liminix, branch HEAD

gateway: set o+r on resolvconf outout so dnsmasq can see it

2026-10-03T22:18:57Z

commit c7e18c193b543c4d09a642a6a263a7fe74baee07 parent cf115867ed52c0c73918e54e9aa55cb4b18e9d85 Author: Daniel Barlow Date: Sat, 3 Oct 2026 23:18:57 +0100 gateway: set o+r on resolvconf outout so dnsmasq can see it dnsmasq needs read permission on resolv.conf _and_ on the directory it lives in, because it sets up an inotify watch there

upgrade Turris Omnia kerne; to latest LTS

2026-09-29T21:22:17Z

commit cf115867ed52c0c73918e54e9aa55cb4b18e9d85 parent 8362f19d485bbce8c038825ee9525c3822f2300b Author: Daniel Barlow Date: Tue, 29 Sep 2026 22:22:17 +0100 upgrade Turris Omnia kerne; to latest LTS

remove firewall DCCP support

2026-09-29T21:21:21Z

commit 8362f19d485bbce8c038825ee9525c3822f2300b parent dc391172f27b79c953a365014922a52363a8be31 Author: Daniel Barlow Date: Tue, 29 Sep 2026 22:21:21 +0100 remove firewall DCCP support

rotuer: remove obsolete log shipping stanza

2026-09-27T21:26:56Z

commit dc391172f27b79c953a365014922a52363a8be31 parent 73fbab8c4f0ae9264fc9a8f7517175767bd5fc35 Author: Daniel Barlow Date: Sun, 27 Sep 2026 22:26:56 +0100 rotuer: remove obsolete log shipping stanza

a note about LLMs (don't)

2026-09-18T22:19:23Z

commit 73fbab8c4f0ae9264fc9a8f7517175767bd5fc35 parent 49e0815fb69d417df910cc01e612e8c8ae4648b5 Author: Daniel Barlow Date: Fri, 18 Sep 2026 23:19:23 +0100 a note about LLMs (don't)

libubootenv: hack cmake version

2026-09-18T21:57:32Z

commit 49e0815fb69d417df910cc01e612e8c8ae4648b5 parent 15b6e114e37a75b091d3ca5d5e1ac59e46e6ea42 Author: Daniel Barlow Date: Fri, 18 Sep 2026 22:57:32 +0100 libubootenv: hack cmake version

override btrfs root options as this is ext4fs

2026-09-18T21:45:01Z

commit 15b6e114e37a75b091d3ca5d5e1ac59e46e6ea42 parent 9630a08649249598c1d172f15bff56ee49fbf0bd Author: Daniel Barlow Date: Fri, 18 Sep 2026 22:45:01 +0100 override btrfs root options as this is ext4fs

rewrite boot.lua to work on turris omnia

2026-09-18T17:12:12Z

commit 9630a08649249598c1d172f15bff56ee49fbf0bd parent 3d7c017623a8de95a13c383a990e4d35e0633e18 Author: Daniel Barlow Date: Fri, 18 Sep 2026 18:12:12 +0100 rewrite boot.lua to work on turris omnia does it work on other devices as well? don't know. hope so

update deprecated stdenv.isMips

2026-09-17T22:06:30Z

commit 3d7c017623a8de95a13c383a990e4d35e0633e18 parent 2ebb24aa52bcbb7d8b9598f6271bd3de34280251 Author: Daniel Barlow Date: Thu, 17 Sep 2026 23:06:30 +0100 update deprecated stdenv.isMips

securityModel was removed from nixpkgs

2026-09-16T17:40:26Z

commit 2ebb24aa52bcbb7d8b9598f6271bd3de34280251 parent bbfa1525a2bef9724f507ba36d8cb1556d79fc05 Author: Daniel Barlow Date: Wed, 16 Sep 2026 18:40:26 +0100 securityModel was removed from nixpkgs

think

2026-09-13T18:23:37Z

commit bbfa1525a2bef9724f507ba36d8cb1556d79fc05 parent 2838b556f4a09610d496c6ff61be3954114e3f53 Author: Daniel Barlow Date: Sun, 13 Sep 2026 19:23:37 +0100 think

tweak levitate docs

2026-09-13T18:07:57Z

commit 2838b556f4a09610d496c6ff61be3954114e3f53 parent 9e5965c3cc67cf3ba8d99a7ea27887f7a1e0628c Author: Daniel Barlow Date: Sun, 13 Sep 2026 19:07:57 +0100 tweak levitate docs

