@
 # CrowdSec security engine + nftables bouncer: parses sshd auth attempts from
 # the journal and bans offending source IPs at the firewall. Log-based (no
-# inline DPI) so it costs the N300 next to nothing.
-{
-  config,
-  lib,
-  ...
-}:
+# inline DPI) so it costs the N300 next to nothing. Opt-in per site
+# (`crowdsec.enable`): the hub sync needs internet at activation time.
+{ settings }:
+{ lib, ... }:
 let
-  cfg = config.cnx.router;
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  cfg = settings;
 in
 {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf cfg.crowdsec.enable {
    services.crowdsec = {
      enable = true;
      autoUpdateService = true;
@@ -36,7 +33,7 @@ in
            description = "Whitelist the ZeroTier management mesh";
            whitelist = {
              reason = "ZeroTier mesh is the admin path";
-              cidr = [ mesh.subnet ];
+              cidr = [ cfg.mesh.subnet ];
            };
          }
        ];
@@ -0,0 +1,67 @@
+# Site gateway (OPNsense replacement) for the Topton 1U boxes, as a clan
+# service: PPPoE WAN, VLAN-filtering bridge over the LAN ports, per-VLAN
+# DHCP/DNS, firewall/NAT, and the optional Omada controller / internal proxy.
+#
+# Exported as `clan.modules.router` of this flake; used here with
+# `module.input = "self"` and from other clans with `module.input =
+# "<this flake's input name>"`. README.md has the consumer view. A site joins
+# through the inventory:
+#
+#   inventory.instances.router = {
+#     module = { name = "router"; input = "self"; };
+#     roles.default.settings.mesh.subnet = ...;   # fleet-wide
+#     roles.default.machines.gw-<city>-<n>.settings = { site = ...; ... };
+#   };
+#
+# The settings schema lives in interface.nix. Implementation files that need
+# the settings are functions `{ settings }: <NixOS module>`; the evaluated
+# settings are handed in with importApply so nothing goes through
+# machine-level options. The rest are plain NixOS modules.
+{ lib, ... }:
+{
+  _class = "clan.service";
+  manifest.name = "router";
+  manifest.description = "Site gateway: PPPoE WAN, VLAN bridge, DHCP/DNS, firewall/NAT";
+  manifest.categories = [ "Network" ];
+  manifest.readme = builtins.readFile ./README.md;
+
+  roles.default = {
+    description = "Turns the machine into the site's router (one instance per machine).";
+    interface = ./interface.nix;
+
+    perInstance =
+      { settings, machine, ... }:
+      {
+        nixosModule.imports = [
+          ./ipv6.nix
+        ]
+        # The proxy's TSIG secret is shared with the nameserver (acme-secret.nix).
+        ++ lib.optional settings.proxy.enable (import ./acme-secret.nix machine.name)
+        ++ map (file: lib.modules.importApply file { inherit settings; }) [
+          ./network.nix
+          ./pppoe.nix
+          ./firewall.nix
+          ./dns-dhcp.nix
+          ./crowdsec.nix
+          ./omada.nix
+          ./proxy.nix
+          ./iperf.nix
+          ./speedtest.nix
+          ./wifi.nix
+        ];
+      };
+  };
+
+  # A machine has exactly one WAN port and one VLAN layout; two instances would
+  # both claim br0/ppp0 and fight over Kea/Blocky/nftables.
+  perMachine =
+    { instances, machine, ... }:
+    {
+      nixosModule.assertions = [
+        {
+          assertion = lib.length (lib.attrNames instances) == 1;
+          message = "router: ${machine.name} is a gateway in several instances (${lib.concatStringsSep ", " (lib.attrNames instances)}); a machine can only be one router.";
+        }
+      ];
+    };
+}
@@ -0,0 +1,98 @@
+# LAN DHCP (Kea) and DNS (Blocky). Fully declarative: one Kea subnet per VLAN
+# with dhcp.enable, Blocky as the blocklist resolver every DHCP lease points
+# at. Blocky's HTTP listener (:4000) serves Prometheus metrics, scraped by
+# control over the mesh (firewall.nix scopes it to the mesh subnet).
+{ settings }:
+{ lib, ... }:
+let
+  cfg = settings;
+  dhcpVlans = lib.filterAttrs (_: vlan: vlan.dhcp.enable) cfg.vlans;
+in
+{
+  services.kea.dhcp4 = {
+    enable = true;
+    settings = {
+      interfaces-config = {
+        interfaces = lib.mapAttrsToList (name: _: "vlan-${name}") dhcpVlans;
+        # The unit orders after network-online.target, which under networkd
+        # only waits for the WAN carrier (the vlan-* links are
+        # RequiredForOnline=no), so Kea can start before vlan-* have their
+        # addresses. By default it then logs the failed bind and runs with no
+        # socket at all: clients' DISCOVERs reach vlan-lan and nobody answers.
+        # Insist on every socket and keep retrying while networkd catches up;
+        # if it still cannot bind, exit and let systemd restart the unit.
+        service-sockets-require-all = true;
+        service-sockets-max-retries = 60;
+        service-sockets-retry-wait-time = 1000;
+      };
+      lease-database = {
+        type = "memfile";
+        persist = true;
+        name = "/var/lib/kea/dhcp4.leases";
+      };
+      valid-lifetime = 86400;
+      subnet4 = lib.mapAttrsToList (name: vlan: {
+        id = vlan.id;
+        subnet = vlan.subnet;
+        interface = "vlan-${name}";
+        valid-lifetime = vlan.dhcp.leaseTime;
+        pools = [ { pool = "${vlan.dhcp.pool.from} - ${vlan.dhcp.pool.to}"; } ];
+        reservations = lib.mapAttrsToList (host: res: {
+          hostname = host;
+          hw-address = res.hwAddress;
+          ip-address = res.ipAddress;
+        }) vlan.dhcp.reservations;
+        option-data = [
+          {
+            name = "routers";
+            data = vlan.address;
+          }
+          {
+            name = "domain-name-servers";
+            data = vlan.address;
+          }
+        ];
+      }) dhcpVlans;
+    };
+  };
+
+  # The nixpkgs unit already has Restart=on-failure; space the restarts out so
+  # a persistent bind failure does not trip the start-rate limit.
+  systemd.services.kea-dhcp4-server.serviceConfig.RestartSec = 5;
+
+  services.blocky = {
+    enable = true;
+    settings = {
+      ports = {
+        dns = 53;
+        http = 4000;
+      };
+      upstreams.groups.default = [
+        "9.9.9.9"
+        "149.112.112.112"
+        "2620:fe::fe"
+      ];
+      blocking = {
+        denylists.ads = [
+          "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
+        ];
+        clientGroupsBlock.default = [ "ads" ];
+      };
+      caching = {
+        minTime = "5m";
+        prefetching = true;
+      };
+      prometheus.enable = true;
+    };
+  };
+
+  # The router itself resolves via public resolvers, not via Blocky, so DNS
+  # for deploys/updates survives a broken local resolver. networkd would
+  # enable systemd-resolved by default, whose stub listener on 127.0.0.53:53
+  # makes Blocky's wildcard :53 bind fail — plain resolv.conf instead.
+  services.resolved.enable = false;
+  networking.nameservers = [
+    "9.9.9.9"
+    "1.1.1.1"
+  ];
+}
@@ -0,0 +1,91 @@
+# Router firewall/NAT policy (nftables). Trust model:
+#   mgmt VLAN  -> trusted: router services, all VLANs, WAN
+#   other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
+#   WAN (ppp0) -> nothing inbound beyond established/related
+#   mesh       -> admin SSH + metrics scrapes (same trust boundary as the fleet)
+#   staging    -> admin SSH only inbound (pre-cutover uplink into the old LAN);
+#                 allowWan VLANs are NATed out through it while ppp0 is down
+{ settings }:
+{ lib, ... }:
+let
+  cfg = settings;
+
+  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
+  wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
+    lib.filterAttrs (_: vlan: vlan.allowWan) cfg.vlans
+  );
+  nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
+
+  # allowWan VLANs may also leave through the staging uplink. Same set as
+  # networking.nat.internalInterfaces below, so `allowWan` holds on both
+  # exits. The kernel picks the exit: ppp0 (metric 0, see pppoe.nix) while
+  # the session is up, the staging DHCP route (metric 1024) otherwise.
+  stagingExit = cfg.stagingPort != null && wanVlanIfs != [ ];
+  wanVlanSet = "{ ${lib.concatMapStringsSep ", " (i: ''"${i}"'') wanVlanIfs} }";
+in
+{
+  networking.nftables.enable = true;
+
+  # SSH reachable only from the mgmt VLAN (trusted) and the mesh — never
+  # from the WAN or the other VLANs.
+  services.openssh.openFirewall = false;
+
+  networking.firewall = {
+    enable = true;
+    filterForward = true;
+    trustedInterfaces = [ "vlan-mgmt" ];
+
+    # Non-mgmt VLANs may only talk to the router's DNS and DHCP; the staging
+    # uplink (old LAN, pre-cutover) gets admin SSH so the box can be reached
+    # before the mgmt VLAN or the mesh are up.
+    interfaces =
+      lib.genAttrs nonMgmtIfs (_: {
+        allowedTCPPorts = [ 53 ];
+        allowedUDPPorts = [
+          53
+          67
+        ];
+      })
+      // lib.optionalAttrs (cfg.stagingPort != null) {
+        ${cfg.stagingPort}.allowedTCPPorts = [ 22 ];
+      };
+
+    extraInputRules = ''
+      ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"
+      ip6 saddr ${cfg.mesh.subnet} tcp dport 4000 accept comment "blocky metrics scrape from control"
+    '';
+
+    extraForwardRules = ''
+      tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
+      iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
+    ''
+    + lib.optionalString stagingExit ''
+      iifname ${wanVlanSet} oifname "${cfg.stagingPort}" accept comment "allowWan VLANs out via the staging uplink"
+    '';
+  };
+
+  # networking.nat both masquerades and opens forward-to-WAN for exactly its
+  # internalInterfaces — so this list, not a rule of our own, is where
+  # `allowWan` is enforced. Listing every VLAN here would silently let
+  # allowWan = false VLANs out.
+  networking.nat = {
+    enable = true;
+    externalInterface = "ppp0";
+    internalInterfaces = wanVlanIfs;
+  };
+
+  # networking.nat only masquerades on its single externalInterface; the
+  # staging uplink needs its own postrouting chain (nixos-nat's is
+  # oifname-scoped to ppp0, so the two never both apply).
+  networking.nftables.tables = lib.optionalAttrs stagingExit {
+    router-staging-nat = {
+      family = "ip";
+      content = ''
+        chain post {
+          type nat hook postrouting priority srcnat;
+          iifname ${wanVlanSet} oifname "${cfg.stagingPort}" masquerade comment "allowWan VLANs out via the staging uplink"
+        }
+      '';
+    };
+  };
+}
@@ -0,0 +1,382 @@
+# Settings of the `router` service (inventory `roles.default.settings`).
+# Pure schema: no machine config is reachable here; the implementation files
+# get the evaluated result as `settings`.
+#
+# Fleet addressing convention: each site owns 10.<siteId>.0.0/16. A VLAN's
+# subnet defaults to 10.<siteId>.<vlanId>.0/24 with the router at .1 and the
+# DHCP pool at .100-.199. VLANs that need more space (e.g. public-wifi guest)
+# override `subnet`/`address`/`dhcp.pool` and take a wider block from the
+# upper half (10.<siteId>.128.0/17), e.g. guest -> 10.<siteId>.128.0/22.
+# VLAN ids: 10 = mgmt, 20 = lan (mandatory); 30 = guest, 40 = iot (reserved).
+{ config, lib, ... }:
+let
+  site = toString config.siteId;
+
+  vlanModule =
+    { config, ... }:
+    let
+      octet = toString config.id;
+    in
+    {
+      options = {
+        id = lib.mkOption {
+          type = lib.types.ints.between 1 4094;
+          description = "802.1Q VLAN id (fleet convention: 10 mgmt, 20 lan, 30 guest, 40 iot).";
+        };
+        address = lib.mkOption {
+          type = lib.types.str;
+          default = "10.${site}.${octet}.1";
+          defaultText = lib.literalExpression ''"10.<siteId>.<id>.1"'';
+          description = "Router address on this VLAN.";
+        };
+        prefixLength = lib.mkOption {
+          type = lib.types.ints.between 8 30;
+          default = 24;
+        };
+        subnet = lib.mkOption {
+          type = lib.types.str;
+          default = "10.${site}.${octet}.0/24";
+          defaultText = lib.literalExpression ''"10.<siteId>.<id>.0/24"'';
+          description = "The VLAN's network in CIDR form (must contain `address`).";
+        };
+        dhcp = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+          };
+          pool = {
+            from = lib.mkOption {
+              type = lib.types.str;
+              default = "10.${site}.${octet}.100";
+              defaultText = lib.literalExpression ''"10.<siteId>.<id>.100"'';
+            };
+            to = lib.mkOption {
+              type = lib.types.str;
+              default = "10.${site}.${octet}.199";
+              defaultText = lib.literalExpression ''"10.<siteId>.<id>.199"'';
+            };
+          };
+          leaseTime = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 86400;
+            description = ''
+              Lease validity in seconds. Lower it for high-churn networks,
+              e.g. public-WiFi guest VLANs (3600-7200), so the pool recycles.
+            '';
+          };
+          reservations = lib.mkOption {
+            type = lib.types.attrsOf (
+              lib.types.submodule {
+                options = {
+                  hwAddress = lib.mkOption {
+                    type = lib.types.str;
+                    example = "aa:bb:cc:dd:ee:ff";
+                    description = "Client MAC address.";
+                  };
+                  ipAddress = lib.mkOption {
+                    type = lib.types.str;
+                    description = "Fixed address handed to this client (inside the VLAN's subnet, outside the pool).";
+                  };
+                };
+              }
+            );
+            default = { };
+            description = "Static DHCP leases; the attribute name becomes the client's hostname.";
+          };
+        };
+        allowWan = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Whether clients on this VLAN may reach the internet.";
+        };
+      };
+    };
+
+  proxyServiceModule = {
+    options = {
+      backend = lib.mkOption {
+        type = lib.types.str;
+        example = "https://127.0.0.1:8043";
+        description = "URL Caddy forwards to (internal/mesh address).";
+      };
+      insecureSkipVerify = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Skip TLS verification towards the backend (self-signed upstreams like Omada).";
+      };
+    };
+  };
+
+  wifiNetworkModule =
+    { name, ... }:
+    {
+      options = {
+        ssid = lib.mkOption {
+          type = lib.types.str;
+          default = name;
+          defaultText = lib.literalExpression "<attribute name>";
+          description = "SSID as advertised; defaults to the attribute name.";
+        };
+        vlan = lib.mkOption {
+          type = lib.types.str;
+          example = "lan";
+          description = "VLAN (by name) the clients of this SSID land in, like an untagged access port.";
+        };
+        security = lib.mkOption {
+          type = lib.types.enum [
+            "wpa3"
+            "wpa3-transition"
+            "wpa2"
+            "open"
+          ];
+          default = "wpa3-transition";
+          description = ''
+            - `wpa3`: WPA3-Personal (SAE) only.
