Volatile journald (64M), tmpfs /tmp, no core dumps, and noatime +
commit=60 on the ext4 root so the small periodic writers (Kea leases,
timesyncd clock, speedtest textfile) coalesce. Logs are kept in RAM rather
than dropped: pppd/kea output is the main debugging tool on a gateway.
cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and
masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets
`defaultroute-metric 0` so the PPPoE route is installed next to the
staging DHCP route instead of being refused. Also makes CrowdSec opt-in
upstream (stellio leaves it off).
The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64
builder without binfmt cannot execute (`--max-jobs 0`); validate the same
YAML with the build host's blocky until the router service carries this.
kurogeek