think

2026-09-07T11:21:33Z

commit 9e5965c3cc67cf3ba8d99a7ea27887f7a1e0628c parent 7af70650d9e4ff43079bcedccacae9e1ec6f7b5b Author: Daniel Barlow Date: Mon, 7 Sep 2026 12:21:33 +0100 think

ssh: improve test for output ref

2026-09-07T11:21:27Z

commit 7af70650d9e4ff43079bcedccacae9e1ec6f7b5b parent a795591e218335ae964630d194f541d585ec71e5 Author: Daniel Barlow Date: Mon, 7 Sep 2026 12:21:27 +0100 ssh: improve test for output ref

secrets subscriber: depend on watched service(s)

2026-08-17T11:59:40Z

commit a795591e218335ae964630d194f541d585ec71e5 parent 717608d954be64afbcff7e4e7f5a119bec9a92a7 Author: Daniel Barlow Date: Mon, 17 Aug 2026 12:59:40 +0100 secrets subscriber: depend on watched service(s) if the secrets service has a long chain of dependencies (e.g https fetch which requires ntp which requires network ...) but the restartable service (e.g. hostapd) would otherwise start at boot, it might have timed out of its restart loop before we even get to the point that it could start successfully with a valid config hand on heart: I am unsure if this is the right thing. maybe secrets-consuming services should be required to provide placeholders if there is no secret yet? the consequnce of adding this dependency is if the secrets service fails, then the services depending on it will all be brought down

fix typo

2026-08-17T11:57:38Z

commit 717608d954be64afbcff7e4e7f5a119bec9a92a7 parent ad8690cb89febcb620f14a2e853a7972f550af5b Author: Daniel Barlow Date: Mon, 17 Aug 2026 12:57:38 +0100 fix typo

Merge remote-tracking branch 'pcc/fix4'

2026-08-10T19:53:21Z

commit ad8690cb89febcb620f14a2e853a7972f550af5b parent bf53297091c9d908f1d83560b78af97bc675c099 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:53:21 +0100 Merge remote-tracking branch 'pcc/fix4'

Merge remote-tracking branch 'pcc/fix-strip'

2026-08-10T19:52:45Z

commit bf53297091c9d908f1d83560b78af97bc675c099 parent 8ccbf00bd68df9284d8d6ffa34d02df1747b5819 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:52:45 +0100 Merge remote-tracking branch 'pcc/fix-strip'

delete pointless "event table: 0x77d6d100" output

2026-08-10T19:48:17Z

commit 8ccbf00bd68df9284d8d6ffa34d02df1747b5819 parent 81222c9c7a58a0e3118d556d7c3b8e6a4209a626 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:48:17 +0100 delete pointless "event table: 0x77d6d100" output

lua script for tio to ftfpboot

2026-08-10T19:46:02Z

commit 81222c9c7a58a0e3118d556d7c3b8e6a4209a626 parent deea138392c19f03e0919f15d447d18dc9f0fea4 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:46:02 +0100 lua script for tio to ftfpboot I have switched from minicom to tio and this is helping

s6-rc-up-tree improve start-service log

2026-08-10T19:42:58Z

commit deea138392c19f03e0919f15d447d18dc9f0fea4 parent b25cda7826ce4fb38706fd49793815f5f96cfb4a Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:42:58 +0100 s6-rc-up-tree improve start-service log

write state and .lock in udhcp service

2026-08-10T19:42:21Z

commit b25cda7826ce4fb38706fd49793815f5f96cfb4a parent 912f5cdf6e0b42ee3b8858c0882f4edc4f371b80 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:42:21 +0100 write state and .lock in udhcp service

delete misleading copypasta doc

2026-08-10T19:41:43Z

commit 912f5cdf6e0b42ee3b8858c0882f4edc4f371b80 parent e25a2d375947690c344c5e46804c126c1291b692 Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:41:43 +0100 delete misleading copypasta doc

Merge remote-tracking branch 'pcc/fix6'

