guix-router/docs/INSTALL.md

Installing guix-router

Guix System with the OpenWrt userland (netifd, firewall4, dnsmasq, odhcpd, LuCI, hostapd) and TollGate, for two devices:

	Raspberry Pi 4	GL.iNet GL-MT6000 (Flint 2)
Image	guix-router-rpi4.img.zst	guix-router-mt6000-root.ext4.zst + guix-router-mt6000-boot.itb
Installer	flash-rpi.sh (or any image writer)	install-mt6000.sh
Admin address	WAN side, by DHCP	192.168.2.1 (wired ports)

Check the download first: sha256sum -c SHA256SUMS.

Before you build

The images contain the SSH key files/workstation.pub (root logins) and the Guix signing key files/workstation-guix.pub (deploys) of the tree they were built from. To build your own, put your keys there and run ./build-release.sh. SSH accepts keys only.

Raspberry Pi 4

1. Write the image to a microSD card or USB SSD (8 GB or more), whole disk, not a partition -- check the device with lsblk:

   sudo ./flash-rpi.sh /dev/sdX guix-router-rpi4.img.zst
   

   (Or zstd -dc --long=27 guix-router-rpi4.img.zst | sudo dd of=/dev/sdX bs=4M conv=fsync; Raspberry Pi Imager and balenaEtcher take the decompressed .img.)

2. Ethernet port = WAN: connect it to your upstream network (DHCP).

3. Power on. The root file system grows to fill the card on first boot, and the Pi reboots once by itself after setting up WiFi and TollGate (about two minutes in all).

4. Log in over SSH from the upstream network: ssh root@<the Pi's WAN address> (see your upstream router's DHCP leases; host name pirouter).

The LAN is WiFi only (br-lan, 192.168.10.1/24). After TollGate's first-boot setup it is an open TollGate-XXXX network with the captive portal; LuCI is on port 8080 (from the WAN side, through ssh -L 8080:127.0.0.1:8080). The Pi's WiFi chip runs one access point only, so the private WPA2 network TollGate's setup also configures (c08r4d0r-XXXX, br-private) stays down.

GL-MT6000

Requirements: the router still has GL.iNet's stock U-Boot (true for stock firmware, OpenWrt, and earlier guix-router installs); a Linux computer with dnsmasq, zstd, curl, ssh, nc and an Ethernet port.

1. Cable the computer's Ethernet port to one of the router's LAN ports (1G ports, not the 2.5G WAN port). Keep the router powered off or let it run -- the installer will ask for a power cycle.

2. Run, with your Ethernet interface name (ip link):

   sudo ./install-mt6000.sh enp2s0
   

3. When asked, unplug the router's power and plug it back in. GL's U-Boot fetches OpenWrt's official initramfs from the computer over TFTP (about 3 s after power-on), OpenWrt starts from RAM, and the installer writes the Guix root file system and boot image over SSH, verifies both, and reboots. It takes a few minutes. Everything on the router except the bootloader and the factory partition (MACs, WiFi calibration) is replaced.

4. The first boot sets up WiFi and TollGate and reboots once by itself; about two minutes later: ssh root@192.168.2.1. LuCI: http://192.168.2.1:8080/.

Network after the first boot:

Port / network	Role
2.5G WAN port (eth1)	upstream, DHCP
lan1-lan5 + WiFi c08r4d0r-XXXX (WPA2)	private network 192.168.2.0/24: the owner's, admin access
WiFi TollGate-XXXX (open)	public network 192.168.1.0/24 behind the TollGate captive portal; no admin services reachable

Read the private WiFi password with ssh root@192.168.2.1 uci get wireless.private_radio0.key.

After installing (both)

• Set the root password -- it is the lab default guix until you do, and LuCI and the serial console use it: ssh root@ROUTER passwd. (Guix keeps a password set this way across updates.)
• TollGate keeps its wallet and Nostr identity in /etc/tollgate. Its status: tollgate status; take the earnings out as a Cashu token: tollgate wallet drain cashu. Check /etc/tollgate/config.json's mint URLs and payout (profit_share) settings.
• WiFi passwords, LAN addresses, firewall: LuCI or uci -- they are kept across updates.

Updates

From a checkout of the tree the release was built from (with the Guix signing key whose public half is in the image):

./deploy-rpi.sh             # Pi:     ROUTER via ~/.ssh/config "pirouter"
./deploy-mt6000.sh          # MT6000: "mt6000" (root@192.168.2.1)
./deploy-mt6000.sh list     # generations
./deploy-mt6000.sh switch N # roll back

Recovery

• MT6000, nothing boots: run install-mt6000.sh again -- U-Boot's TFTP fetch happens on every power-on, so no button is needed. Or hold the reset button while powering on for GL's web failsafe at http://192.168.1.1/ and upload an OpenWrt image.
• MT6000, a deploy doesn't come up: if SSH works, deploy-mt6000.sh switch N to the previous generation; otherwise reinstall as above.
• Pi: the U-Boot menu (serial console) lists every generation; or re-flash the card.