stellio: define the GL-AR750 / GL-AR750-5 Wi-Fi networks the radios reference

6d06356 pointed wlan0/wlan1 at these SSIDs but wifi.networks still only declared WhiteHouse, so hostapd evaluation failed on a null network. One SSID per band on lan, named like the GL-AR750 being replaced; passphrases come from the wifi-GL-AR750-passphrase / wifi-GL-AR750-5-passphrase prompts.
vars: update via generator wifi-GL-AR750-passphrase (machine: stellio)
2026-09-21 09:54:34 +00:00 · 2026-09-21 16:50:14 +07:00 · 2026-09-21 16:50:13 +07:00 · 2026-09-21 15:49:55 +07:00 · 2026-09-21 08:11:19 +00:00 · 2026-09-18 10:10:49 +00:00
11 changed files with 136 additions and 14 deletions
@@ -181,11 +181,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789610252,
-        "narHash": "sha256-k8rD1LMf17vAf+fS9lVC4Yp0C6ok5mYVtfZAsKC6Wy8=",
+        "lastModified": 1789975217,
+        "narHash": "sha256-n7L5vHbyemIa5jzlueIdpWmQsQSkv5Rrf9JV5kTZ6uU=",
        "ref": "clanService-router-ai",
-        "rev": "60aac6efb277a12c24fde29eb77422b3c3519df4",
-        "revCount": 194,
+        "rev": "596ac1f4bb851af3e03c06ba286cb33ae36095d2",
+        "revCount": 201,
        "type": "git",
        "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
      },
@@ -52,28 +52,31 @@ in
      };
      stagingPort = "lan5";

-      # Both MT7976 radios broadcast the site SSID (same name and passphrase
-      # as the liminix router's "WhiteHouse"/"WhiteHouse-5", merged into one
-      # dual-band SSID) as an untagged access port on lan. Passphrase is the
-      # `wifi-WhiteHouse-passphrase` vars prompt. Channels as on the old
-      # router. Check the band mapping with `iw phy` (mt7986: phy0/wlan0 =
-      # 2.4 GHz, phy1/wlan1 = 5 GHz).
+      # Both MT7976 radios serve lan as an untagged access port, one SSID per
+      # band named like the GL-AR750 it stands in for ("GL-AR750" on 2.4 GHz,
+      # "GL-AR750-5" on 5 GHz) so clients roam over unchanged. Passphrases
+      # are the `wifi-GL-AR750-passphrase` / `wifi-GL-AR750-5-passphrase`
+      # vars prompts. Channels as on the old router. Check the band mapping
+      # with `iw phy` (mt7986: phy0/wlan0 = 2.4 GHz, phy1/wlan1 = 5 GHz).
      wifi = {
        enable = true;
        countryCode = "TH";
-        networks.WhiteHouse.vlan = "lan";
+        networks = {
+          "GL-AR750".vlan = "lan";
+          "GL-AR750-5".vlan = "lan";
+        };
        radios = {