2026-08-10T19:38:53Z

commit e25a2d375947690c344c5e46804c126c1291b692 parent afad526b6ad52d18525409037f03e7bf92a68c1d Author: Daniel Barlow Date: Mon, 10 Aug 2026 20:38:53 +0100 Merge remote-tracking branch 'pcc/fix6'

think

2026-08-10T12:20:19Z

commit afad526b6ad52d18525409037f03e7bf92a68c1d parent ea0a654ead2ab86656277ede2d73b86e3851c036 Author: Daniel Barlow Date: Mon, 10 Aug 2026 13:20:19 +0100 think

json-to-fstree expects service directory not .outputs

2026-08-10T12:17:07Z

commit ea0a654ead2ab86656277ede2d73b86e3851c036 parent 12ef421fb2ec5f6c57d82e8c8943c789fa8c81d3 Author: Daniel Barlow Date: Mon, 10 Aug 2026 13:17:07 +0100 json-to-fstree expects service directory not .outputs

dhcp lease watcher: hold .lock while copying outputs

2026-08-10T12:16:12Z

commit 12ef421fb2ec5f6c57d82e8c8943c789fa8c81d3 parent 0ffad2df1a97a0f9a65967a71a072c0582390c66 Author: Daniel Barlow Date: Mon, 10 Aug 2026 13:16:12 +0100 dhcp lease watcher: hold .lock while copying outputs

fix mktree when passed symlink to existing directory

2026-08-10T12:23:21Z

commit 0ffad2df1a97a0f9a65967a71a072c0582390c66 parent 5a125fad3a576634686c66483a7e66d89efef585 Author: Daniel Barlow Date: Mon, 10 Aug 2026 13:23:21 +0100 fix mktree when passed symlink to existing directory

make custom lua only on device not on build

2026-08-05T22:32:09Z

commit 5a125fad3a576634686c66483a7e66d89efef585 parent 497297b5a0c91c16a38dd00bc40be7de16971d6a Author: Daniel Barlow Date: Wed, 5 Aug 2026 23:32:09 +0100 make custom lua only on device not on build this is because we don't need to, but also because the linker flags we hardcode don't work on darwin

json-to-fstree: Accept: application/json

2026-08-05T22:31:08Z

commit 497297b5a0c91c16a38dd00bc40be7de16971d6a parent fb2ec4e2c13f3f2fbbc56e4d11ea6f28a93925ef Author: Daniel Barlow Date: Wed, 5 Aug 2026 23:31:08 +0100 json-to-fstree: Accept: application/json this is required for undercroft which will otherwise serve yaml, but I think is not going to hurt for any other server either

enable tls client certificates for outboard secrets service

2026-08-04T23:08:57Z

commit fb2ec4e2c13f3f2fbbc56e4d11ea6f28a93925ef parent 42a315383f5c9499028c5327ba5908462611c432 Author: Daniel Barlow Date: Wed, 5 Aug 2026 00:08:57 +0100 enable tls client certificates for outboard secrets service

add option to configure /etc/hosts entries

2026-08-04T20:54:41Z

commit 42a315383f5c9499028c5327ba5908462611c432 parent 98cbb93109cc813c079078163cbed539ae3ba4fe Author: Daniel Barlow Date: Tue, 4 Aug 2026 21:54:41 +0100 add option to configure /etc/hosts entries

exec chronyd

2026-08-04T20:04:31Z

commit 98cbb93109cc813c079078163cbed539ae3ba4fe parent 4a9c4a9a4697b6f7935da0e6b959245134ec5fae Author: Daniel Barlow Date: Tue, 4 Aug 2026 21:04:31 +0100 exec chronyd

util-linux: disable shadow support, depends on systemd

2026-08-04T09:44:54Z

commit 4a9c4a9a4697b6f7935da0e6b959245134ec5fae parent d91277804ed3dafca040207b1f5c5d12d292ba48 Author: Daniel Barlow Date: Tue, 4 Aug 2026 10:44:54 +0100 util-linux: disable shadow support, depends on systemd

nwa50ax: convert from mac80211 package to kmodloader

2026-08-04T09:43:15Z

commit d91277804ed3dafca040207b1f5c5d12d292ba48 parent dbe5bf15a171185df1826db8a062e7b57f82193f Author: Daniel Barlow Date: Tue, 4 Aug 2026 10:43:15 +0100 nwa50ax: convert from mac80211 package to kmodloader

fix qemu build

2026-07-29T21:00:13Z

commit dbe5bf15a171185df1826db8a062e7b57f82193f parent 10f02a11f688660695e88c6f786a29822637ba1f Author: Daniel Barlow Date: Wed, 29 Jul 2026 22:00:13 +0100 fix qemu build