+            - `wpa3-transition`: WPA3 with WPA2 fallback for older clients.
+            - `wpa2`: WPA2-PSK only, for legacy IoT devices.
+            - `open`: no encryption (captive/guest use; pair with an isolated VLAN).
+            Except for `open`, the passphrase is a vars prompt
+            (`wifi-<name>-passphrase`, entered at `clan vars generate`).
+          '';
+        };
+        hidden = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = "Do not advertise the SSID in beacons (clients must know it).";
+        };
+        isolateClients = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = "Keep wireless clients of this SSID from talking to each other (guest networks).";
+        };
+      };
+    };
+
+  wifiRadioModule = {
+    options = {
+      band = lib.mkOption {
+        type = lib.types.enum [
+          "2g"
+          "5g"
+          "6g"
+        ];
+        default = "2g";
+        description = "Frequency band of this radio; a dual-band card exposes one radio interface per band.";
+      };
+      channel = lib.mkOption {
+        type = lib.types.ints.unsigned;
+        default = 0;
+        description = "Channel; 0 lets hostapd pick one (ACS) — not every driver supports that.";
+      };
+      wifi6 = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Enable 802.11ax (WiFi 6) on this radio; WiFi 4/5 are always on.";
+      };
+      macAddress = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "aa:bb:cc:dd:ee:ff";
+        description = ''
+          Hardware address of the radio (facter.json / `ip link`). Needed when
+          the radio serves more than one network: hostapd wants a fixed BSSID
+          per extra network, derived from this address (locally administered
+          variants of its first octet).
+        '';
+      };
+      networks = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        example = [
+          "home"
+          "iot"
+        ];
+        description = "Networks (from `wifi.networks`) this radio broadcasts; at most four per radio.";
+      };
+    };
+  };
+in
+{
+  options = {
+    site = lib.mkOption {
+      type = lib.types.str;
+      description = "City code of the site, e.g. \"cnx\".";
+    };
+
+    siteId = lib.mkOption {
+      type = lib.types.ints.between 1 254;
+      description = "Site number; drives the 10.<siteId>.<vlan>.0/24 addressing.";
+    };
+
+    wan.interface = lib.mkOption {
+      type = lib.types.str;
+      description = "Physical WAN port the PPPoE session runs on.";
+    };
+
+    wan.vlanId = lib.mkOption {
+      type = lib.types.nullOr (lib.types.ints.between 1 4094);
+      default = null;
+      description = ''
+        802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
+        null for untagged PPPoE directly on the port. Unrelated to the LAN
+        VLANs — this tag exists only on the WAN port.
+      '';
+    };
+
+    wan.macAddress = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "aa:bb:cc:dd:ee:ff";
+      description = ''
+        Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
+        pinned (cloned from the old router). null keeps the hardware MAC.
+      '';
+    };
+
+    trunkPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "LAN ports carrying all VLANs tagged (incl. any 10G SFP+ ports).";
+    };
+
+    accessPorts = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = {
+        enp4s0 = "mgmt";
+      };
+      description = ''
+        Ports acting as untagged access ports on a single VLAN (port name ->
+        VLAN name). Frames are untagged on the wire; the bridge tags them with
+        the VLAN's PVID. Use for an always-available on-site mgmt port.
+      '';
+    };
+
+    stagingPort = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "enp3s0";
+      description = ''
+        Temporary DHCPv4-client uplink into the existing LAN while the box
+        runs alongside the router it replaces: gives it (and, NATed, the
+        allowWan VLANs) internet + mesh before the WAN port is cabled; once
+        the PPPoE session is up its default route wins, and the staging
+        route only carries traffic again if the session drops (PPPoE simply
+        retries until then). The port is in no VLAN zone; inbound, the
+        firewall admits only SSH on it. Do NOT connect the trunk ports to
+        the production switch while staging — Kea on the mgmt tag would
+        fight the old router's DHCP in one broadcast domain. Set to null at
+        cutover (and usually hand the port back to `trunkPorts`).
+      '';
+    };
+
+    vlans = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule vlanModule);
+      description = "VLANs served at this site; `mgmt` and `lan` are mandatory.";
+    };
+
+    mesh.subnet = lib.mkOption {
+      type = lib.types.str;
+      example = "fd12:3456:789a:bcde:f000::/88";
+      description = ''
+        IPv6 prefix of the admin mesh (the ZeroTier overlay; see
+        modules/mesh-hosts.nix). Admin SSH, metrics scrapes, iperf3 and the
+        Omada UI accept connections from it, and CrowdSec never bans it.
+      '';
+    };
+
+    omada.enable = lib.mkEnableOption "TP-Link Omada SDN controller (podman container)";
+
+    crowdsec.enable = lib.mkEnableOption "CrowdSec (sshd log parsing) with the nftables bouncer";
+
+    proxy = {
+      enable = lib.mkEnableOption "internal reverse proxy (Caddy, wildcard cert via DNS-01)";
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "example.net";
+        description = ''
+          Parent zone of the proxy names: services are served as
+          <name>.<site><siteId>.<domain> under a wildcard certificate.
+        '';
+      };
+
+      acme = {
+        nameserver = lib.mkOption {
+          type = lib.types.str;
+          example = "203.0.113.53";
+          description = ''
+            Authoritative nameserver of `domain` that accepts RFC 2136
+            updates for _acme-challenge.<site><siteId> with this gateway's
+            TSIG key (acme_<hostname with _>, secret from the shared
+            dns-acme-<hostname>-secret generator, see acme-secret.nix).
+          '';
+        };
+        email = lib.mkOption {
+          type = lib.types.str;
+          example = "postmaster@example.net";
+          description = "ACME account contact.";
+        };
+      };
+
+      services = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.submodule proxyServiceModule);
+        default = { };
+        description = "Proxied services; attr name becomes <name>.<site><siteId>.<domain>.";
+      };
+
+      allowVlans = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "mgmt"
+          "lan"
+        ];
+        description = "VLANs whose clients may reach the proxy (443, plus 80 for the redirect).";
+      };
+    };
+
+    wifi = {
+      enable = lib.mkEnableOption "a Wi-Fi access point on the router's own radios (hostapd)";
+
+      countryCode = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "TH";
+        description = "ISO 3166-1 country code for the regulatory domain; required when enabled.";
+      };
+
+      networks = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.submodule wifiNetworkModule);
+        default = { };
+        example = {
+          home.vlan = "lan";
+          things = {
+            vlan = "iot";
+            security = "wpa2";
+          };
+        };
+        description = ''
+          Wireless networks (SSIDs). Each one behaves like an untagged access
+          port on its VLAN; the radios below choose which to broadcast.
+        '';
+      };
+
+      radios = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.submodule wifiRadioModule);
+        default = { };
+        example = {
+          wlp5s0 = {
+            band = "5g";
+            channel = 36;
+            networks = [ "home" ];
+          };
+        };
+        description = "Wireless radios of the router (interface name -> config); at least one when enabled.";
+      };
+    };
+
+    speedtest.interval = lib.mkOption {
+      type = lib.types.str;
+      default = "hourly";
+      description = "systemd OnCalendar spec for the WAN speed test.";
+    };
+  };
+}
@@ -0,0 +1,22 @@
+# iperf3 server on every gateway, for throughput testing from any LAN segment
+# (e.g. validating AP/switch links: `iperf3 -c 10.<siteId>.<vlan>.1`) and from
+# admin machines over the mesh. Never reachable from the WAN (default-deny).
+{ settings }:
+{ lib, ... }:
+let
+  cfg = settings;
+  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
+in
+{
+  services.iperf3.enable = true;
+
+  networking.firewall.interfaces = lib.genAttrs vlanIfs (_: {
+    allowedTCPPorts = [ 5201 ];
+    allowedUDPPorts = [ 5201 ];
+  });
+
+  networking.firewall.extraInputRules = ''
+    ip6 saddr ${cfg.mesh.subnet} tcp dport 5201 accept comment "iperf3 over the mesh"
+    ip6 saddr ${cfg.mesh.subnet} udp dport 5201 accept comment "iperf3 over the mesh"
+  '';
+}
@@ -0,0 +1,22 @@
+# IPv6 on the PPPoE uplink: run networkd's DHCPv6 client on ppp0 to obtain a
+# delegated prefix; each vlan-* interface (network.nix) carves a /64 out of it
+# via DHCPPrefixDelegation and announces it to clients with SLAAC.
+{ lib, ... }:
+{
+  systemd.network.networks."45-ppp0" = {
+    matchConfig.Name = "ppp0";
+    networkConfig = {
+      DHCP = "ipv6";
+      # pppd owns the v4 address/route on this link; don't let networkd
+      # tear them down.
+      KeepConfiguration = "static";
+      # Default v6 route comes from the ISP's RA when they send one.
+      IPv6AcceptRA = true;
+    };
+    # Many PPPoE ISPs never send an RA with the M flag; solicit regardless.
+    dhcpV6Config.WithoutRA = "solicit";
+    linkConfig.RequiredForOnline = "no";
+  };
+
+  boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
+}
@@ -0,0 +1,170 @@
+# L2/L3 of the gateway: PPPoE WAN port (optionally on an ISP VLAN), a
+# VLAN-filtering bridge over the LAN ports, and one L3 interface per VLAN.
+{ settings }:
+{ lib, pkgs, ... }:
+let
+  cfg = settings;
+
+  vlanIf = name: "vlan-${name}";
+in
+{
+  assertions = [
+    {
+      assertion = cfg.vlans ? mgmt && cfg.vlans ? lan;
+      message = "router: every site must define the `mgmt` and `lan` VLANs.";
+    }
+    {
+      assertion = lib.all (v: cfg.vlans ? ${v}) (lib.attrValues cfg.accessPorts);
+      message = "router: every accessPorts value must name a defined VLAN.";
+    }
+    {
+      assertion = lib.all (p: !(cfg.accessPorts ? ${p})) cfg.trunkPorts;
+      message = "router: a port cannot be both a trunk and an access port.";
+    }
+    {
+      assertion =
+        cfg.stagingPort == null
+        || !(
+          cfg.stagingPort == cfg.wan.interface
+          || lib.elem cfg.stagingPort cfg.trunkPorts
+          || cfg.accessPorts ? ${cfg.stagingPort}
+        );
+      message = "router: stagingPort ${toString cfg.stagingPort} is also the WAN, a trunk or an access port.";
+    }
+  ];
+
+  # Router diagnostics toolkit: packets (tcpdump), path (mtr), link
+  # negotiation (ethtool), NAT state (conntrack), DNS (kdig), per-flow
+  # bandwidth (iftop), WAN throughput (librespeed-cli; iperf3 covers LAN).
+  environment.systemPackages = with pkgs; [
+    tcpdump
+    mtr
+    ethtool
+    conntrack-tools
+    knot-dns
+    iftop
+    librespeed-cli
+  ];
+
+  networking.useNetworkd = true;
+  networking.useDHCP = false;
+  systemd.network.enable = true;
+
+  systemd.network.netdevs = {
+    "20-br0" = {
+      netdevConfig = {
+        Name = "br0";
+        Kind = "bridge";
+      };
+      bridgeConfig.VLANFiltering = true;
+    };
+  }
+  // lib.optionalAttrs (cfg.wan.vlanId != null) {
+    "15-wan-vlan" = {
+      netdevConfig = {
+        Name = "wan-vlan";
+        Kind = "vlan";
+      };
+      vlanConfig.Id = cfg.wan.vlanId;
+    };
+  }
+  // lib.mapAttrs' (
+    name: vlan:
+    lib.nameValuePair "30-${vlanIf name}" {
+      netdevConfig = {
+        Name = vlanIf name;
+        Kind = "vlan";
+      };
+      vlanConfig.Id = vlan.id;
+    }
+  ) cfg.vlans;
+
+  systemd.network.networks =
+    let
+      taggedAll = lib.mapAttrsToList (_: vlan: { VLAN = vlan.id; }) cfg.vlans;
+    in
+    lib.optionalAttrs (cfg.stagingPort != null) {
+      # Staging uplink (see interface.nix): plain DHCPv4 client on a spare
+      # port, no bridge/VLAN membership, so the firewall treats it as untrusted.
+      "05-staging" = {
+        matchConfig.Name = cfg.stagingPort;
+        networkConfig.DHCP = "ipv4";
+      };
+    }
+    // {
+      # WAN port carries only the PPPoE session; no IP config of its own.
+      "10-wan" = {
+        matchConfig.Name = cfg.wan.interface;
+        networkConfig.LinkLocalAddressing = "no";
+        vlan = lib.optional (cfg.wan.vlanId != null) "wan-vlan";
+        linkConfig = {
+          RequiredForOnline = "carrier";
+        }
+        # The wan-vlan subinterface (and thus the PPPoE session) inherits
+        # the parent port's MAC, so spoofing here covers both cases.
+        // lib.optionalAttrs (cfg.wan.macAddress != null) {
+          MACAddress = cfg.wan.macAddress;
+        };
+      };
+    }
+    // lib.optionalAttrs (cfg.wan.vlanId != null) {
+      # The ISP-side VLAN subinterface pppd dials on (e.g. AIS tags PPPoE).
+      "15-wan-vlan" = {
+        matchConfig.Name = "wan-vlan";
+        networkConfig.LinkLocalAddressing = "no";
+        linkConfig.RequiredForOnline = "no";
+      };
+    }
+    // {
+      # The bridge itself is L2-only; L3 lives on the vlan-* interfaces,
+      # which hang off the bridge (tagged on the bridge "self" port).