          wlan0 = {
            band = "2g";
            channel = 2;
            wifi6 = true;
-            networks = [ "WhiteHouse" ];
+            networks = [ "GL-AR750" ];
          };
          wlan1 = {
            band = "5g";
            channel = 36;
            wifi6 = true;
-            networks = [ "WhiteHouse" ];
+            networks = [ "GL-AR750-5" ];
          };
        };
      };
@@ -1,4 +1,10 @@
-{ inputs, lib, ... }:
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 {
  imports = [
    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
@@ -27,5 +33,20 @@

    clan.core.settings.name = "stellio";
    clan.core.settings.machine.description = "Flint-2 router";
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
  };
 }
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:a2FQFSLd0eUq3FdoGKY1RBfy38CfCxtWqf4AiTAqsYeFQJeOFzNC28c6YImv,iv:EDlMtdxJFlo1G8chTuERaMNhGFO0C4Nex7DN3pn7i10=,tag:8HE58+YnKhdJpax15jyCqA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Nk1QQnU1WFlFK0RDdlFr\nWkhSUTN0SDgzSXNtK3c3ZFRieEkvV1hqdmhVCjJDZWxLYXpWUGJoMHFYeWE4U1lD\nWVFFQ01IblBXUCtNODZ3OHF2UmhhM1kKLS0tIHZndC9rL0h4ZzhPbEY1MkkzT1M1\namRib0FOZEdhR3hUQWpCWDJaMnJMb0kKiqanyOifjJO+2Pw/m7Sx3+Z7TFVULDlE\ngz3qH+tlIo//GpufHPIfQ+c2gtFaNFG1AKbOewIK3inuEzvSEQyF0w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpenVKdDBEMlY4V2QxdmN0\nZUpBSEdzbk9SWTc4dGZldzk4NDZLa1UzTFRjCkt1MXZWbzZtUHpVdGozc0JSMnhP\nOGxnRkRSeXgyMTVvUXQ5WG9IcXRaTGMKLS0tIDJNVlVZWll5bjN1Z1BXdzR6M1li\nTzM0cVdFaEFxTjdmZ3RUK3JHQ1V5a3MK0KgXsT3efS4BQi2nBZB6TjAULYUGE72S\nTYKl+lQ+p8IREG8DGU0MzFPnPAjat0YAMav4RNSQGWHvjqU2J3fNiQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDk2UmlZTzJB\nV2tZS296eTdabmg4amNKbnc1QUluTDVkcGh6aUdsbW56RHMgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpQamZwcFZGOHpISVF5Z0FGUjhhQXZS\nNnBmMnIwYVMwOUFoOEJwN2FpNkRZCi0tLSBraUg2NE1tM1FjQTk0M3c5ZEwyODV5\neFNIc3M4OFpzOCtCbFdoaGZXR3NvCsVpoP8RKmd/wLwjmMpK8fEDlKUF00W5+YRG\nj2qi6sHPNsScgFL5am2P3lKF0kjbhx02C5bZxxocEJ99sRJL3N4=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDNNdTlqNWFq\nOWR4ZS9ZOEdsaGpUWXdrZHJiM3FQTUFDQ1ZCbkJibEhjaWsgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwpjaE5oZ1ZmaWRMRURCbE5TL1krWW1j\ncFh0NjRWWWNFMm5TSitrZ3BnU200Ci0tLSBVYjA1clNLdE85aTdnZGJIbTJQVHhn\nYWFuc1k0Yk04aVdqdFA1SERWRmtjCtBq6UTDH5qMdVLv4zuyvi0JT60a3bmIaD1u\nExb5g0HxtmLZCyXVCj8/+Amj9xdsJ4ppmbp/7gxNkTmas9+K1H0=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIEZUQWtKODg4\nZS9CbmgxODdiTzN0VlAvbTFYL2RaZFd2aXJQcW5JQ2s4Z1UgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp6TlNickJibkdWM2dESzZOdmQwQUZP\nQXJ5ZGd6LzhpcEJ6RnhvdkI5SmxBCi0tLSBVNUoxK0pmZDUxbEpKVnAvOXc1S1Bj\nZzBkemtONXF3aG1kQUlEKzcxME93Cqr0myzB5rHWchu5ppaKVD+Ypg/eWExmvwTJ\nVKptgfdfzfowzIHftRyVNvWzgt+D83QhwmZzELfpv6RGkST4BQs=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMCtGNlRIUUJnYTlvL1ZG\nVXI0UG1uRytsM1J0dHZtbXFyRVFFeTRaK1RRCnoyYWwrU3RWWENyck9lK0xmempI\nQjViN0V4Zzl0WVlFTGhvT3I5ZkpvQlkKLS0tIGVpaWg2aXNiOEtiV0szcWJhMCtj\nNDhJaGk4WnhmZDF3d3NDSUdXTjY2UlEKYyjpIe7bpSgBJ4fMb5j58kjNBqePezmC\nKvqPDSkT9OzAf2Hkgq7cG1CWM95GYjHpeDevoRvSs8l7fCrOUWTV5A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmTWFuQUErcDVYRDZhVVVm\nZzEvZVRGUlVyaEM5OXUzb0plcjNzT1hjcWxNCmF0a3dXZGJXQWgwRWhvcCtha3d1\nMVBNeGI1SloyTzRldm1WbXNqaHA2QUEKLS0tIHUwNUt4MEx0K0xpR09DZWxEa04y\nS1NLZVoydUhGSVBZMHRVd2VZc25xdlUKJRkVkKqDyxtviNppT3Wywj1RJh44hO+H\n2YU1wvfPtkar+Tu6ua0KEtKGEnbQK9woVR1n44aB2pBHrJKOTX3qTw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNUlyUEZ1aktHSE5SUWE3\nRFdreXBabzNKWmhCbjA2V2pnbzkzekkxa1c0ClZQNGJoUmtVSFl5eXpwQXdmM2Rr\nckVTZng3RTM2aWNzYUQvVERJdEJtWXcKLS0tIERWbWhaZlpRK0p2WEhXREZ6aUVZ\nMU9NaVBBNCtaZFVWRlVxaS80aWY3RUUKqlXufjNFkWGT1RylteAtw6ijsYBRvQyL\nHheXQBkZ5DgOXGJ6qlJCEwBh4XC4YB48OzCmf230OsP9QIG9LpX3ow==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTQ2xRVUQxb2YwazhUVlhS\nZTQ5Zjh0eGxjUElyWUFGVmRiSUF5SjhpQUVnCllhSzBoam1nbzZ3eGpJRnRtYlYz\nQVpZak1DQnVOVk9zSWFvQm9adEJKUGcKLS0tIG5xNmlYOUxVZVN5RTN2R2NrZG52\nRll0MDQxNHJVY0U3K2gvTER3NEN4MTgKf3XZWt0f3ml33yI/z/zIWS6FRQf3wAF4\nmIX9dePU8HKnkp3Oy9Cot5hhI9asq1moi1OGNkS2htzP3YUS12a3Bw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-21T09:50:13Z",
+		"mac": "ENC[AES256_GCM,data:9oM++V+iIv6KSy6Yhd16Ocx9moyXRgs04sKTAqIJMja+V+dpN/gznHJmgRW7TbFQKlov7Zi0HNlByWWCipxXF7bAfYTF3/79ZetkF6y2oFWm0ieab3yJbcx/zrQm0k+jEYansME5JHJ4OjF7ZBMPQ6ibtjWQU60LfutVmhjhqR4=,iv:7UeqRTU5puNv95iyKLQBlw9MJTIi9URvImQK7sHmqcw=,tag:1cmR5SMkBA8WpCWxU9JhvQ==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/machines/stellio
@@ -0,0 +1,46 @@
+{
