#guixrouter — Public Fediverse posts

I love how easy it is to upgrade my #guix router to fix security problems. Basically just guix pull on my build server and then guix deploy the config and reboot --kexec total downtime less than 30 seconds.

#guixrouter

I'm imagining my #guixrouter having a default tunnel to Google and Cloudflare DNS, and then all the guixrouters register themselves somehow over i2p so that a guile script can grab a set of random i2p addresses and set up a service where DNS is resolved over i2p to other guixrouter instances that forward to google/cloudflare.. we keep each other safe from DNS surveillance...

Ok, family and friends and #guix peeps, the #guixrouter initial push is up on codeberg as promised.

https://codeberg.org/dlakelan/guixrouter

There's also a semi-extensive discussion of how to use it in the README which is visible at the repo page, it probably needs a bit more discussion in the readme even, so I'll be working on that. Right now, I'd love it if people take a look and If you have questions put them here or in an issue and I'll try to write answers into the README.

So on the #guixrouter project I'm just about ready to publish. I need to remove all the specific stuff about my network in ONE more file, do a final check, and then push it to codeberg. Expect an announcement maybe tomorrow?

Does anyone want to test it out? I think the easiest way is with a Proxmox server and the qcow2 image off guix site: https://guix.gnu.org/en/download/

You make a VM, import the qcow2 disk, and follow the config instructions on the codeberg site once they're pushed out... LMK

Default services right now:

squid proxy, dnsmasq, unbound DNS over TLS, wireguard, yggdrasil, keepalived, tor, i2p, zabbix agent, prometheus exporter, ntpd client and server, dhcpd for upstream requests, nginx reverse proxy, letsencrypt, ssh, custom nftables firewall, and HFSC qdisc traffic shaper

Sounds interesting? I'm beginning to port it over to an independent repo so I can put it on codeberg

#guixrouter

Ok, so it was not hard to get i2pd running on the #guixrouter. And it has a way to limit the number of transit connections, so I can probably prevent it from eating up my connection budget, so i2p is a go for default services on the router.

@GhostOnTheHalfShell
OpenWrt on a Raspberry Pi 4 with a ue300 USB NIC was my router from 2020 to 2025 when I shifted to my #guixrouter VM. It would handle a gigabit connection without breaking a sweat.

@alienghic
Well 3 of them used to be desktop PCs for my kids or a media PC for our front room. So they were kinda "free". They run as a #proxmox cluster so you need an odd number for quorum. Right now they host a #homeassistant VM, a VM thats a #Cfengine3 policy server, my #guixrouter which routes and traffic shapes the entire network, a 2 node #glusterfs cluster thats our home NAS (hosts home dirs for desktop machines), a #guix build VM, and a #yunohost machine hosting #Immich, and #Zabbix

Where are my #ipv6 experts at?

My #guixrouter is having problems where when I restart its networking, it can respond to neighbor discovery, but after some time... it stops receiving neighbor discovery requests (they don't appear in tcpdumps). I think this must be either something to do with my switch or something to do with the linux bridge on the proxmox host... why would this happen? I can see the ndp snooping entry disappears on switch, but it happens even if ndp snooping is off

@doachs ?

Right now my #guixrouter uses unbound to forward upstream queries to Cloudflare DNS over TLS.

I'm thinking of moving that to DNS over Tor. How many of you do your DNS over Tor and how reliable is it? Since unbound doesn't handle this directly with socks proxy options, I'm thinking of using socat to open tls connections to like 4 DNS over TCP services through the Tor proxy (say 1.1.1.1 and 8.8.8.8 and their ipv6 versions) and then have unbound open 4 TCP streams to locally bound ports

#guix

Saw the message from @guix about a potential security issue this morning. did a #guix pull and deployed to my #guixrouter, problem was fixed within 10 mins of seeing the announcement. So great for an internet facing device. My previous Raspberry Pi 4 device running the Pi OS got updated rarely because of the difficulty of doing it while keeping network online (2 or 3 times in 5 years). This is a substantial security improvement for me.

#guix experts, for my #guixrouter I am trying to add the tor snowflake proxy, and I'm getting a problem with conflicting versions of some dependency. Screenshot is hard to read so I'll give the gist of it in the next post. Anyone got an idea how to handle this? The idea is at root default profile I want to run yggdrasil and the tor snowflake proxy contained in the go-gitlab-torproject-etcetcetc package, but those two packages want different veresions of some go quic library?

Ive been making a bunch of steady progress on the computer projects I have. For example ive got Tor doing relay on my router. Ive got storage for my Yunohost. Ive got both my kids laptops working, ive got backups for my laptop, and backups for my NAS, etc.

So one thing I'd like to get back to is cleaning up my router and making it public. for those interested in the #guixrouter who would be interested in doing testing? i really can't test on my network.