+      "20-br0" = {
+        matchConfig.Name = "br0";
+        networkConfig.LinkLocalAddressing = "no";
+        vlan = lib.mapAttrsToList (name: _: vlanIf name) cfg.vlans;
+        bridgeVLANs = taggedAll;
+        linkConfig.RequiredForOnline = "no";
+      };
+    }
+    // lib.listToAttrs (
+      map (port: {
+        name = "25-trunk-${port}";
+        value = {
+          matchConfig.Name = port;
+          networkConfig.Bridge = "br0";
+          bridgeVLANs = taggedAll;
+          linkConfig.RequiredForOnline = "no";
+        };
+      }) cfg.trunkPorts
+    )
+    // lib.mapAttrs' (
+      port: vlanName:
+      lib.nameValuePair "25-access-${port}" {
+        matchConfig.Name = port;
+        networkConfig.Bridge = "br0";
+        bridgeVLANs = [
+          {
+            VLAN = cfg.vlans.${vlanName}.id;
+            PVID = cfg.vlans.${vlanName}.id;
+            EgressUntagged = cfg.vlans.${vlanName}.id;
+          }
+        ];
+        linkConfig.RequiredForOnline = "no";
+      }
+    ) cfg.accessPorts
+    // lib.mapAttrs' (
+      name: vlan:
+      lib.nameValuePair "40-${vlanIf name}" {
+        matchConfig.Name = vlanIf name;
+        address = [ "${vlan.address}/${toString vlan.prefixLength}" ];
+        networkConfig = {
+          IPv6AcceptRA = false;
+          # Announce a /64 carved from the DHCPv6-PD prefix on ppp0 (SLAAC).
+          IPv6SendRA = true;
+          DHCPPrefixDelegation = true;
+        };
+        dhcpPrefixDelegationConfig.SubnetId = "auto";
+        linkConfig.RequiredForOnline = "no";
+      }
+    ) cfg.vlans;
+}
@@ -3,20 +3,13 @@
 # the de-facto standard image). Host networking because device adoption relies
 # on L2 broadcast discovery (UDP 29810) on the mgmt VLAN; the default-deny
 # input firewall keeps its ports unreachable from WAN and non-mgmt VLANs.
-{
-  config,
-  lib,
-  ...
-}:
+{ settings }:
+{ config, lib, ... }:
 let
-  cfg = config.cnx.router;
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  cfg = settings;
 in
 {
-  options.cnx.router.omada.enable =
-    lib.mkEnableOption "TP-Link Omada SDN controller (podman container)";
-
-  config = lib.mkIf (cfg.enable && cfg.omada.enable) {
+  config = lib.mkIf cfg.omada.enable {
    virtualisation.podman.enable = true;
    virtualisation.oci-containers = {
      backend = "podman";
@@ -33,7 +26,7 @@ in

    # Admin UI (8043) also reachable over the mesh, like Grafana on control.
    networking.firewall.extraInputRules = ''
-      ip6 saddr ${mesh.subnet} tcp dport 8043 accept comment "omada ui over the mesh"
+      ip6 saddr ${cfg.mesh.subnet} tcp dport 8043 accept comment "omada ui over the mesh"
    '';

    # Controller state (adopted devices, site config, cert) — declared as clan
@@ -0,0 +1,67 @@
+# PPPoE WAN session. ISP credentials are entered once at `clan vars generate`
+# (prompts). Both are secret — AIS often uses the same string for username and
+# password — so neither may land in the Nix store: pppd reads the username from
+# an included secret options file and the password from chap/pap-secrets.
+{ settings }:
+{ config, ... }:
+let
+  cfg = settings;
+  creds = config.clan.core.vars.generators.pppoe-credentials;
+  # Interface pppd dials on: the WAN port itself, or its ISP VLAN (network.nix).
+  pppInterface = if cfg.wan.vlanId == null then cfg.wan.interface else "wan-vlan";
+in
+{
+  clan.core.vars.generators.pppoe-credentials = {
+    prompts.username = {
+      description = "PPPoE username (from the ISP)";
+      type = "hidden";
+    };
+    prompts.password = {
+      description = "PPPoE password (from the ISP)";
+      type = "hidden";
+    };
+    files."user-opts".secret = true;
+    files."chap-secrets".secret = true;
+    script = ''
+      user="$(cat "$prompts"/username)"
+      pass="$(cat "$prompts"/password)"
+      printf 'user "%s"\n' "$user" > "$out"/user-opts
+      printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/chap-secrets
+    '';
+  };
+
+  # defaultroute-metric 0: pppd refuses `defaultroute` while any other
+  # default route exists (e.g. the staging uplink's DHCP route, metric 1024,
+  # network.nix) unless given a metric; with 0 it only checks for a metric-0
+  # route, installs its own as the preferred exit, and removes it again on
+  # hangup so the staging route takes over.
+  services.pppd = {
+    enable = true;
+    peers.wan = {
+      autostart = true;
+      config = ''
+        plugin pppoe.so ${pppInterface}
+        ifname ppp0
+        file ${creds.files."user-opts".path}
+        noipdefault
+        defaultroute
+        defaultroute-metric 0
+        noauth
+        hide-password
+        persist
+        maxfail 0
+        holdoff 5
+        lcp-echo-interval 15
+        lcp-echo-failure 3
+        +ipv6
+        mtu 1492
+        mru 1492
+      '';
+    };
+  };
+
+  # pppd looks up the password for `user` in these files at dial time; both
+  # point at the same generated `"<user>" * "<pass>"` line (PAP and CHAP).
+  environment.etc."ppp/chap-secrets".source = creds.files."chap-secrets".path;
+  environment.etc."ppp/pap-secrets".source = creds.files."chap-secrets".path;
+}
@@ -0,0 +1,104 @@
+# Internal reverse proxy for the gateway: Caddy terminates TLS for
+# <service>.<site><siteId>.<proxy.domain> (e.g. omada.cnx1.cnx.network) and
+# forwards to backends by their internal address. The cert is a real Let's
+# Encrypt wildcard (*.<site><siteId>.<domain>) obtained via ACME DNS-01
+# against proxy.acme.nameserver with a gateway-scoped TSIG key, so browsers
+# trust it without any CA install; the names only *resolve* internally —
+# Blocky answers them with the router's LAN address, the public zone never
+# carries them.
+#
+# The TSIG secret is the shared dns-acme-<hostname>-secret generator
+# (acme-secret.nix, declared here via default.nix); the nameserver machine
+# must declare the same generator and load the key (this fleet: ns1).
+{ settings }:
+{ config, lib, ... }:
+let
+  cfg = settings;
+  hostname = config.networking.hostName;
+  tsigKey = "acme_${lib.replaceStrings [ "-" ] [ "_" ] hostname}";
+  certName = "${cfg.site}${toString cfg.siteId}.${cfg.proxy.domain}";
+  nameserver = "${cfg.proxy.acme.nameserver}:53";
+in
+{
+  config = lib.mkIf cfg.proxy.enable {
+    assertions = [
+      {
+        assertion = lib.all (v: cfg.vlans ? ${v}) cfg.proxy.allowVlans;
+        message = "router: proxy.allowVlans must name VLANs defined in vlans.";
+      }
+    ];
+
+    # Render the shared per-gateway TSIG secret into a lego rfc2136 env file,
+    # scoped on the nameserver to _acme-challenge.<site><siteId> TXT records.
+    clan.core.vars.generators."dns-acme-${hostname}-rfc2136" = {
+      files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
+      dependencies = [ "dns-acme-${hostname}-secret" ];
+      script = ''
+        printf 'RFC2136_NAMESERVER=${nameserver}\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=${tsigKey}\nRFC2136_TSIG_SECRET=%s\n' \
+          "$(cat "$in"/dns-acme-${hostname}-secret/secret)" > "$out"/rfc2136.env
+      '';
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = cfg.proxy.acme.email;
+      # One wildcard for every proxied service; DNS-01, so issuance works
+      # behind PPPoE with no inbound reachability at all.
+      certs.${certName} = {
+        domain = "*.${certName}";
+        dnsProvider = "rfc2136";
+        environmentFile =
+          config.clan.core.vars.generators."dns-acme-${hostname}-rfc2136".files."rfc2136.env".path;
+        # Only that nameserver accepts this key's UPDATE; check propagation
+        # against it directly rather than a public resolver.
+        dnsResolver = nameserver;
+        # Caddy reads the cert from explicit file paths (tls directive below),
+        # so it won't notice a renewal on its own.
+        reloadServices = [ "caddy.service" ];
+      };
+    };
+
+    # The lego-issued cert is owned group=acme; Caddy needs to read the key.
+    users.users.caddy.extraGroups = [ "acme" ];
+
+    # The explicit `tls cert key` points Caddy at the wildcard cert and disables
+    # its automatic ACME, so no extra issuance happens.
+    services.caddy = {
+      enable = true;
+      virtualHosts = lib.mapAttrs' (
+        name: svc:
+        lib.nameValuePair "${name}.${certName}" {
+          extraConfig = ''
+            tls /var/lib/acme/${certName}/cert.pem /var/lib/acme/${certName}/key.pem
+            ${
+              if svc.insecureSkipVerify then
+                ''
+                  reverse_proxy ${svc.backend} {
+                    transport http {
+                      tls_insecure_skip_verify
+                    }
+                  }''
+              else
+                "reverse_proxy ${svc.backend}"
+            }
+          '';
+        }
+      ) cfg.proxy.services;
+    };
+
+    # Blocky answers <anything>.<site><siteId>.cnx.network (customDNS covers
+    # subdomains) with the router's LAN address — clients on any allowed VLAN
+    # reach that address through the router's input path.
+    services.blocky.settings.customDNS.mapping.${certName} = cfg.vlans.lan.address;
+
+    # 443 serves the proxy; 80 only carries Caddy's automatic HTTP->HTTPS
+    # redirect. mgmt is already a trusted interface; listed anyway so shrinking
+    # trustedInterfaces later doesn't silently break the proxy.
+    networking.firewall.interfaces = lib.genAttrs (map (v: "vlan-${v}") cfg.proxy.allowVlans) (_: {
+      allowedTCPPorts = [
+        80
+        443
+      ];
+    });
+  };
+}
@@ -0,0 +1,55 @@
+# Periodic WAN speed test so ISP degradation shows up as a trend instead of a
+# complaint. A timer runs librespeed-cli and writes the results as Prometheus
+# metrics into node_exporter's textfile collector — they ride the existing
+# 9100 scrape to VictoriaMetrics, where alerts.nix compares each run against
+# the link's own 7-day median (no per-site threshold to maintain).
+{ settings }:
+{ pkgs, ... }:
+let
+  cfg = settings;
+  textfileDir = "/var/lib/speedtest";
+in
+{
+  services.prometheus.exporters.node.extraFlags = [
+    "--collector.textfile.directory=${textfileDir}"
+  ];
+
+  systemd.services.speedtest = {
+    description = "WAN speed test to Prometheus textfile metrics";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    path = [
+      pkgs.librespeed-cli
+      pkgs.jq
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      StateDirectory = "speedtest";
+      # One test at boot would race PPPoE and log a spurious failure.
+      ExecCondition = "${pkgs.iproute2}/bin/ip link show ppp0";
+    };
+    script = ''
+      tmp="${textfileDir}/.speedtest.prom.tmp"
+      if result=$(librespeed-cli --json); then
+        jq -r '.[0]
+          | "speedtest_download_mbps \(.download)",
+            "speedtest_upload_mbps \(.upload)",
+            "speedtest_ping_ms \(.ping)",
+            "speedtest_jitter_ms \(.jitter)",
+            "speedtest_success 1"' <<<"$result" > "$tmp"
+      else
+        echo "speedtest_success 0" > "$tmp"
+      fi
+      mv "$tmp" "${textfileDir}/speedtest.prom"
+    '';
+  };
+
+  systemd.timers.speedtest = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = cfg.speedtest.interval;
+      RandomizedDelaySec = "10m";
+      Persistent = true;
+    };
+  };
+}
@@ -0,0 +1,359 @@
+# End-to-end VM test of the router service: a PPPoE access concentrator plays
+# the ISP on the WAN port, a trunk carries tagged lan/iot VLANs to `client`,
+# an untagged access port carries mgmt to `admin`, and `oldlan` is the DHCP
+# network the box is staged in before cutover.
+#
+#   isp ---(vlan 1: PPPoE)--- wan [gw] trunk ---(vlan 2: tagged 20/40)--- client
+#                                    access --(vlan 3: untagged mgmt)--- admin
+#                                    staging -(vlan 4: DHCP client)--- oldlan
+#
+# What is proven: PPPoE dial-in with the vars-provided credentials, bridge
+# VLAN tagging/untagging, Kea leases and reservations per VLAN, Blocky
+# answering on the VLAN with the blocklist active, NAT to the WAN, the
+# firewall trust model (allowWan, mgmt-only SSH, no inter-VLAN forwarding),
+# and the staging uplink as NATed fallback exit behind ppp0.
+{ pkgs, lib, ... }:
+let
+  # The vars mock answers every prompt with "mock-prompt-value-<name>"; the
+  # ISP side must accept exactly those.
+  chapSecrets = ''"mock-prompt-value-username" * "mock-prompt-value-password" *'';
+  ispAddress = "192.0.2.1";
+
+  clientMac = "02:00:00:00:00:20";
+  clientAddress = "10.9.20.50";
+  adminMac = "02:00:00:00:00:10";
+  adminAddress = "10.9.10.50";
+  oldlanAddress = "192.168.88.1";
+  # Only reachable through oldlan's router role, i.e. via gw's staging
+  # default route (metric 1024); ppp0's metric-0 default must win while up.
+  beyondStaging = "203.0.113.1";
+in
+{
+  name = "router";
+
+  clan = {
+    directory = ./.;
+    # Bridges, VLAN netdevs, PPPoE and nftables need a real kernel.
+    test.useContainers = false;
+    inventory = {
+      # Every node is a clan machine (the test framework's defaults require
+      # it); only gw gets the router role.
+      machines = {
+        gw = { };
+        isp = { };
+        client = { };
+        admin = { };
+        oldlan = { };
+      };
+
+      instances.router = {
+        module.name = "router";
+        module.input = "self";
+        roles.default.machines.gw.settings = {
+          site = "tst";
+          siteId = 9;
+          mesh.subnet = "fd00:7e57:c1a1:c0de::/64";
+          wan.interface = "wan";
+          trunkPorts = [ "trunk" ];
+          accessPorts.access = "mgmt";
+          stagingPort = "staging";
+          vlans = {
+            mgmt = {
+              id = 10;
+              dhcp.reservations.admin = {
+                hwAddress = adminMac;
+                ipAddress = adminAddress;
+              };
+            };
+            lan = {
+              id = 20;
+              dhcp.reservations.client = {
+                hwAddress = clientMac;
+                ipAddress = clientAddress;
+              };
+            };
+            iot = {
+              id = 40;
+              allowWan = false;
+            };
+          };
+          # Access point on the simulated radio wlan0 (mac80211_hwsim, address
+          # 02:00:00:00:00:00): two SSIDs, one per VLAN.