+	"data": "ENC[AES256_GCM,data:Cz0lmpOGYW/Yik8plBEWURzH0eNEwpNSuRH+Vs6bWnNFgBl7MbaR3h9J1ELv,iv:PR/76pDzXAa+zqv28EzUyn3tE0KLXmwXFKjszGmGQhU=,tag:k6IhDQKXwJOc1qO82A+ZQg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRldqV3dFV20yV3hYdkVn\nOE85WDcxSE4wd3I3QjBiVFVqL2c2TmRYaUYwCk5IUlNwUm5tZU8xLzd1K28ydFZF\nQjkrYUtCbVd5YS8rUTBwQmhEV2kyc2cKLS0tIHljTlRBRHFIZWY0UWV2cUl2MmRD\neFgvV2NZV3RuZ1p5bEVxSkRuWEtnZlEKGiMnCtln1vSkJqOwZUtNxCO6cATk8xHh\nYTGX7BrX2FeBuGNTezcp29qnGJng2Z62jh6Eb5O4rUovJg5cVAabZA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age17d4qt0n9edq57tgcqyk8eu5mrendl59yt6z2y3a4vkq7el8krqtq6lq28g"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbVc2M0J0dlZxVUx0VndY\nOEsxbFVaM3dRSGZYNDJjVnRSZk9CVmFKalRRCjZOSlhwd0p3UjlKc2dOdEtDM1Ft\nTHBWK3lsb1JOYjhVOEcxSXZJaUxuanMKLS0tIEV3QWtuYTJaYmt6MHRWa2lLRzBI\nZjNteElMUTFENDY0S2xsSU9KUnVlZWMK5HXz/YBmGvERAfVjwl7IsMOEABkv9sV+\nrlI5I/GFkOHxzeR5TeF5YOqnSd5oLQDHtYlovYV1drdeN4yfd9lLNw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ez6597tgxg7xxpm6lqv30z82sa97c04afq4wlmw8qspm8pq4m33s86fxz7"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIDdVU1lIZTE5\nNEw2Y2lJaHI5TzlKV1c4REVvVnhzNGtkbjZwT1RpVUFwVmcgQVEgd0l6SlBCVW1v\neDl5N0lHYmVrajZzVzVTYjd4WVdNVjZoZVlkUEtmVXlMdyBIdmtoczF0dmhxL1py\nS1hsc0ErckdoVVB0bE02RGdCNW5raERXT1ZJMTkzNjRGNHd2T3ZSTVYrKzZlbEll\nVTZKc2JVN1B2SzRuNkpaekhwSWJQaFZVQQpMdUM4Yjhwa2RvTnBaeW9Ic1dMVmVo\na3BWWC9ZYmRzZEJNZ0U0d1BsQTVjCi0tLSBuRi95TG1NNDltRy9pY0FCbGNqU0FM\nZnloNmZmbEdDTnFLSlhOaTZzeHNRCsJEYSr/Zyj45cp1CYZwTAZZuS9C+65EZJ8Y\nga6faEEo1Fa11CNhaN3wvqqiGwZhN3CPboVAo7giQkXbpmrvbHE=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpf43tgcfjm048lsqskvq34w2t4uvrm5qy6m2eg6zjj82ctca8wctgpczxvj0q4y6337uhvsxdh5j86k9h9ymautpvv2759ucwnef75ez7pa7fpkddklp40mxk2tedsp74359g0kefn5rsq0x0yss6cu4yd0h06up0rp08t6yc4l0hfa9y8jn5fkx6nk0hjhz06ykwv0fyxe7z42q683jy0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGdYMkJpTHBK\namxlT3RUUlRCTnJtSG1GVmtlK21NL2NpaUNJZGNOTGVjM0UgQVEgZlFBRFNyWkNS\nRDJQaUJ3WWowTEcwaTk0Z0tiRHpQNmhkMTJZUlZHbHlEMCBtMzE5bzVQb1JmZkpy\nY0orbEs2RzBSVXA3UmZYZkRRanNnc2pHSnJjK1pLVmZOWGR4d0IwZjh1YXlkakRx\nTm5EMXR3ZjNHWGl0Ty8rcHpQbkcxRTZmZwo3QlBIbTNncVpnaytEN0NqY01lTXdG\nZ0FURDgvQ2I1Z3BHNTVTNWxEeUs0Ci0tLSBmbnlvSTNQSXRVejgrMXlubGVMM1Za\ncE8wdkoxQW8rUk5YSTdWOW52dytvCm9c8ogdR3gHsTVTqcbObhfQXsNXO0nudh3M\njiTX9BPxZDuIf8OaL0Kh0M/p4U0UNmSBj+SsEctCkBf0a1lHhHc=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqprw0vfpc8wzsu78quc777kmee54ln6nnsjrnrhl7nr33eh4kvkksqp05qqxj4kgfzrmrugrsvg7skx6ghh3q9xc0x0agthtkvy25d9eq7eklta5wf7s30hexkuyl5546rdz9ffa5tawlp5yweqkgccntw0ny540n2am3cqw3luhxkfmrp63kwr6mwplhr9u26wll48x0n3k5f60c7hg9a3"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IGZpZG8yLWhtYWMgQUFJIGN2U0t4eTJL\nN0ZiSldQZUpCOHFxU1V4L3RPMkwwVUExY3Fxc3A0cVM4MUEgQVEgZUh4S2o1R2RE\nV0svbnErTmxodXE2bUxJK3lla2lvajB3OXVwZHJtcHU5dyBKU3I4WFJnK3BOQXl0\nZDh5NTB5ZFlteFJIM2FVTVp5cmNyRXZqL1V0c0l6L0tSb0c5ZU9jbmRXMTIwb2c1\nQjZsREgzWUxaOXBUd2pQK2NncDZuUmZkZwp1VnJudlBKVUp2YTl6U200Y3A1ZFh3\neWtXTXBhamJsWEZJQ0VxeXhSRWQwCi0tLSBqWnNJdkJzSGdqNkRGcDRnY2lQbFU3\nRFNOZm1YUUdPR1pGalczN1h5VmUwCuRg39/4XjF4JDNKbYBD9uFK/YE/xjEkcBPY\n+niwkk0bVMim7/+w5ROiJERPYffn1dyBm8YOauwE9DfSvd/yhdI=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1fido2-hmac1qqpyewum3q8dfcumfgec8nn958aec9f4q9aqy0k06kw5kq27d6fdqdgp0p7y4ru3n5xk90u747xevxa2af3v37e85j9g3axrmw5hdwdfh0wz22hut5vrafxsx26a7vh8fjwkymz3ramfgvvu4detztu075kmpr8l9ydqda0rnjwatdwmfgswg849p37astvld98s3nleeq575azlwc2hhpuh"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENEdHTmRBUmhGUWx4b0Zx\nTnBKbHFpc1FBSkoyKzZPZzdlcXRpTUtKZzJvCkRBN1hZV1FXbTZDbHpaSXhHZVZH\na1BMV0xyUWF3cCt5N010ZGxuRk42WkEKLS0tIHRBbko0dmQrN3hobVpXdHprQjBk\nWEhhc0krRnlmZmpySVVhK1ZCS1Q3UDAK390KtJjWaiASVW63zzvFFBBup5Wo/DsH\nwzp4AEM0x4i+QgSAFEwFEtgpfitIxE/F+EV2CPkTmyccygGShbIcHg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQUxzWGJoa3QxRnQyelNq\ncitoVGFOZEE4a29sTTc5Snc4a0JnejAyVERZClE3S2pVb25Gd2FkK21IZ284VVVi\naVJnOVkzSzAveUFsVFZTQ1JTb3VnencKLS0tIEMzSHMrSTRpbk1TeWFOdjFZRFRC\nSnQvZS8yUjdyQmZtd0RBTkpBR0lLZmMKOug+UtHoNLVJMhBMmlsdA2xGY28IA5q2\n1+L6+KK3A/8sqtLzBBh+ev5SKaLgnCKs2WKz/BcNkiBBxGRu/4DPfA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1sg0rvgyetdcqw7j2x983fh69kdkvqsngpe5x36e5920qa7fze3cqhj4wgx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUHhqR0NqVzJZRWp2UzB1\nZmFzMldjZXVRaFZGbGN3Mk9scitBY3JpRFRvCnpHS3NhTkZkYVYwWHRkZHBNMzl4\nR05wSUhmdGFhc2d2WEtVcVV2aWlSY0UKLS0tIEFWY09lQWd3R1psWFFkZGZCUHcv\nRVJYNW0vUTJXblJoS3E0dU94LzNiTjAK98FCTYD6x8KbN6Ugkpo3mUwl8rZETQkh\nby9ZWMcBuk7kZCWQ/HcCNZq3JutDl29k8Zjj/xJmqemw+lqVY9AAmg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1swlyyk2rzvevqawyeekv75nx2dz34zpe3xqhkqme26gcgeavy4dqrfpcd8"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTHgxTFI3cFZQeWhQaXh1\nUmdiSjR3LzUrWUg5M3pzdFJWdnB4b3NxWXpZCmxBbCtqVkp1VmlPdXZMSXpvcDJx\nUUREMDduc0RQVmtIc1JuN3JFZFNycnMKLS0tIGQvY211aUI4dFQxS0FGTllXV2N6\nWEd1VHBNNGpmeGpUa00zL05WNDZueVkKUWA+iHXydSwQByEXmGHVWhFM0jp8dJGG\ncy2Dy8SOeQQt+h4wx3MNrfQn2IW0RWUOzszutp+03rRJmcX+ZNNp1g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1vphy2sr6uw4ptsua3gh9khrm2cqyt65t46tusmt44z98qa7q6ymq6prrdl"
+			}
+		],
+		"lastmodified": "2026-09-21T09:50:14Z",
