mob next [ci-skip] [ci skip] [skip ci]

lastFile:inventories/router.nix
stellio: NAT LAN/Wi-Fi out the staging uplink; cross-safe Blocky check
2026-09-21 15:49:55 +07:00 · 2026-09-21 08:11:19 +00:00 · 2026-09-18 10:10:49 +00:00 · 2026-09-18 09:41:47 +00:00
3 changed files with 28 additions and 7 deletions
@@ -181,11 +181,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789610252,
-        "narHash": "sha256-k8rD1LMf17vAf+fS9lVC4Yp0C6ok5mYVtfZAsKC6Wy8=",
+        "lastModified": 1789975217,
+        "narHash": "sha256-n7L5vHbyemIa5jzlueIdpWmQsQSkv5Rrf9JV5kTZ6uU=",
        "ref": "clanService-router-ai",
-        "rev": "60aac6efb277a12c24fde29eb77422b3c3519df4",
-        "revCount": 194,
+        "rev": "596ac1f4bb851af3e03c06ba286cb33ae36095d2",
+        "revCount": 201,
        "type": "git",
        "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
      },
@@ -67,13 +67,13 @@ in
            band = "2g";
            channel = 2;
            wifi6 = true;
-            networks = [ "WhiteHouse" ];
+            networks = [ "GL-AR750" ];
          };
          wlan1 = {
            band = "5g";
            channel = 36;
            wifi6 = true;
-            networks = [ "WhiteHouse" ];
+            networks = [ "GL-AR750-5" ];
          };
        };
      };
@@ -1,4 +1,10 @@
-{ inputs, lib, ... }:
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 {
  imports = [
    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
@@ -27,5 +33,20 @@

    clan.core.settings.name = "stellio";
    clan.core.settings.machine.description = "Flint-2 router";
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
  };
 }
Author	SHA1	Message	Date
kurogeek	6d063561e7	mob next [ci-skip] [ci skip] [skip ci] lastFile:inventories/router.nix	2026-09-21 15:49:55 +07:00
kurogeek	a48a4300eb	stellio: NAT LAN/Wi-Fi out the staging uplink; cross-safe Blocky check cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets `defaultroute-metric 0` so the PPPoE route is installed next to the staging DHCP route instead of being refused. Also makes CrowdSec opt-in upstream (stellio leaves it off). The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64 builder without binfmt cannot execute (`--max-jobs 0`); validate the same YAML with the build host's blocky until the router service carries this.	2026-09-21 08:11:19 +00:00
kurogeek	6d131cc727	flake: bump cnx-network so Kea waits for its VLAN sockets f98226b -> 4146f2c. kea-dhcp4-server started before networkd had addressed vlan-lan/vlan-mgmt on stellio and ran with no socket on :67; Kea now requires every configured socket and retries the bind while networkd catches up.	2026-09-18 10:10:49 +00:00
kurogeek	8a2d67c7a0	flake: bump cnx-network for the wifi bridge enslave fix 60aac6e -> f98226b. Wireless BSS .network files now match on WLANInterfaceType=ap so networkd enslaves the radios to br0 only once hostapd has switched them to AP mode; on stellio (mt798x-wmac) the earlier one-shot enslave failed in station mode and wifi clients never reached Kea. Also picks up the assertion that no supplicant owns the radios.	2026-09-18 09:41:47 +00:00