+          wifi = {
+            enable = true;
+            countryCode = "US";
+            networks = {
+              home.vlan = "lan";
+              things = {
+                vlan = "iot";
+                security = "wpa2";
+                hidden = true;
+                isolateClients = true;
+              };
+            };
+            radios.wlan0 = {
+              channel = 6;
+              macAddress = "02:00:00:00:00:00";
+              networks = [
+                "home"
+                "things"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+
+  nodes = {
+    gw = {
+      virtualisation.interfaces = {
+        wan = {
+          vlan = 1;
+          assignIP = false;
+        };
+        trunk = {
+          vlan = 2;
+          assignIP = false;
+        };
+        access = {
+          vlan = 3;
+          assignIP = false;
+        };
+        staging = {
+          vlan = 4;
+          assignIP = false;
+        };
+      };
+
+      # Something must listen on 22 for the mgmt-only SSH rule to be observable
+      # (a refused and a dropped connection look the same to the client).
+      services.openssh.enable = true;
+
+      # The sandbox has no internet: serve the blocklist from a local file
+      # instead of GitHub. (CrowdSec, whose hub sync needs the network too,
+      # is opt-in and stays off.)
+      services.blocky.settings.blocking.denylists.ads = lib.mkForce [
+        (toString (pkgs.writeText "ads.hosts" "0.0.0.0 ads.example.com\n"))
+      ];
+
+      # Two simulated radios: wlan0 is the AP (settings above), wlan1 plays a
+      # wireless client. It lives in its own network namespace, like the
+      # separate host it stands in for — otherwise its lease would add a
+      # second 10.9.20.0/24 route to the router's own table. Its DHCP lease
+      # must come from Kea on the SSID's VLAN: wlan1 -> air -> wlan0 -> br0 ->
+      # vlan-lan. The mock passphrase is what the vars mock fed into the
+      # wifi-home-passphrase generator.
+      boot.kernelModules = [ "mac80211_hwsim" ];
+      systemd.services.wifi-station = {
+        wantedBy = [ "multi-user.target" ];
+        # No BindsTo: the device unit vanishes once wlan1 moves into the netns.
+        after = [ "sys-subsystem-net-devices-wlan1.device" ];
+        path = [
+          pkgs.iproute2
+          pkgs.iw
+        ];
+        preStart = ''
+          ip netns add sta
+          iw phy phy1 set netns name sta
+          ip netns exec sta ip link set lo up
+          mkdir -p /run/wpa_supplicant/client # nixpkgs' wpa_cli keeps its sockets here
+        '';
+        serviceConfig.ExecStart =
+          "${pkgs.iproute2}/bin/ip netns exec sta ${pkgs.wpa_supplicant}/bin/wpa_supplicant -i wlan1 -c "
+          + pkgs.writeText "sta.conf" ''
+            ctrl_interface=/run/wpa_supplicant/control
+            network={
+              ssid="home"
+              key_mgmt=SAE
+              sae_password="mock-prompt-value-passphrase"
+              ieee80211w=2
+              scan_freq=2437
+            }
+          '';
+      };
+      environment.systemPackages = [
+        pkgs.wpa_supplicant
+        (pkgs.writeShellScriptBin "sta-dhcp" ''
+          # One DHCP round on the station, applying the offered address.
+          exec ${pkgs.iproute2}/bin/ip netns exec sta ${pkgs.busybox}/bin/udhcpc -i wlan1 -n -q -f \
+            -s ${pkgs.writeShellScript "udhcpc-apply" ''
+              case "$1" in
+                bound|renew) ${pkgs.iproute2}/bin/ip addr replace "$ip/$mask" dev "$interface" ;;
+              esac
+            ''}
+        '')
+      ];
+    };
+
+    isp = {
+      virtualisation.interfaces.wan = {
+        vlan = 1;
+        assignIP = false;
+      };
+      # PPPoE access concentrator: one session, peer gets 192.0.2.10.
+      systemd.services.pppoe-server = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig.ExecStart =
+          "${pkgs.rp-pppoe}/sbin/pppoe-server -F -O /etc/ppp/pppoe-server-options"
+          + " -q ${pkgs.ppp}/sbin/pppd -I wan -L ${ispAddress} -R 192.0.2.10";
+      };
+      environment.etc = {
+        "ppp/pppoe-server-options".text = ''
+          plugin pppoe.so
+          require-chap
+          lcp-echo-interval 10
+          lcp-echo-failure 2
+          nobsdcomp
+          noccp
+          novj
+        '';
+        "ppp/chap-secrets" = {
+          text = chapSecrets;
+          mode = "0640";
+        };
+      };
+    };
+
+    client = {
+      virtualisation.interfaces.trunk = {
+        vlan = 2;
+        assignIP = false;
+      };
+      networking.useDHCP = false;
+      networking.vlans = {
+        lan0 = {
+          id = 20;
+          interface = "trunk";
+        };
+        iot0 = {
+          id = 40;
+          interface = "trunk";
+        };
+      };
+      networking.interfaces.lan0 = {
+        useDHCP = true;
+        macAddress = clientMac;
+      };
+      networking.interfaces.iot0.useDHCP = true;
+      # Dual-homed on purpose (lan + iot). Both leases bring a default route:
+      # prefer lan0 so replies to other VLANs and the WAN leave where the
+      # router expects them (its rp-filter would drop them on vlan-iot), and
+      # loosen this client's own rp-filter so a WAN reply on iot0 would be
+      # seen — the negative allowWan check must fail at the router, not here.
+      systemd.network.networks."40-iot0".dhcpV4Config.RouteMetric = 2048;
+      networking.firewall.checkReversePath = "loose";
+      environment.systemPackages = [
+        pkgs.dnsutils
+        pkgs.netcat
+      ];
+    };
+
+    admin = {
+      virtualisation.interfaces.access = {
+        vlan = 3;
+        assignIP = false;
+      };
+      networking.useDHCP = false;
+      networking.interfaces.access = {
+        useDHCP = true;
+        macAddress = adminMac;
+      };
+      environment.systemPackages = [ pkgs.netcat ];
+    };
+
+    # The LAN the box is staged in: a DHCP server handing gw its uplink
+    # lease, plus an address that is only reachable via that uplink's
+    # default route. No route back to 10.9.0.0/16: replies only reach the
+    # clients if gw masquerades them.
+    oldlan = {
+      virtualisation.interfaces.staging = {
+        vlan = 4;
+        assignIP = false;
+      };
+      networking.useDHCP = false;
+      networking.useNetworkd = true;
+      systemd.network.networks."10-staging" = {
+        matchConfig.Name = "staging";
+        address = [
+          "${oldlanAddress}/24"
+          "${beyondStaging}/32"
+        ];
+        networkConfig.DHCPServer = true;
+        dhcpServerConfig = {
+          PoolOffset = 100;
+          PoolSize = 50;
+        };
+      };
+      networking.firewall.allowedUDPPorts = [ 67 ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("PPPoE session comes up with the vars credentials"):
+        gw.wait_for_unit("pppd-wan.service")
+        gw.wait_until_succeeds("ping -c1 -W1 ${ispAddress}")
+
+    with subtest("DHCP hands out reserved leases per VLAN"):
+        gw.wait_for_unit("kea-dhcp4-server.service")
+        client.wait_until_succeeds("ip -4 addr show lan0 | grep -q 'inet ${clientAddress}/24'")
+        client.wait_until_succeeds("ip -4 addr show iot0 | grep -q 'inet 10.9.40.1[0-9][0-9]/24'")
+        admin.wait_until_succeeds("ip -4 addr show access | grep -q 'inet ${adminAddress}/24'")
+
+    with subtest("Blocky serves the VLAN and blocks the denylist"):
+        gw.wait_for_unit("blocky.service")
+        answer = client.wait_until_succeeds("dig +short +time=2 @10.9.20.1 ads.example.com")
+        assert answer.strip() == "0.0.0.0", f"expected blocked answer, got: {answer!r}"
+
+    with subtest("NAT to the WAN only for VLANs with allowWan"):
+        client.wait_until_succeeds("ping -c1 -W1 -I lan0 ${ispAddress}")
+        # iot has a route to the WAN; the router is what refuses to forward.
+        client.succeed("ip route show dev iot0 | grep -q ^default")
+        client.fail("ping -c1 -W2 -I iot0 ${ispAddress}")
+
+    with subtest("mgmt reaches other VLANs, other VLANs do not"):
+        admin.succeed("ping -c1 -W2 ${clientAddress}")
+        client.fail("ping -c1 -W2 -I lan0 ${adminAddress}")
+
+    with subtest("SSH on the router only from mgmt"):
+        gw.wait_for_open_port(22)
+        admin.succeed("nc -z -w2 10.9.10.1 22")
+        client.fail("nc -z -w2 10.9.20.1 22")
+
+    with subtest("Wireless SSIDs are bridge access ports of their VLAN"):
+        gw.wait_for_unit("hostapd.service")
+        # Second SSID: derived BSSID, hidden, bridged into the iot VLAN.
+        gw.wait_until_succeeds("ip link show wlan0-1 | grep -q '06:00:00:00:00:00'")
+        gw.wait_until_succeeds("bridge vlan show dev wlan0-1 | grep -q '40 PVID Egress Untagged'")
+        gw.succeed("hostapd_cli -i wlan0-1 get_config | grep -q '^ssid=things'")
+        # The second BSS section of the rendered config carries hidden + isolation.
+        things = gw.succeed("sed -n '/^bss=wlan0-1/,$p' /run/hostapd/wlan0.hostapd.conf")
+        assert "ignore_broadcast_ssid=1" in things and "ap_isolate=1" in things, things
+        assert "sae_password=mock-prompt-value-passphrase" not in things, "wpa2 SSID must not carry SAE entries"
+        # A WPA3 (SAE) station on the first SSID authenticates with the vars
+        # passphrase and gets its lease from Kea on the lan VLAN, through the bridge.
+        gw.wait_for_unit("wifi-station.service")
+        gw.wait_until_succeeds("ip netns exec sta wpa_cli -i wlan1 status | grep -q wpa_state=COMPLETED")
+        gw.succeed("timeout 60 sta-dhcp")
+        gw.succeed("ip netns exec sta ip -4 addr show wlan1 | grep -q 'inet 10.9.20.1[0-9][0-9]/24'")
+
+    with subtest("Staging uplink: NATed exit for allowWan VLANs, behind ppp0 while it is up"):
+        gw.wait_until_succeeds("ip -4 route show default dev staging | grep -q 'via ${oldlanAddress}'")
+        # pppd installs its default route despite the DHCP one (defaultroute-metric 0).
+        gw.succeed("ip route get ${beyondStaging} | grep -q 'dev ppp0'")
+        # On-link old-LAN hosts are reached through the staging port regardless.
+        client.succeed("ping -c1 -W2 -I lan0 ${oldlanAddress}")
+        client.fail("ping -c1 -W2 -I iot0 ${oldlanAddress}")
+        # ppp0 down: the staging route carries the WAN traffic, allowWan still holds.
+        gw.systemctl("stop pppd-wan.service")
+        gw.wait_until_succeeds("ip route get ${beyondStaging} | grep -q 'dev staging'")
+        client.succeed("ping -c1 -W2 -I lan0 ${beyondStaging}")
+        client.fail("ping -c1 -W2 -I iot0 ${beyondStaging}")
+        # ppp0 back: preferred again.
+        gw.systemctl("start pppd-wan.service")
+        gw.wait_until_succeeds("ip route get ${beyondStaging} | grep -q 'dev ppp0'")
+  '';
+}
@@ -0,0 +1,207 @@
+# Wireless access point on the router itself (hostapd). Every SSID is a BSS
+# interface that joins the VLAN bridge as an untagged access port of its VLAN,
+# so wireless clients get exactly the same DHCP/DNS/firewall treatment as a
+# wired port in that VLAN. Passphrases are vars prompts, never in the store.
+#
+# hostapd names BSS interfaces <radio>, <radio>-1, <radio>-2 ... and wants a
+# fixed BSSID for every extra one; they are derived from the radio's hardware
+# address by setting the locally-administered bit and flipping bits 2-3 of
+# the first octet per index (02 -> 06, 0a, 0e), which never collides with the
+# radio's own address.
+{ settings }:
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = settings;
+  wifi = cfg.wifi;
+
+  bssIf = radio: i: if i == 0 then radio else "${radio}-${toString i}";
+
+  hexDigit =
+    c:
+    {
+      "0" = 0;
+      "1" = 1;
+      "2" = 2;
+      "3" = 3;
+      "4" = 4;
+      "5" = 5;
+      "6" = 6;
+      "7" = 7;
+      "8" = 8;
+      "9" = 9;
+      a = 10;
+      b = 11;
+      c = 12;
+      d = 13;
+      e = 14;
+      f = 15;
+    }
+    .${lib.toLower c};
+  octetToInt = s: 16 * hexDigit (builtins.substring 0 1 s) + hexDigit (builtins.substring 1 1 s);
+  intToOctet = n: lib.toLower (lib.fixedWidthString 2 "0" (lib.toHexString n));
+  deriveBssid =
+    mac: i:
+    let
+      octets = lib.splitString ":" mac;
+      first = builtins.bitXor (builtins.bitOr (octetToInt (builtins.head octets)) 2) (i * 4);
+    in
+    lib.concatStringsSep ":" ([ (intToOctet first) ] ++ builtins.tail octets);
+
+  # Every BSS of every radio, flattened.
