Volatile journald (64M), tmpfs /tmp, no core dumps, and noatime + commit=60 on the ext4 root so the small periodic writers (Kea leases, timesyncd clock, speedtest textfile) coalesce. Logs are kept in RAM rather than dropped: pppd/kea output is the main debugging tool on a gateway.