+		"mac": "ENC[AES256_GCM,data:ims4gXwRuyDeRFCi/uhU0BYkVrlkG4Tdldz1PQMTgz+vcQwQUN7fmzXOBEKyyOuQi0IcxyLCCs9+C6FqfCoaOcuO6k7J1IjZ9t+/OrL/DG/Jh6kRk/jIh8I8hq0bsBjiqHjv4nvg5mf04EF3YbzGIi9GL6r6ktgaZVyKMEwAHsA=,iv:ouyE4KNY2V2IfhWSB88dGYE5O530joJIOeoV/vkZphc=,tag:2zt6NhJO73adFDkvYBRW/g==,type:str]",
+		"version": "3.13.3"
+	}
+}
@@ -0,0 +1 @@
+../../../../../../sops/users/kurogeek
Author	SHA1	Message	Date
kurogeek	12f6be1239	stellio: define the GL-AR750 / GL-AR750-5 Wi-Fi networks the radios reference `6d06356` pointed wlan0/wlan1 at these SSIDs but wifi.networks still only declared WhiteHouse, so hostapd evaluation failed on a null network. One SSID per band on lan, named like the GL-AR750 being replaced; passphrases come from the wifi-GL-AR750-passphrase / wifi-GL-AR750-5-passphrase prompts.	2026-09-21 09:54:34 +00:00
kurogeek	e276428b37	vars: update via generator wifi-GL-AR750-passphrase (machine: stellio)	2026-09-21 16:50:14 +07:00
kurogeek	fb0cb8e9ac	vars: update via generator wifi-GL-AR750-5-passphrase (machine: stellio)	2026-09-21 16:50:13 +07:00
kurogeek	6d063561e7	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/router.nix	2026-09-21 15:49:55 +07:00
kurogeek	a48a4300eb	stellio: NAT LAN/Wi-Fi out the staging uplink; cross-safe Blocky check cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets `defaultroute-metric 0` so the PPPoE route is installed next to the staging DHCP route instead of being refused. Also makes CrowdSec opt-in upstream (stellio leaves it off). The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64 builder without binfmt cannot execute (`--max-jobs 0`); validate the same YAML with the build host's blocky until the router service carries this.	2026-09-21 08:11:19 +00:00
kurogeek	6d131cc727	flake: bump cnx-network so Kea waits for its VLAN sockets f98226b -> 4146f2c. kea-dhcp4-server started before networkd had addressed vlan-lan/vlan-mgmt on stellio and ran with no socket on :67; Kea now requires every configured socket and retries the bind while networkd catches up.	2026-09-18 10:10:49 +00:00
kurogeek	8a2d67c7a0	flake: bump cnx-network for the wifi bridge enslave fix 60aac6e -> f98226b. Wireless BSS .network files now match on WLANInterfaceType=ap so networkd enslaves the radios to br0 only once hostapd has switched them to AP mode; on stellio (mt798x-wmac) the earlier one-shot enslave failed in station mode and wifi clients never reached Kea. Also picks up the assertion that no supplicant owns the radios.	2026-09-18 09:41:47 +00:00