+  bsses = lib.concatLists (
+    lib.mapAttrsToList (
+      radio: r:
+      lib.imap0 (i: name: {
+        inherit radio name;
+        index = i;
+        iface = bssIf radio i;
+        net = wifi.networks.${name} or null;
+      }) r.networks
+    ) wifi.radios
+  );
+
+  referenced = lib.unique (map (b: b.name) bsses);
+  secured = lib.filter (name: wifi.networks.${name}.security != "open") (
+    lib.filter (name: wifi.networks ? ${name}) referenced
+  );
+  passphraseFile =
+    name: config.clan.core.vars.generators."wifi-${name}-passphrase".files.passphrase.path;
+
+  authentication =
+    name: net:
+    {
+      wpa3 = {
+        mode = "wpa3-sae";
+        saePasswordsFile = passphraseFile name;
+      };
+      wpa3-transition = {
+        mode = "wpa3-sae-transition";
+        saePasswordsFile = passphraseFile name;
+        wpaPasswordFile = passphraseFile name;
+      };
+      wpa2 = {
+        mode = "wpa2-sha1";
+        wpaPasswordFile = passphraseFile name;
+      };
+      open.mode = "none";
+    }
+    .${net.security};
+in
+{
+  config = lib.mkIf wifi.enable {
+    assertions = [
+      {
+        assertion = wifi.radios != { };
+        message = "router: wifi.enable needs at least one radio in wifi.radios.";
+      }
+      {
+        assertion = wifi.countryCode != null;
+        message = "router: wifi.countryCode is required when wifi.enable is set (regulatory domain).";
+      }
+      {
+        assertion = lib.all (b: b.net != null) bsses;
+        message = "router: every wifi.radios.<radio>.networks entry must name a network in wifi.networks.";
+      }
+      {
+        assertion = lib.all (b: b.net == null || cfg.vlans ? ${b.net.vlan}) bsses;
+        message = "router: every wifi.networks.<name>.vlan must name a VLAN in vlans.";
+      }
+      {
+        assertion = lib.all (r: lib.length r.networks <= 4) (lib.attrValues wifi.radios);
+        message = "router: a radio can broadcast at most four networks.";
+      }
+      {
+        assertion = lib.all (r: lib.length r.networks <= 1 || r.macAddress != null) (
+          lib.attrValues wifi.radios
+        );
+        message = "router: wifi.radios.<radio>.macAddress is required for radios broadcasting more than one network.";
+      }
+      {
+        assertion =
+          !config.networking.wireless.enable
+          && !config.networking.wireless.iwd.enable
+          && !config.networking.networkmanager.enable;
+        message = "router: wifi.enable needs the radios for hostapd; disable networking.wireless (wpa_supplicant), iwd and NetworkManager.";
+      }
+    ];
+
+    # Regulatory database for the kernel, so countryCode actually applies.
+    hardware.wirelessRegulatoryDatabase = true;
+
+    clan.core.vars.generators = lib.genAttrs (map (name: "wifi-${name}-passphrase") secured) (
+      gen:
+      let
+        name = lib.removeSuffix "-passphrase" (lib.removePrefix "wifi-" gen);
+      in
+      {
+        prompts.passphrase = {
+          description = "Wi-Fi passphrase for SSID \"${wifi.networks.${name}.ssid}\" (8-63 ASCII characters)";
+          type = "hidden";
+        };
+        files.passphrase.secret = true;
+        # No trailing newline: hostapd turns every line of the file into a
+        # sae_password entry, and an empty one wipes the list.
+        script = ''printf '%s' "$(cat "$prompts"/passphrase)" > "$out"/passphrase'';
+      }
+    );
+
+    services.hostapd = {
+      enable = true;
+      radios = lib.mapAttrs (radio: r: {
+        inherit (r) band channel;
+        inherit (wifi) countryCode;
+        wifi6.enable = r.wifi6;
+        networks = lib.listToAttrs (
+          map (
+            b:
+            lib.nameValuePair b.iface (
+              {
+                inherit (b.net) ssid;
+                ignoreBroadcastSsid = if b.net.hidden then "empty" else "disabled";
+                apIsolate = b.net.isolateClients;
+                authentication = authentication b.name b.net;
+              }
+              // lib.optionalAttrs (lib.length r.networks > 1) {
+                bssid = if b.index == 0 then r.macAddress else deriveBssid r.macAddress b.index;
+              }
+            )
+          ) (lib.filter (b: b.radio == radio) bsses)
+        );
+      }) wifi.radios;
+    };
+
+    # Each BSS is an untagged access port of its VLAN on br0 (cf. accessPorts
+    # in network.nix). The kernel refuses to bridge a wireless interface in
+    # station mode (IFF_DONT_BRIDGE), and a failed enslave parks the link in
+    # networkd's `failed` state for good: networkd only re-evaluates a link
+    # when its matching .network file changes. So match on the AP interface
+    # type as well as the name: the radio's initial station-mode netdev
+    # matches nothing (unmanaged), and once hostapd switches it to AP and
+    # brings the carrier up, networkd matches this file for the first time
+    # and enslaves it. Extra BSSes are created by hostapd in AP mode already.
+    systemd.network.networks = lib.listToAttrs (
+      map (
+        b:
+        lib.nameValuePair "27-wifi-${b.iface}" {
+          matchConfig = {
+            Name = b.iface;
+            WLANInterfaceType = "ap";
+          };
+          networkConfig.Bridge = "br0";
+          bridgeVLANs = [
+            {
+              VLAN = cfg.vlans.${b.net.vlan}.id;
+              PVID = cfg.vlans.${b.net.vlan}.id;
+              EgressUntagged = cfg.vlans.${b.net.vlan}.id;
+            }
+          ];
+          linkConfig.RequiredForOnline = "no";
+        }
+      ) bsses
+    );
+  };
+}
@@ -6,7 +6,10 @@
 }:
 let
  # ZeroTier addresses — zone transfers run over the mesh, not the public net.
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  mesh = import ../mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  ns1zt = mesh.hosts.ns1;
  ns2zt = mesh.hosts.ns2;
 in
@@ -4,4 +4,5 @@
  "cnx.network"
  "buildfor.life"
  "cnx.email"
+  "newedge.house"
 ]
@@ -0,0 +1,13 @@
+$ORIGIN newedge.house.
+$TTL 3600
+
+@   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
+        2026061401  ; serial   (ignored: Knot auto-assigns a dateserial on signing)
+        3600        ; refresh
+        900         ; retry
+        604800      ; expire
+        300 )       ; negative-cache TTL
+
+; Served by the same nameservers (out-of-bailiwick, no glue needed here).
+@       IN  NS      ns1.cnx.network.
+@       IN  NS      ns2.cnx.network.
@@ -8,7 +8,10 @@
  ...
 }:
 let
-  mesh = import ./mesh-hosts.nix { inherit config lib; };
+  mesh = import ./mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  port = 8080;

  site = pkgs.stdenvNoCC.mkDerivation {
@@ -8,10 +8,10 @@
 # vars/shared/zerotier-network-<instance>/network-id (instance = "zerotier",
 # the inventory.instances.zerotier name in clan.nix). This keeps the mesh map in
 # lockstep with the actual identities: regenerate or re-key a node and its
-# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
-{ config, lib }:
+# address here follows automatically. `dir` is the clan directory: from NixOS
+# `config.clan.core.settings.directory`, from clan.nix `config.directory`.
+{ dir, lib }:
 let
-  dir = config.clan.core.settings.directory;
  instance = "zerotier";

  readIp =
@@ -59,6 +59,31 @@ in
          }
        ];
      }
+      {
+        # WAN quality on the site gateways, fed by the hourly speedtest timer
+        # (modules/clan/router/speedtest.nix) via the node_exporter textfile
+        # collector. Degradation is judged against the link's own 7-day median,
+        # so no per-site/per-ISP-plan threshold needs maintaining.
+        name = "wan";
+        rules = [
+          {
+            alert = "WANSpeedDegraded";
+            expr = "speedtest_download_mbps < 0.5 * quantile_over_time(0.5, speedtest_download_mbps[7d])";
+            for = "3h";
+            labels.severity = "warning";
+            annotations.summary = "WAN download on {{ $labels.instance }} is below half its 7-day median";
+            annotations.description = "Sustained for 3h (several test runs) — likely ISP degradation, line fault, or saturation. Compare speedtest_upload_mbps/speedtest_ping_ms and run `librespeed-cli` manually on the gateway.";
+          }
+          {
+            alert = "WANSpeedTestFailing";
+            expr = "speedtest_success == 0";
+            for = "3h";
+            labels.severity = "warning";
+            annotations.summary = "Speed tests on {{ $labels.instance }} have been failing for 3h";
+            annotations.description = "librespeed-cli cannot complete a test while other traffic may still flow; check `journalctl -u speedtest` on the gateway.";
+          }
+        ];
+      }
      {
        name = "backup";
        rules = [
@@ -0,0 +1,267 @@
+{
+  "uid": "cnx-wan",
+  "title": "CNX WAN Speed",
+  "tags": ["wan", "speedtest", "gateway", "cnx"],
+  "timezone": "browser",
+  "schemaVersion": 39,
+  "version": 1,
+  "refresh": "5m",
+  "time": { "from": "now-7d", "to": "now" },
+  "templating": { "list": [] },
+  "annotations": { "list": [] },
+  "panels": [
+    {
+      "type": "row",
+      "title": "WAN speed (site gateways)",
+      "id": 1,
+      "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }
+    },
+    {
+      "type": "stat",
+      "title": "Download (latest)",
+      "description": "Most recent hourly librespeed result per gateway.",
+      "id": 2,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 5, "w": 6, "x": 0, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bps",
+          "color": { "mode": "fixed", "fixedColor": "green" },
+          "noValue": "no data"
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value_and_name",
+        "orientation": "auto"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_download_mbps * 1e6",
+          "legendFormat": "{{instance}}",
+          "instant": true
+        }
+      ]
+    },
+    {
+      "type": "stat",
+      "title": "Upload (latest)",
+      "description": "Most recent hourly librespeed result per gateway.",
+      "id": 3,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 5, "w": 6, "x": 6, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bps",
+          "color": { "mode": "fixed", "fixedColor": "blue" },
+          "noValue": "no data"
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value_and_name",
+        "orientation": "auto"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_upload_mbps * 1e6",
+          "legendFormat": "{{instance}}",
+          "instant": true
+        }
+      ]
+    },
+    {
+      "type": "stat",
+      "title": "Ping (latest)",
+      "description": "Latency to the librespeed test server. Yellow over 50 ms, red over 100 ms.",
+      "id": 4,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 5, "w": 6, "x": 12, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms",
+          "color": { "mode": "thresholds" },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "yellow", "value": 50 },
+              { "color": "red", "value": 100 }
+            ]
+          },
+          "noValue": "no data"
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "colorMode": "value",
+        "graphMode": "none",
+        "textMode": "value_and_name",
+        "orientation": "auto"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_ping_ms",
+          "legendFormat": "{{instance}}",
+          "instant": true
+        }
+      ]
+    },
+    {
+      "type": "stat",
+      "title": "Test status",
+      "description": "Whether the last speed test on each gateway completed. FAILING also fires the WANSpeedTestFailing alert after 3h.",
+      "id": 5,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 5, "w": 6, "x": 18, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [{ "color": "green", "value": null }]
+          },
+          "noValue": "no data",
+          "mappings": [
+            {
+              "type": "value",
+              "options": {
+                "0": { "text": "FAILING", "color": "red", "index": 0 },
+                "1": { "text": "OK", "color": "green", "index": 1 }
+              }
+            }
+          ]
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": ["lastNotNull"],
+          "fields": "",
+          "values": false
+        },
+        "colorMode": "background",
+        "graphMode": "none",
+        "textMode": "value_and_name",
+        "orientation": "auto"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_success",
+          "legendFormat": "{{instance}}",
+          "instant": true
+        }
+      ]
+    },
+    {
+      "type": "timeseries",
+      "title": "Download",
+      "description": "Hourly download rate per gateway, with each link's own 7-day median as reference — the WANSpeedDegraded alert fires when a link stays below half its median for 3h.",
+      "id": 6,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 9, "w": 12, "x": 0, "y": 6 },
+      "fieldConfig": {
+        "defaults": { "unit": "bps", "min": 0 },
+        "overrides": [
+          {
+            "matcher": { "id": "byRegexp", "options": ".*7d median.*" },
+            "properties": [
+              {
+                "id": "custom.lineStyle",
+                "value": { "fill": "dash", "dash": [10, 10] }
+              },
+              { "id": "custom.fillOpacity", "value": 0 }
+            ]
+          }
+        ]
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_download_mbps * 1e6",
+          "legendFormat": "{{instance}}"
+        },
+        {
+          "refId": "B",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "quantile_over_time(0.5, speedtest_download_mbps[7d]) * 1e6",
+          "legendFormat": "{{instance}} 7d median"
+        }
+      ]
+    },
+    {
+      "type": "timeseries",
+      "title": "Upload",
+      "description": "Hourly upload rate per gateway.",
+      "id": 7,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 9, "w": 12, "x": 12, "y": 6 },
+      "fieldConfig": {
+        "defaults": { "unit": "bps", "min": 0 },
+        "overrides": []
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_upload_mbps * 1e6",
+          "legendFormat": "{{instance}}"
+        }
+      ]
+    },
+    {
+      "type": "timeseries",
+      "title": "Latency & jitter",
+      "description": "Ping and jitter towards the librespeed test server. A latency climb with stable throughput usually means bufferbloat or an ISP routing change.",
+      "id": 8,
+      "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+      "gridPos": { "h": 8, "w": 24, "x": 0, "y": 15 },
+      "fieldConfig": {
+        "defaults": { "unit": "ms", "min": 0 },
+        "overrides": []
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_ping_ms",
+          "legendFormat": "{{instance}} ping"
+        },
+        {
+          "refId": "B",
+          "datasource": { "type": "prometheus", "uid": "victoriametrics" },
+          "expr": "speedtest_jitter_ms",
+          "legendFormat": "{{instance}} jitter"
+        }
+      ]
+    }
+  ]
+}
@@ -10,7 +10,10 @@
  ...
 }:
 let
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  mesh = import ../mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  knotEnabled = config.services.knot.enable;
  # node_exporter on every host; knot-exporter only where Knot runs.
  ports = [ 9100 ] ++ lib.optional knotEnabled 9433;
@@ -16,7 +16,10 @@
  ...
 }:
 let
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  mesh = import ../mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };

  # Grafana 13 (since the externalisation of core data sources) no longer bundles
  # the Elasticsearch data source, and nixpkgs has no grafanaPlugins entry for it,
@@ -9,7 +9,10 @@
  ...
 }:
 let
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  mesh = import ../mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  probes = import ./blackbox-probes.nix { inherit lib; };
  vmPort = 8428;
  logsPort = 9428;
@@ -1,253 +0,0 @@
-# Site gateway (OPNsense replacement) for the Topton 1U boxes: PPPoE WAN,
-# VLAN-filtering bridge over the LAN ports, and per-VLAN L3 interfaces.
-# Imported by machines/gw-<city>-<n>; everything is driven by cnx.router.*.