#guix

Is anyone using #frrouting in #guix? I'm trying to get babeld to run over my VPN network. I've got it running on the remote end where it's OpenWrt, I want to start frrouting on my #guixrouter and have it start babeld and use similar settings, it look like /gnu/store/...-frrouting/sbin/frrinit.sh should be run to start the daemons and it'll default to looking in /etc/frr/daemons and /etc/frr/frr.conf

but is there a guix approved way to get this up and running or is it roll-your-own?

One of my projects for the 2 week christmas break we're doing is to finally put together and upload the #guixrouter to a Codeberg site. Merry Christmas y'all I hope I am able to give you guys that gift, and that a few of you will test it out and provide some feedback. #guix

I have a few more things I want to do with the #guix router project. I want to configure tor, and i2pd, which should be straightforward, and I want to detect and fail over between my Fiber WAN and my backup LTE modem WAN2. Today I worked on the fail over. I'm detecting failure with more than 2 ping packets lost in both of 5 pings to 2 separate services using fping and binding to the particular device. Fail over just involves raising the metric for the route. #guixrouter

#guix pull, followed by deploy of my config to my router confirms that the new default for keepalived works and the #guixrouter comes up properly. Took a few minutes, `reboot --kexec` had the system back up in about 30 seconds. I almost could have watched a youtube video with enough buffered to not even notice the router downtime.

For my #guix friends who are following the #guixrouter project, they merged my keepalived change, so now keepalived by default depends on networking so it doesn't come up and fail if your network isn't up properly. Which means I can guix pull and rebuild my router without my special patched fork. So I'll do that, and then think about how to generify the setup so it can be used by others and put on codeberg.

Well, my #guix peeps, I just used pre-inst-env guix deploy to build my router's OS definition on my build machine and deploy it to the router using the modified guix which has my patches to make keepalived have adjustable requirements... if my router comes up properly I will file a PR for the keepalived stuff. IF not, I will simply roll-back to previous config 😉

I am enjoying the hell out of this #guixrouter

@cwebber

Right now It's a little personalized to my setup, but I plan to create a new branch in my repo, clean it up for consumption and push that to codeberg probably in the next couple weeks.

follow the #guixrouter tag to get updates.

@cwebber

*blushes* just little old me, learning Guix by transferring my Debian router functionality to guix. I've been tagging posts about it as #guix and then #guixrouter as well more recently.

Right now I'm routing my network via a VM on proxmox running Guix. Will describe features in followup post thread. 1/n

Things I figured out: how to get logged in as root to the mariadb, how to create a zabbix user, and how to populate the schema... Things I haven't figured out yet.. How to get zabbix to connect without using TLS.

#guix #guixrouter

I added zabbix agent and prometheus exporter to the #guix router and of course now I have to create a zabbix server to aggregate that info so there's another guix VM coming online... that's what I'm up to next. Soon it will be mine all mine ... MUAHHAHAHAHAHA sorry nevermind.

#guixrouter

#guix peeps, and #guixrouter fans as well as #git literati...

I have a config that's pretty good, it's all based around my personal needs including secrets and network numbering and host names and etc. I'd like to branch the git and build a "generic" version, then create a new repo on codeburg and have it start at the HEAD of my generic branch with no history from before that... How?

YAAAAS... #guix router now has yggdrasil running correctly! There's really just one thing holding me back from calling it version 1.0 and that's keepalived not having a requirements option so you can get it to start at the appropriate time. I'll look into that soon, but for the moment if I log in and restart keepalived it runs and provides all the features and more of my old router. (more = nginx and certbot). I turned off my old RasPi4 router this morning.
#guixrouter

Well my fellow network nerds... Part of the rush to get a #guix router online has been because I know my mother's Raspberry Pi has required several reboots in the last month or two... Finally this afternoon there was no internet at her house, and a power-cycle did NOT bring it back up. I'm having Amazon do an overnight delivery of a Gl-inet Beryl device similar to what I was using at our fire-evacuation apartment. That'll get her back online tomorrow. #guixrouter

One thing that would be nice to have is WAN failover. I've got a 4G/LTE modem and a service we bought because of the fire. It'd be nice to have it detect if my regular Fiber WAN is down for more than say 2 minutes and failover to using the LTE modem.

If I have both WANs up but the LTE has a higher metric, and then I detect a failure on the regular WAN and raise the regular WAN metric above the fallback... that should be enough to cause everything to start routing?

#guix #guixrouter #routing

I've only got a few must-have items left on my #guix router list. One was a reliable timer for duckdns updates. That required setting some PATH type variables at the top of the script because it worked fine in my personal profile, but didn't work in the system profile. Both the regular PATH and the path for the curl certificate store... but they were trivial once figured out. Now it updates the duckdb every 5 minutes, which is perfect if the power goes out or whatever #guixrouter

So, it's been on the net a few days now and my #guix router is currently being continuously hammered by some particular ipv4 for ssh connections to root. My firewall permits 10/minute and the password is disabled and the acceptable public key is mine only. so i'm not too worried about it... but yeah this is an annoyance that continuously fills the logs... I usually just put up with this, but I'm thinking maybe I should set 1/minute with a burst of 15 or something.

#guixrouter