# Installing guix-router Guix System with the OpenWrt userland (netifd, firewall4, dnsmasq, odhcpd, LuCI, hostapd) and TollGate, for two devices: | | Raspberry Pi 4 | GL.iNet GL-MT6000 (Flint 2) | |---|---|---| | Image | `guix-router-rpi4.img.zst` | `guix-router-mt6000-root.ext4.zst` + `guix-router-mt6000-boot.itb` | | Installer | `flash-rpi.sh` (or any image writer) | `install-mt6000.sh` | | Admin address | WAN side, by DHCP | `192.168.2.1` (wired ports) | Check the download first: `sha256sum -c SHA256SUMS`. ## Before you build The images contain the SSH key `files/workstation.pub` (root logins) and the Guix signing key `files/workstation-guix.pub` (deploys) of the tree they were built from. To build your own, put your keys there and run `./build-release.sh`. SSH accepts **keys only**. ## Raspberry Pi 4 1. Write the image to a microSD card or USB SSD (8 GB or more), whole disk, not a partition -- check the device with `lsblk`: sudo ./flash-rpi.sh /dev/sdX guix-router-rpi4.img.zst (Or `zstd -dc --long=27 guix-router-rpi4.img.zst | sudo dd of=/dev/sdX bs=4M conv=fsync`; Raspberry Pi Imager and balenaEtcher take the decompressed `.img`.) 2. Ethernet port = **WAN**: connect it to your upstream network (DHCP). 3. Power on. The root file system grows to fill the card on first boot, and the Pi reboots once by itself after setting up WiFi and TollGate (about two minutes in all). 4. Log in over SSH from the upstream network: `ssh root@` (see your upstream router's DHCP leases; host name `pirouter`). The LAN is WiFi only (br-lan, 192.168.10.1/24). After TollGate's first-boot setup it is an open `TollGate-XXXX` network with the captive portal; LuCI is on port 8080 (from the WAN side, through `ssh -L 8080:127.0.0.1:8080`). The Pi's WiFi chip runs one access point only, so the private WPA2 network TollGate's setup also configures (`c08r4d0r-XXXX`, br-private) stays down. ## GL-MT6000 Requirements: the router still has GL.iNet's stock U-Boot (true for stock firmware, OpenWrt, and earlier guix-router installs); a Linux computer with `dnsmasq`, `zstd`, `curl`, `ssh`, `nc` and an Ethernet port. 1. Cable the computer's Ethernet port to one of the router's **LAN ports** (1G ports, not the 2.5G WAN port). Keep the router powered off or let it run -- the installer will ask for a power cycle. 2. Run, with your Ethernet interface name (`ip link`): sudo ./install-mt6000.sh enp2s0 3. When asked, unplug the router's power and plug it back in. GL's U-Boot fetches OpenWrt's official initramfs from the computer over TFTP (about 3 s after power-on), OpenWrt starts from RAM, and the installer writes the Guix root file system and boot image over SSH, verifies both, and reboots. It takes a few minutes. Everything on the router except the bootloader and the `factory` partition (MACs, WiFi calibration) is replaced. 4. The first boot sets up WiFi and TollGate and reboots once by itself; about two minutes later: `ssh root@192.168.2.1`. LuCI: . Network after the first boot: | Port / network | Role | |---|---| | 2.5G WAN port (`eth1`) | upstream, DHCP | | lan1-lan5 + WiFi `c08r4d0r-XXXX` (WPA2) | **private** network 192.168.2.0/24: the owner's, admin access | | WiFi `TollGate-XXXX` (open) | public network 192.168.1.0/24 behind the TollGate captive portal; no admin services reachable | Read the private WiFi password with `ssh root@192.168.2.1 uci get wireless.private_radio0.key`. ## After installing (both) - **Set the root password** -- it is the lab default `guix` until you do, and LuCI and the serial console use it: `ssh root@ROUTER passwd`. (Guix keeps a password set this way across updates.) - TollGate keeps its wallet and Nostr identity in `/etc/tollgate`. Its status: `tollgate status`; take the earnings out as a Cashu token: `tollgate wallet drain cashu`. Check `/etc/tollgate/config.json`'s mint URLs and payout (`profit_share`) settings. - WiFi passwords, LAN addresses, firewall: LuCI or `uci` -- they are kept across updates. ## Updates From a checkout of the tree the release was built from (with the Guix signing key whose public half is in the image): ./deploy-rpi.sh # Pi: ROUTER via ~/.ssh/config "pirouter" ./deploy-mt6000.sh # MT6000: "mt6000" (root@192.168.2.1) ./deploy-mt6000.sh list # generations ./deploy-mt6000.sh switch N # roll back ## Recovery - **MT6000, nothing boots:** run `install-mt6000.sh` again -- U-Boot's TFTP fetch happens on every power-on, so no button is needed. Or hold the reset button while powering on for GL's web failsafe at and upload an OpenWrt image. - **MT6000, a deploy doesn't come up:** if SSH works, `deploy-mt6000.sh switch N` to the previous generation; otherwise reinstall as above. - **Pi:** the U-Boot menu (serial console) lists every generation; or re-flash the card.