-#
-# Fleet addressing convention: each site owns 10.<siteId>.0.0/16. A VLAN's
-# subnet defaults to 10.<siteId>.<vlanId>.0/24 with the router at .1 and the
-# DHCP pool at .100-.199. VLANs that need more space (e.g. public-wifi guest)
-# override `subnet`/`address`/`dhcp.pool` and take a wider block from the
-# upper half (10.<siteId>.128.0/17), e.g. guest -> 10.<siteId>.128.0/22.
-# VLAN ids: 10 = mgmt, 20 = lan (mandatory); 30 = guest, 40 = iot (reserved).
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.cnx.router;
-
-  vlanIf = name: "vlan-${name}";
-  site = toString cfg.siteId;
-
-  vlanModule =
-    { name, config, ... }:
-    let
-      octet = toString config.id;
-    in
-    {
-      options = {
-        id = lib.mkOption {
-          type = lib.types.ints.between 1 4094;
-          description = "802.1Q VLAN id (fleet convention: 10 mgmt, 20 lan, 30 guest, 40 iot).";
-        };
-        address = lib.mkOption {
-          type = lib.types.str;
-          default = "10.${site}.${octet}.1";
-          description = "Router address on this VLAN.";
-        };
-        prefixLength = lib.mkOption {
-          type = lib.types.ints.between 8 30;
-          default = 24;
-        };
-        subnet = lib.mkOption {
-          type = lib.types.str;
-          default = "10.${site}.${octet}.0/24";
-          description = "The VLAN's network in CIDR form (must contain `address`).";
-        };
-        dhcp = {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-          };
-          pool = {
-            from = lib.mkOption {
-              type = lib.types.str;
-              default = "10.${site}.${octet}.100";
-            };
-            to = lib.mkOption {
-              type = lib.types.str;
-              default = "10.${site}.${octet}.199";
-            };
-          };
-          leaseTime = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 86400;
-            description = ''
-              Lease validity in seconds. Lower it for high-churn networks,
-              e.g. public-WiFi guest VLANs (3600-7200), so the pool recycles.
-            '';
-          };
-        };
-        allowWan = lib.mkOption {
-          type = lib.types.bool;
-          default = true;
-          description = "Whether clients on this VLAN may reach the internet.";
-        };
-      };
-    };
-in
-{
-  imports = [
-    ./pppoe.nix
-    ./ipv6.nix
-    ./firewall.nix
-    ./dns-dhcp.nix
-    ./crowdsec.nix
-    ./omada.nix
-  ];
-
-  options.cnx.router = {
-    enable = lib.mkEnableOption "site gateway (router) role";
-
-    site = lib.mkOption {
-      type = lib.types.str;
-      description = "City code of the site, e.g. \"cnx\".";
-    };
-
-    siteId = lib.mkOption {
-      type = lib.types.ints.between 1 254;
-      description = "Site number; drives the 10.<siteId>.<vlan>.0/24 addressing.";
-    };
-
-    wan.interface = lib.mkOption {
-      type = lib.types.str;
-      description = "Physical WAN port the PPPoE session runs on.";
-    };
-
-    wan.vlanId = lib.mkOption {
-      type = lib.types.nullOr (lib.types.ints.between 1 4094);
-      default = null;
-      description = ''
-        802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
-        null for untagged PPPoE directly on the port. Unrelated to the LAN
-        VLANs — this tag exists only on the WAN port.
-      '';
-    };
-
-    wan.macAddress = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "aa:bb:cc:dd:ee:ff";
-      description = ''
-        Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
-        pinned (cloned from the old router). null keeps the hardware MAC.
-      '';
-    };
-
-    wan.pppInterface = lib.mkOption {
-      type = lib.types.str;
-      internal = true;
-      readOnly = true;
-      default = if cfg.wan.vlanId == null then cfg.wan.interface else "wan-vlan";
-      description = "Interface pppd dials on (the WAN port or its ISP VLAN).";
-    };
-
-    trunkPorts = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      description = "LAN ports carrying all VLANs tagged (incl. any 10G SFP+ ports).";
-    };
-
-    vlans = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule vlanModule);
-      description = "VLANs served at this site; `mgmt` and `lan` are mandatory.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.vlans ? mgmt && cfg.vlans ? lan;
-        message = "cnx.router: every site must define the `mgmt` and `lan` VLANs.";
-      }
-    ];
-
-    networking.useNetworkd = true;
-    networking.useDHCP = false;
-    systemd.network.enable = true;
-
-    systemd.network.netdevs = {
-      "20-br0" = {
-        netdevConfig = {
-          Name = "br0";
-          Kind = "bridge";
-        };
-        bridgeConfig.VLANFiltering = true;
-      };
-    }
-    // lib.optionalAttrs (cfg.wan.vlanId != null) {
-      "15-wan-vlan" = {
-        netdevConfig = {
-          Name = "wan-vlan";
-          Kind = "vlan";
-        };
-        vlanConfig.Id = cfg.wan.vlanId;
-      };
-    }
-    // lib.mapAttrs' (
-      name: vlan:
-      lib.nameValuePair "30-${vlanIf name}" {
-        netdevConfig = {
-          Name = vlanIf name;
-          Kind = "vlan";
-        };
-        vlanConfig.Id = vlan.id;
-      }
-    ) cfg.vlans;
-
-    systemd.network.networks =
-      let
-        taggedAll = lib.mapAttrsToList (_: vlan: { VLAN = vlan.id; }) cfg.vlans;
-      in
-      {
-        # WAN port carries only the PPPoE session; no IP config of its own.
-        "10-wan" = {
-          matchConfig.Name = cfg.wan.interface;
-          networkConfig.LinkLocalAddressing = "no";
-          vlan = lib.optional (cfg.wan.vlanId != null) "wan-vlan";
-          linkConfig = {
-            RequiredForOnline = "carrier";
-          }
-          # The wan-vlan subinterface (and thus the PPPoE session) inherits
-          # the parent port's MAC, so spoofing here covers both cases.
-          // lib.optionalAttrs (cfg.wan.macAddress != null) {
-            MACAddress = cfg.wan.macAddress;
-          };
-        };
-      }
-      // lib.optionalAttrs (cfg.wan.vlanId != null) {
-        # The ISP-side VLAN subinterface pppd dials on (e.g. AIS tags PPPoE).
-        "15-wan-vlan" = {
-          matchConfig.Name = "wan-vlan";
-          networkConfig.LinkLocalAddressing = "no";
-          linkConfig.RequiredForOnline = "no";
-        };
-      }
-      // {
-        # The bridge itself is L2-only; L3 lives on the vlan-* interfaces,
-        # which hang off the bridge (tagged on the bridge "self" port).
-        "20-br0" = {
-          matchConfig.Name = "br0";
-          networkConfig.LinkLocalAddressing = "no";
-          vlan = lib.mapAttrsToList (name: _: vlanIf name) cfg.vlans;
-          bridgeVLANs = taggedAll;
-          linkConfig.RequiredForOnline = "no";
-        };
-      }
-      // lib.listToAttrs (
-        map (port: {
-          name = "25-trunk-${port}";
-          value = {
-            matchConfig.Name = port;
-            networkConfig.Bridge = "br0";
-            bridgeVLANs = taggedAll;
-            linkConfig.RequiredForOnline = "no";
-          };
-        }) cfg.trunkPorts
-      )
-      // lib.mapAttrs' (
-        name: vlan:
-        lib.nameValuePair "40-${vlanIf name}" {
-          matchConfig.Name = vlanIf name;
-          address = [ "${vlan.address}/${toString vlan.prefixLength}" ];
-          networkConfig = {
-            IPv6AcceptRA = false;
-            # Announce a /64 carved from the DHCPv6-PD prefix on ppp0 (SLAAC).
-            IPv6SendRA = true;
-            DHCPPrefixDelegation = true;
-          };
-          dhcpPrefixDelegationConfig.SubnetId = "auto";
-          linkConfig.RequiredForOnline = "no";
-        }
-      ) cfg.vlans;
-  };
-}
@@ -1,79 +0,0 @@
-# LAN DHCP (Kea) and DNS (Blocky). Fully declarative: one Kea subnet per VLAN
-# with dhcp.enable, Blocky as the blocklist resolver every DHCP lease points
-# at. Blocky's HTTP listener (:4000) serves Prometheus metrics, scraped by
-# control over the mesh (firewall.nix scopes it to the mesh subnet).
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.cnx.router;
-  dhcpVlans = lib.filterAttrs (_: vlan: vlan.dhcp.enable) cfg.vlans;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.kea.dhcp4 = {
-      enable = true;
-      settings = {
-        interfaces-config.interfaces = lib.mapAttrsToList (name: _: "vlan-${name}") dhcpVlans;
-        lease-database = {
-          type = "memfile";
-          persist = true;
-          name = "/var/lib/kea/dhcp4.leases";
-        };
-        valid-lifetime = 86400;
-        subnet4 = lib.mapAttrsToList (name: vlan: {
-          id = vlan.id;
-          subnet = vlan.subnet;
-          interface = "vlan-${name}";
-          valid-lifetime = vlan.dhcp.leaseTime;
-          pools = [ { pool = "${vlan.dhcp.pool.from} - ${vlan.dhcp.pool.to}"; } ];
-          option-data = [
-            {
-              name = "routers";
-              data = vlan.address;
-            }
-            {
-              name = "domain-name-servers";
-              data = vlan.address;
-            }
-          ];
-        }) dhcpVlans;
-      };
-    };
-
-    services.blocky = {
-      enable = true;
-      settings = {
-        ports = {
-          dns = 53;
-          http = 4000;
-        };
-        upstreams.groups.default = [
-          "9.9.9.9"
-          "149.112.112.112"
-          "2620:fe::fe"
-        ];
-        blocking = {
-          denylists.ads = [
-            "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
-          ];
-          clientGroupsBlock.default = [ "ads" ];
-        };
-        caching = {
-          minTime = "5m";
-          prefetching = true;
-        };
-        prometheus.enable = true;
-      };
-    };
-
-    # The router itself resolves via public resolvers, not via Blocky, so DNS
-    # for deploys/updates survives a broken local resolver.
-    networking.nameservers = [
-      "9.9.9.9"
-      "1.1.1.1"
-    ];
-  };
-}
@@ -1,62 +0,0 @@
-# Router firewall/NAT policy (nftables). Trust model:
-#   mgmt VLAN  -> trusted: router services, all VLANs, WAN
-#   other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
-#   WAN (ppp0) -> nothing inbound beyond established/related
-#   mesh       -> admin SSH + metrics scrapes (same trust boundary as the fleet)
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.cnx.router;
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
-
-  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
-  wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
-    lib.filterAttrs (_: vlan: vlan.allowWan) cfg.vlans
-  );
-  nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
-  ifSet = ifs: "{ ${lib.concatStringsSep ", " (map (i: "\"${i}\"") ifs)} }";
-in
-{
-  config = lib.mkIf cfg.enable {
-    networking.nftables.enable = true;
-
-    # SSH reachable only from the mgmt VLAN (trusted) and the mesh — never
-    # from the WAN or the other VLANs.
-    services.openssh.openFirewall = false;
-
-    networking.firewall = {
-      enable = true;
-      filterForward = true;
-      trustedInterfaces = [ "vlan-mgmt" ];
-
-      # Non-mgmt VLANs may only talk to the router's DNS and DHCP.
-      interfaces = lib.genAttrs nonMgmtIfs (_: {
-        allowedTCPPorts = [ 53 ];
-        allowedUDPPorts = [
-          53
-          67
-        ];
-      });
-
-      extraInputRules = ''
-        ip6 saddr ${mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"
-        ip6 saddr ${mesh.subnet} tcp dport 4000 accept comment "blocky metrics scrape from control"
-      '';
-
-      extraForwardRules = ''
-        tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
-        iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
-        iifname ${ifSet wanVlanIfs} oifname "ppp0" accept comment "LAN to internet"
-      '';
-    };
-
-    networking.nat = {
-      enable = true;
-      externalInterface = "ppp0";
-      internalInterfaces = vlanIfs;
-    };
-  };
-}
@@ -1,31 +0,0 @@
-# IPv6 on the PPPoE uplink: run networkd's DHCPv6 client on ppp0 to obtain a
-# delegated prefix; each vlan-* interface (default.nix) carves a /64 out of it
-# via DHCPPrefixDelegation and announces it to clients with SLAAC.
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.cnx.router;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.network.networks."45-ppp0" = {
-      matchConfig.Name = "ppp0";
-      networkConfig = {
-        DHCP = "ipv6";
-        # pppd owns the v4 address/route on this link; don't let networkd
-        # tear them down.
-        KeepConfiguration = "static";
-        # Default v6 route comes from the ISP's RA when they send one.
-        IPv6AcceptRA = true;
-      };
-      # Many PPPoE ISPs never send an RA with the M flag; solicit regardless.
-      dhcpV6Config.WithoutRA = "solicit";
-      linkConfig.RequiredForOnline = "no";
-    };
-
-    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
-  };
-}
@@ -1,64 +0,0 @@
-# PPPoE WAN session. ISP credentials are entered once at `clan vars generate`
-# (prompts). Both are secret — AIS often uses the same string for username and
-# password — so neither may land in the Nix store: pppd reads the username from
-# an included secret options file and the password from chap/pap-secrets.
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.cnx.router;
-  creds = config.clan.core.vars.generators.pppoe-credentials;
-in
-{
-  config = lib.mkIf cfg.enable {
-    clan.core.vars.generators.pppoe-credentials = {
-      prompts.username = {
-        description = "PPPoE username (from the ISP)";
-        type = "hidden";
-      };
-      prompts.password = {
-        description = "PPPoE password (from the ISP)";
-        type = "hidden";
-      };
-      files."user-opts".secret = true;
-      files."chap-secrets".secret = true;
-      script = ''
-        user="$(cat "$prompts"/username)"
-        pass="$(cat "$prompts"/password)"
-        printf 'user "%s"\n' "$user" > "$out"/user-opts
-        printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/chap-secrets
-      '';
-    };
-
-    services.pppd = {
-      enable = true;
-      peers.wan = {
-        autostart = true;
-        config = ''
-          plugin pppoe.so ${cfg.wan.pppInterface}
-          ifname ppp0
-          file ${creds.files."user-opts".path}
-          noipdefault
-          defaultroute
-          noauth
-          hide-password
-          persist
-          maxfail 0
-          holdoff 5
-          lcp-echo-interval 15
-          lcp-echo-failure 3
-          +ipv6
-          mtu 1492
-          mru 1492
-        '';
-      };
-    };
-
-    # pppd looks up the password for `user` in these files at dial time; both
-    # point at the same generated `"<user>" * "<pass>"` line (PAP and CHAP).
-    environment.etc."ppp/chap-secrets".source = creds.files."chap-secrets".path;
-    environment.etc."ppp/pap-secrets".source = creds.files."chap-secrets".path;
-  };
-}
@@ -10,7 +10,10 @@
  ...
 }:
 let
-  mesh = import ./mesh-hosts.nix { inherit config lib; };
+  mesh = import ./mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
  hosts = import ./hosts.nix;
  certName = "cnx.network";
 in
@@ -0,0 +1 @@
+../../../groups/admins
@@ -3,8 +3,12 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcmJ4cXNt\nL3k4UmtqQUJZOGRoZFhab0pRSTdBUm9ZZkRxdHNvaCtRc05JVgphbHhHQThiRDNF\neW8xVGhXQ1pvSkRDR2hod2Zpa3pwaWZDVUpGZlpPWkNZCi0tLSB2T3JCcElnbVU2\nekJ5ZTdyQzZwbmR4aHBJUTc3M3loUm0wbHpHTGM0ZW1RCs0kHes9rkjd3uwHzxhi\n8x8AcQcQTR+CGsV5XPzGVMKKUZpwXWeNnvcHfVwYcqOnXucbUdCxLc6d57c9GQpC\nd3Y=\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRWlKNFVSOThSWlI3LzAz\ndnQxbnNGSlhoVmZrQmpIVEJieStlUzlseDJJCmdGbldCSU1oTGszZmtzSWhJaWta\nVDhoQU8vVXB0bG1VUkxoWDlyR0I1a0EKLS0tIDFzdklCTTBjeXBoT3FqVW1Pbkxl\nYVZ5Vm55OFp4YWwzS3dVNXRoZmpBT1EK0pNbk20gwPe5Q1bZR3XRHMWz+x+8FzRa\niq5tLcGkgfMO6WTzj8vtB7g0Q3sFgmPXTqb8yMzqAkZd4z9FKJGt6A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcFBHaFpS\nbjJiL0ZnOXlzMVVNdjhvUGxmaEJhTklSR2ZaTnhPWXFCaC8vbgpLdE04aW16dEls\neGw3VllEYVAzbGJ5TVZoOXhkR3dCUkREdUkxMU13clVzCi0tLSA3eW93QnFsNW1r\nK0ZiWEtrWFVqeTJyTk1maGVTMzdBTkJUdk5WN2N3WlprCp5oak+Bh/g4+ikE1LR5\n7kYrWQlzjC0Z+F5GegEtRjGCPnolWllnPUH4dGGjfuyAxy9qfi1J6Bi6m8uzo5rY\n+zs=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
 			}
 		],
 		"lastmodified": "2026-06-14T05:20:21Z",
@@ -0,0 +1 @@
+../../../groups/admins
@@ -3,12 +3,17 @@
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcC92dDND\nUFFiMGYzSE5zWFdoRXlSV1lQdHc4TDBab21wSWpxMGxsSDVweQplTW5lcUY3dXdR\nMUJPamMzREZlN0N6WTVUbE9kaXlZMVVDUFBRVnU5TkJjCi0tLSBzZW5SYXMrRTlT\nYmJLSDRlWTg5bFdNRmw1WkhpQVQ5Zi9GeG91SUtxM3RVClP9r+sAX8BVngpVGPJh\n/tYHqmSl67sFL5K6TJog1QQ1Gj2GiiTXE/kLTN+vsPbQaepqXamCKNrMXZWYOA2t\ntWw=\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLRkppdUoza2l0SnFpME5n\nM0xBRVk4c2lhaHMvazFNaGNTdkJDcnJEQkVrCjhFUlZMUitnZ20zQlFEcm5WQmVG\nWmJVeUh6S09MS0xpQUR4aDF1V1dCZFkKLS0tICtOMEJ6QmRRR3BkaU5sZHdzOElO\nSnV4K0dHMHhDOURPTEpucXFuNEUwaU0Kx4xAaKTrw1bKJPQVCHcByTcapFhslwrV\nqssEBnYWXqFgI3vh3CatBXuZY1Lm3eTKhDDQ2ZyPKgc/l0gXyFwH2g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBMHFKQTNG\nazdEcThReFZGVVBtVFBDY1luQk1UTkl0a0p1bzQ0cUxBZWVyYwo4aU5qaEs0czJB\nUzZFcG9uTUZ1OUFScW9ZeHljbDBEbjkzZ08vS2F1Qjd3Ci0tLSBHTXhVWjNsWHhK\nbWtrMWw3Nm8wSU9MNXZwcWxVZXRJS1dTK0hycnFoVlRJChemDXVb7LgM7OeUUeqa\nTl0IuDHmIIx/lUYnJWGZmWQHz2znk679j36VQQNWcK6eZlKUIqYmBj3fMu+OYir2\nMLI=\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
 			}
 		],
 		"lastmodified": "2026-07-28T09:03:13Z",
 		"mac": "ENC[AES256_GCM,data:MKIyykYwtQqpUnXqZQKzKwoRhSon2PH0wYiTDTvogaVREHfpEPs/mdOjQBUHtbr1QGqWNh4AxdBTKfpjXTlncHAEtcIdVH3qPccVxsXqfqRmZPDFzcHZAIw+VSvDsKwD3anixiXDeHmeLawwbyb1rnS0P8KquXbmjvirwGUIQLU=,iv:+hdLXMJMCby/6Q6JGxp4p95GgPKbdA/OTAZloyylr08=,tag:ZZ4dKjhjpE2xqcoNf4qeoA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.13.1"
 	}
 }
@@ -0,0 +1 @@
+../../../groups/admins
@@ -3,8 +3,12 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBemRVWUs1\naXFpVm80UmloUUpnR1BVaGsxampHV1JFNWFnSUhiY0orOTU0cgppVEJ5QVcvbGpC\nZlErd01XUzh0MnZOekkvTkc5Z3owS3pBbkNCUDJ6SlJRCi0tLSBRVVgrd3hIVEla\nMEhoN3FDSG1HdGk5YU8ydzlVUGd1RW5zM1lka3VuSHFNClrBItoFo7uqpS5fuvaG\nOvh6mTylk4bHgcSRGKTk383srgsvPdZaioJfUs7fbVmLD3+bhfM/Wgv7tI6kO1dj\nmDg=\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcU01TXl0\nRmU5ZlZOK3NZZE8vNktOWXBkRnZtZHlUbnBHYlVQbDdzZlRDbApFeFI0OE1KdndQ\nZWczZGRYZXBONTc2aG4vZTJEZ1hCdGljNFJBcmF0UGpRCi0tLSBGMGJVWUtJMWFP\nQUZwWVZTWUFKZnVJUTJSMHlRMGRNcExPSEpXTFpLSkVNCj1WEuRyATcxp0GYeoqC\nACpQpcqgIBVD1dYB0pPo+I6yDXvx+JbwVdgGl+2Cxj40HQOfyvJecoOO3efOZrB3\nUZU=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRb0ZvUmN2RWhtQkpXMXJr\nY1o2MXZsQ0dXNFYxa2RLUGlJWnN3Z25zbnp3CmtLbkYvdHR2MUZIY2U1MzhyU1VD\ndm5MTmMveEJLOHZWWnVWdVpDcTFsTmMKLS0tIFEwYzZYeU5uc29BTEVxN2YvN0Zw\nd0VSeTNhQk1pNVdaZVdTVk1oNjFwQWcKwEbHyT354Cbam9wuiIhapre+nbqtMr9h\nbOjF53LR9RZ9/mbpTNDLOkq2QW2aM4tKkRfdUgP1XgboilzcTjba8A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			}
 		],
 		"lastmodified": "2026-06-14T05:20:24Z",
@@ -0,0 +1 @@
+../../../groups/admins
@@ -3,8 +3,12 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBL2doZFpO\na2Y2QzZSckJaZmZsTlFtQU1mckxJWTBiUXA2SUljVWZDemFJYgpwcFl6RHh2ZXdn\nNTBsaEVpWm5oYWtteU5WZmxWK1RRK2NoYW0yWlpCd3dBCi0tLSBsZVNpczR4dUdv\nSmtqQzMvc1ZYY0xUY0JMQmt2YzB5YmZOMEtXcW9vWUcwCnCdgcgiwF2rkWsV0IdO\n/6cs35FBypWpfflGwOwP0GnTrNizc9HphcMcwAi5NMQVi6X90Xgm5aFdpAsSWepX\n/SI=\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBaTVGQWRC\nZUJocGx5Zjd0c1JpUEdHbGczNUh1RjRqSERRNHNSbnRndWFUMAoxbFBEU0Ezajhr\nSUlIRStWUUdVTDJMQWxmSkw0c0FNYnFxNEJIdnExTmx3Ci0tLSBMRGRPLzlXTEN3\ncHZCMGF3WDZTcFhTd2srL3Vpc2dRdExrVzFJcWhjQVJrCrA1y2SapkZoppI3z4LD\nH71D/WxIcTHp3fIzICNvgxWHn3+vkDDZcpcgH+gRiPCDqrgDp0NZcZiDlz6zyHGr\nmaM=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Rmp1S29hVE5LNkZpLzRV\nMGZJL242YmdHNkFXR2d0TmlVWXViTlJFNGpnClBSdEhaRlNWbVNrb05tTHh0Q3Rk\naVFNdUd1clNVckREajVoRmZCenFEaVkKLS0tIExOaHd1WWxZRFM1UFk4K0E0cWpE\nK2duUE1KeEtmeVorRnc3MFdDZXFGZjAKKw4ykWu+HzBN3WAj/gx0mMYk0RiyRR50\nYv7hg1B/+x4lDCTjAJIWrrBEjLJBZTZRnECmTMTlJ39uOhxeUOizCA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
 			}
 		],
 		"lastmodified": "2026-06-14T05:20:27Z",
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/gw-cnx-1
@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:4OPDbpmYb7nhHbUvu8dYmF7B/LipnKNE5g8vE33LMzUVg5S+EAyRu2u9dbeUDayqq+ms8WT/oqN/Q0hjsE67+3PCEYBbeAgb5tibsn3tmh1Erp0QUlA4V/erhDwvH+Y8GA3UEJITQ1TtPhCSCKnQbGm85+Tir0nsocjQi3g9Q67TRqUAF7US8H+MVM+YEnIE7HcUH/LKc9z3kg43AaMa2Ey83PjmkMmRdQ==,iv:3VdMulw2DUIReb2werCE4+VLMlxn4FeVUwl8R9Bn3Vw=,tag:TZJZcRiBSCjeTzd10a3rHA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBTXlXNzBJRisyeVM3YmRO\nK3IyTTFOcW5VVCtJcnVySFU2RE9PdUdpeWpJCnpscGhsakZkL1hDenhXUW1yY3JH\naHFzUS8velQxV3lYc2hPL0FWcWRpYUEKLS0tIE9BckgrUVRKM1hOWGg0N0V2Z2ds\nUzlhZ0luWitPS3U0UHpWQzZwdG1temMKf5SKmUh3LYD50tObR5tfEvNRoVegg/Tu\n4jXlMKNVg7yOgXET3CNS/Sm4ork4Wz4bSA6gYhLD5JIW356d5WBO4w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAybzRIVjhDUHZBVHFSTDF1\nZUNScTRoZzFzdkRISFMzZ0E3M0ZWeFF3bncwCi9rbzg2bUV0OVhBNlROQlhSQnpF\nSm9mVkF2MzhycnNqRUwvTFV2bW5QRWsKLS0tIHJUc2NyOVprMzBjOTgyM1IvZDU2\na0RSenNHYXNqSzR1K0JRVVBpMlpZN0kKk63q9i5zCP3lAZ+JiknOgFcp/quFGYdp\nzoAmkEeGLK8nR5lOVdUutHktG9Rneci+7Q49bk2S4gqeLDt2AnOCsw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcXRoTXMy\nOG01R2hEY3R2NTd1bzdPTVUvOWorN1NOYlVLYWk3VThtUEpoUgpzOHNYN1N0bzlv\naWhDVCs0b1ozQ0FBREpiVXpiTkxOeEl5b3YzdkR5YXowCi0tLSBBbTZUZDVpN0I0\ndWRPUXdVaGx5Mk56UzFUbzBvT0xBa0h3dFdmajNXak9RCmDpIFatc4U+k3NDDw7m\nn/D+azJwB6KS2s9YeUy85RoClEqiNSGC9t7qqffVFdiNS8Zww6MTzY++lgj1bYlK\nLMc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-31T03:07:42Z",
+		"mac": "ENC[AES256_GCM,data:aXgLJn6HmSS01GjwYi/lpDil2/FmQitKZOZHUEr1k1r31gTb87RYVJd11MXuGiCCtc5ASKsbZIxoRuPf9DLiiJfuCaVY6Sv4fH/JXkSaLh9YoRCPeX7lrcyYiqficAhmC6+0D3Y0e9tpLSuEdaNB9wHwvslEZ4LSkVscTPSM8VQ=,iv:eY9+6mPJaVDNkZH4LvPBzggEHtyj4H/3QPfN0cjJdx4=,tag:iZyexO/rlt/8XOJ9yR4zgA==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/berwn
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/ns1
@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:Y0fYYbD4wqi/WNt+dzVFkJ6ZH4PLC34T3dbmPw0bVFCNCbNF/twHwALVihVc18Oc2PbLpudY5DKr3s0zwfoG7YzPn0Hlc6+KsotoG+8R71WRo3D9yZbGz2ajdDCuglfLbhFmuDAlQjAHFWVUV5HH,iv:CbNFBo0As6cu/1n/BuwqqMn8wbx76i1HZ1Y3g6DiBcA=,tag:0VlCjAK6ZwP0eDxRcqowvg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NndmSXF2MWc2MEtZZ09u\nR0xQWUlGWWo5VFRMTFgwOCtFMVdJbXB0MlcwCktRNG9tQVJJOUlPbXlBbTFyb1NE\nSmZ2OVpXNUxUdjZhYTl1aG1DV3ZkNzAKLS0tIEtiOGVaMTZrbHBRZGVBRlQ2VE1G\ncWhkVzZ4Yk1GY3ZXNnJzcFk3NUs0N2sK44Dw4YMuUSiu+XVR/By1Tdm+ikGZr8sW\nsOr8BVOUH14yF3L5pGd3DoJIYPKqcaUiDpg6qSsqYXD8UYaB8c6d4Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fanu282vm7njjweqhrpcfcwpttuhce8js4tsyfry98l0neaqpewqs5s7nt"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSkppQU1sbm9WaDIrUGEx\nRjJWakpReXFCVTBaR2RqN3pNVDV6c1hySVVrCjdtRlFTMHNEc3J1NjMwczlvVWdx\nSVBjVXhGQVFFbXdEbVVFWHFHbEppQ3MKLS0tIG1DdzFqYURxNFBWQjF6NXl6YVU3\nZ2tYWjN4MVNMVGNjSmVJYWs2SnVjQVkK5kS5kpZO22EAAdokjM44g7hZy+bdOKrc\nrC6DjBwpI+BtJjXdO8nltBIXKhOBz+8sHI0XPuQP58UjKRD3YtaaJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBMnFiMFhr\nci9GdmZvRnhaVXNtR1NDcDZrcXhKd0V1Nm4wQnpUeWNiY253WApnUlJVNG4wZStX\nRkZIOEVBVTlNcS8zUWVqM0xldGRXVjNTWlZqWE5lTXpNCi0tLSBxSkVLY0k4dkpH\nbjRJOWhWekhhbXV4bldUWVE2UXRRbXlpeUJtUWVJcU1nCmxN/fEWLPJuzt6bYdNA\n+FUSn7Q3WLLgIGmCMxy+xxNBh3Sbu9ZRd9and2tNwcwBcCiywsrESQc5SD0RFqNU\ncqQ=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-31T03:07:42Z",
+		"mac": "ENC[AES256_GCM,data:0Ugi6vc7hWdXxCbVuRoq0yuAl15N0Udndf3QISlteWdiV9F3Cg99S/NpCa9PPk7EKOGJ9+Ow0mJAZVJqz9l5Zuvq4wpClU9hSe7VMuUO2sF8EambdEQtrHccV560DecFZn/lgYhnJIhJOUAKuqR7PoyGN5A+64vSc18KgNU8Euc=,iv:cnhktstJBZIAt1RU84fX8YV4IPrYPUQAjNGlXweNJFo=,tag:D2Qqyu+utno09ADAPXUkVA==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/berwn
@@ -0,0 +1 @@
+../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../sops/machines/gw-cnx-1
@@ -0,0 +1 @@
+../../../../../sops/machines/ns1
@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:juFDgvxu7l6xf8wXVvlMz6m8bOaBAG3JTok/5YNwEIs/XxmL+GqkI0WuYr0=,iv:/Ga2ENxUUMK1U/WoYU8McatIPT9lRyFYfSZiTZTMIFs=,tag:Rxxkwu73i45HlCLBgSqi+g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMXpyMko0d3NMeFZMc1kx\nWEtyZjVvWkpwK2tCNy9WQmNwRFpsb3hXUENzCjF1ZXhQRTVxSm40aStZLy9oWGxn\nMU5BSDFsd0ZNVTROVGs4SkcweFgvTDgKLS0tIHhEcEdScFluT1pGTTBXVW9jTzV5\nalhPT0FyRXNveHBwUTArMjhrNDJMR3cKiBBQheppYxyJ4uwS8MIWSuo7EGm3GYcc\nE4vdoIEp2NkDlPEWNudMKlV0fMoOdAt1psPFXUy37XEWLsOgJTIMEg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fanu282vm7njjweqhrpcfcwpttuhce8js4tsyfry98l0neaqpewqs5s7nt"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWlNVS2VDR2pRUWdlUlFG\nUjJPNzl6YUpSRnc3bHRveU9Xd1kyTTU5N0I4CmZ1bDRzU2o3YVNFRnE0MGhFMVYx\ndXcrZGc4TEFJQjNwZEVDaW5hTVZTblEKLS0tIDlRbHkrdEFJM2NsckJ1d2VSb1Bh\na3Y4VXE0UjRVUU41ODBzeDc3T3AvcjQKBS9bhuSlag2xuUyhnPniY1EFIXzsSNDE\nONpxAmsuGm/aQ6u2+W+46Vm0Ow3Oc+cIkB35XeB0D9wXQjbJt8r0Rw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcUlLTU5HOVFxTEwrSFQ5\nTkkzd0JxN0V5RkM5UXZ6OENnYU02T2Jtd0dzCjBmOEZ1SFBmdGZERVE2bThMREs4\nbmVWemlqRkFQVzBqTk9hZTd5QkhWSWMKLS0tIFcvdGVpQXBxSjZCbk52WVlhVnpD\nUjhxRWdZbk5tSTUxeUt4cHhQVlVFbHMKg0VVYZwf9ykVaZ17pqrha3HG7ZRjcRdk\nsTTuTZ9c+5IhBThrv24+8vkidQhJKSJY+aLiYL9BraKS86lvZSPzpg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBN2RKU0FW\nakJJcXB6dHllbytBSldiV1NvZFFneEVtdmw5L2xQc1kvWnJwRQoyNGkyUUtUZ29K\nS2hudkhPTDVtMVg1ZTFpakxZb3BkM0JQYXBSS21iNEtNCi0tLSBVWWpGRUFpOEEy\nNU1SUmVOQnozcjdwcDJkQnY3bldFeHptTUJ2bjJPamlFCre4Bzl0E8yj1Ld79Snk\nTRE/1l2kep1/9ufwq59R1eyE7nTCmnuaMUj1nB2na64S1orjmVa69buBEQORaoNp\n8yg=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-31T03:07:39Z",
+		"mac": "ENC[AES256_GCM,data:MVoUIB0J8GvTEgEVdFD3CWmqaJkuvhx21ApnfMJgTABwKN/q+luPhn2i/2LI9S1NQx26k6fbiYtq5DypuOBfxW+wmeDwOMFVmA5tQLCuvzn6HR1hC3EMGAI5AmXulAdOWpP86R8tfVjrPNyb94iq6haNkFJ+N8Vacq5Iq8FyKyk=,iv:9vTa0xZD5wscJ614ELcTzu7SpMu7+BjRxx3soBwlMwA=,tag:/MPGGTQN2DLBubm93FY/LA==,type:str]",
+		"version": "3.13.1"
+	}
+}
@@ -0,0 +1 @@
+../../../../../sops/users/berwn
Author	SHA1	Message	Date
kurogeek	596ac1f4bb	router: make CrowdSec opt-in (`crowdsec.enable`, default off) Not every site wants the ban engine (hub sync needs internet at activation, and it is one more moving part on a small box). Gate crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`. gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.	2026-09-21 07:20:17 +00:00
kurogeek	e1e18dd9f3	router/tests: cover the staging uplink as NATed fallback exit Neither regression fixed by the previous commit was observable: the VM test had no staging port, and pinging the ISP's PPPoE address only needs ppp0's connected route, not the default route pppd refused to install. Add a fifth node, `oldlan`: a networkd DHCP server on vlan 4 handing gw its staging lease, with a second address (203.0.113.1) that gw can only reach through that lease's default route. It has no route back to the VLANs, so client pings only work if gw masquerades. Proven: pppd's metric-0 default wins over the DHCP one while ppp0 is up; lan reaches the old LAN via the staging port and iot (allowWan = false) does not; after stopping pppd the staging route carries WAN traffic with the same allowWan split; restarting pppd makes ppp0 preferred again.	2026-09-21 04:32:14 +00:00
kurogeek	8090ab3e6d	router: let allowWan VLANs out through the staging uplink With stagingPort set, the box itself had internet over the staging DHCP uplink but LAN/Wi-Fi clients had none: forward and masquerade were scoped to ppp0 only. Worse, pppd's `defaultroute` refuses to install its route while the staging DHCP default route (metric 1024) exists ("not replacing existing default route"), so even a live PPPoE session was never used. - firewall: forward-allow + masquerade allowWan VLANs -> stagingPort in a separate `router-staging-nat` postrouting chain (networking.nat only takes one external interface). Same allowWan set as nixos-nat. - pppoe: `defaultroute-metric 0`, so pppd only checks for a metric-0 default route, installs ppp0 as the preferred exit and removes it on hangup, leaving the staging route as the fallback.	2026-09-21 04:32:07 +00:00
kurogeek	4146f2c878	router/dhcp: drop Restart= already set by the nixpkgs kea unit	2026-09-18 10:08:03 +00:00
kurogeek	9ea058bfb8	router/dhcp: make Kea wait for its VLAN sockets kea-dhcp4-server orders after network-online.target, which under networkd only waits for the WAN carrier: the vlan-* links are RequiredForOnline=no. On stellio Kea started before networkd had addressed vlan-lan/vlan-mgmt, failed both binds and, per its default, kept running with no socket at all (ss -ulnp showed nothing on :67). Wireless and wired clients' DISCOVERs reached vlan-lan and were never answered. Set service-sockets-require-all with a bounded retry so Kea keeps trying while networkd catches up, and Restart=on-failure on the unit for the case it still gives up. Verified with checks.x86_64-linux.router.	2026-09-18 10:06:01 +00:00
kurogeek	f98226bc6e	router/wifi: assert no supplicant/NetworkManager owns the radios With the AP-typed match, the station-mode netdev is unmanaged until hostapd flips it, so any wpa_supplicant/iwd/NetworkManager in the importing config would grab the radio first and keep resetting it to managed mode under hostapd. Fail at eval instead of at runtime.	2026-09-18 09:36:07 +00:00
kurogeek	d4e98d8dd5	router/wifi: match BSS .network files on WLANInterfaceType=ap networkd enslaves the radio to br0 once, at link init. On real hardware (GL-MT6000, mt798x-wmac) that happens while the netdev is still in station mode, so the kernel rejects the bridge join (IFF_DONT_BRIDGE), the link is parked in networkd's failed state and never retried: link_reconfigure_impl() is a no-op while the matching .network file is unchanged, and the udev 'iw set type __ap' hook meant to pre-empt this loses the race. Wireless clients associate but their DHCP never reaches vlan-lan. Match on WLANInterfaceType=ap as well as the name. The station-mode netdev then matches nothing (unmanaged) and the file first matches when hostapd has switched the radio to AP and raised carrier, so the enslave succeeds on the first try. Drop the udev hook. Verified with checks.x86_64-linux.router (hwsim STA lease over the bridge).	2026-09-18 09:22:57 +00:00
kurogeek	60aac6efb2	services/router: init	2026-09-17 08:57:32 +07:00
kurogeek	b85d6637f1	machines/gw-cnx-1: wan.macAddress	2026-08-17 17:34:14 +07:00
kurogeek	e316ec56ce	flake: use flake-parts	2026-08-05 10:19:32 +07:00
kurogeek	559115e52b	inventory.json: update install time of gw-cnx-1	2026-07-31 17:37:47 +07:00
kurogeek	9cfcf91b51	inventory.json: update install time of gw-cnx-1	2026-07-31 16:08:14 +07:00
kurogeek	570fe64497	inventory.json: update install time of gw-cnx-1	2026-07-31 15:09:07 +07:00
kurogeek	2ac4215237	inventory.json: update install time of gw-cnx-1	2026-07-31 13:03:43 +07:00
kurogeek	d51a334ec6	inventory.json: update install time of gw-cnx-1	2026-07-31 13:00:57 +07:00
kurogeek	b81c0aaa89	machines/gw-cnx-1/facter.json: update hardware configuration	2026-07-31 13:00:57 +07:00
Berwn	fcd8e55024	Add untagged access ports and a staging uplink for gw-cnx-1 New cnx.router.accessPorts option pins a port untagged to one VLAN via bridge PVID/EgressUntagged; convention is the last copper port as an always-available mgmt recovery port. gw-cnx-1 port roles: enp1s0 WAN, enp2s0 trunk, enp3s0 temporary DHCP uplink into the old OPNsense LAN (back to trunk at cutover), enp4s0 untagged mgmt.	2026-07-31 12:57:34 +07:00
Berwn	19e1acda51	Renumber gw-cnx-1 to the fleet addressing scheme (OPNsense replacement) The newedge.house site adopts the 10.1.<vlanId>.0/24 convention: mgmt 10 (the old untagged LAN), lan 20, iot 40, voip 50, dmz 60, unit1-5 110-150. PPPoE is untagged at this site. Static leases move to a new per-VLAN dhcp.reservations option rendered into Kea host reservations.	2026-07-31 11:39:54 +07:00
Berwn	f5b6b4b55e	Serve newedge.house from the fleet nameservers	2026-07-31 11:39:54 +07:00
Berwn	3646d43ac5	Add CNX WAN Speed dashboard for the gateway speed tests Per-gateway download/upload/ping from the hourly librespeed runs, with each link's 7-day median overlaid so the WANSpeedDegraded alert condition is visible at a glance. Label-driven — new sites appear automatically once scraped.	2026-07-31 11:03:31 +07:00
Berwn	d8d4a686eb	Add gateway diagnostics: iperf3, CLI toolkit, periodic WAN speed test iperf3 serves throughput tests from every VLAN and the mesh; an hourly librespeed run feeds speedtest_* metrics through node_exporter's textfile collector, and vmalert flags download rates below half the link's own 7-day median so ISP degradation surfaces without per-site thresholds.	2026-07-31 10:44:52 +07:00
Berwn	b11ff75ca6	Add internal reverse proxy for gateways (Caddy, wildcard via DNS-01) cnx.router.proxy serves <service>.<site><n>.cnx.network with a real Let's Encrypt wildcard obtained via a gateway-scoped TSIG key against ns1; Blocky resolves the names to the router's LAN address, so they exist only internally. First user: Omada UI on gw-cnx-1 (omada.cnx1.cnx.network).	2026-07-31 10:09:08 +07:00
Berwn	4735968433	vars: update via generator dns-acme-gw-cnx-1-knot (machine: ns1)	2026-07-31 10:09:08 +07:00
Berwn	02efeb454b	vars: update via generator dns-acme-gw-cnx-1-rfc2136 (machine: gw-cnx-1)	2026-07-31 10:09:08 +07:00
Berwn	868cd9eebd	vars: update via generator dns-acme-gw-cnx-1-secret (shared)	2026-07-31 10:09:08 +07:00
Berwn	99fdde666c	secrets: add group admins to secret gw-cnx-1-age.key	2026-07-31 10:09:08 +07:00
Berwn	7b706eb3e7	secrets: add group admins to secret ns2-age.key	2026-07-31 10:09:08 +07:00
Berwn	6c89a7031a	secrets: add group admins to secret ns1-age.key	2026-07-31 10:09:08 +07:00
Berwn	4ca5fd3afd	secrets: add group admins to secret control-age.key	2026-07-31 10:09:08 +07:00