update dropbear patch

2026-07-28T13:26:14Z

commit 10f02a11f688660695e88c6f786a29822637ba1f parent 455bc7a8860813bf06bebb733860e61cfd40bbf6 Author: Daniel Barlow Date: Tue, 28 Jul 2026 14:26:14 +0100 update dropbear patch

remove checks for old nixpkgs versions

2026-07-28T13:11:01Z

commit 455bc7a8860813bf06bebb733860e61cfd40bbf6 parent ee7ab4ec39d486f733147b6dff0d95ea147ea1aa Author: Daniel Barlow Date: Tue, 28 Jul 2026 14:11:01 +0100 remove checks for old nixpkgs versions

s6-linux-init remove obsolete patch

2026-07-28T11:52:53Z

commit ee7ab4ec39d486f733147b6dff0d95ea147ea1aa parent 6c63e02ef67574d7c4441c6a7874a342c24eb982 Author: Daniel Barlow Date: Tue, 28 Jul 2026 12:52:53 +0100 s6-linux-init remove obsolete patch looks like it's gone upstream

update dropbear patch for 26.05

2026-06-04T21:03:24Z

commit 6c63e02ef67574d7c4441c6a7874a342c24eb982 parent c21282420961d74133d52cd73b974681167509b1 Author: Daniel Barlow Date: Thu, 4 Jun 2026 22:03:24 +0100 update dropbear patch for 26.05

Merge remote-tracking branch 'pcc/s6'

2026-05-27T12:14:33Z

commit c21282420961d74133d52cd73b974681167509b1 parent f6978f97704778a6b248cdb50706cbb2df6ebbe7 Author: Daniel Barlow Date: Wed, 27 May 2026 13:14:33 +0100 Merge remote-tracking branch 'pcc/s6'

Merge remote-tracking branch 'pcc/mitig'

2026-05-27T12:10:19Z

commit f6978f97704778a6b248cdb50706cbb2df6ebbe7 parent f85d4a66ca57c27e0e32142ee149c561f351b772 Author: Daniel Barlow Date: Wed, 27 May 2026 13:10:19 +0100 Merge remote-tracking branch 'pcc/mitig'

Merge remote-tracking branch 'pcc/hrt'

2026-05-27T12:07:47Z

commit f85d4a66ca57c27e0e32142ee149c561f351b772 parent 430ed1290210f8d444cd60f890a95f8935fe4903 Author: Daniel Barlow Date: Wed, 27 May 2026 13:07:47 +0100 Merge remote-tracking branch 'pcc/hrt'

Adjust kernel exploit mitigation settings on arm64

2026-05-24T10:12:40Z

commit 0cb8383b90e4e2e54be0c15864f8650669eb1b6f parent 8e36690ae2ad7439188bc2b2319da48e6d723faf Author: Peter Collingbourne Date: Sun, 24 May 2026 03:12:40 -0700 Adjust kernel exploit mitigation settings on arm64 CONFIG_RANDOMIZE_BASE enables KASLR. It doesn't increase the size of the kernel image for OpenWrt One (technically it increases .text size by 256 bytes, but that was cancelled out by alignment padding). Set this to y on arm64. The other architectures are not modified (arm doesn't support it, and mips only supports it for some targets). CONFIG_ARM64_PTR_AUTH is enabled by default by the kernel and enables pointer authentication instructions at entry and exit of most kernel functions. However, none of our targets support pointer authentication, so these instructions are just taking up space for no purpose. Set this one to n, which reduces OpenWrt One kernel image size by 24KB.

Patch s6-linux-init to fix running from non-root filesystem

2026-05-24T07:30:10Z

commit 01ded6eb25ec75e4c5599755764e086816c50a25 parent 8e36690ae2ad7439188bc2b2319da48e6d723faf Author: Peter Collingbourne Date: Sun, 24 May 2026 00:30:10 -0700 Patch s6-linux-init to fix running from non-root filesystem With #26 the s6 binaries will run from a non-root filesystem. This exposed a bug in s6-linux-init which is now fixed upstream. Apply the fix.

Enable CONFIG_HIGH_RES_TIMERS in the default kernel config

2026-05-24T01:27:57Z

commit 3ed4e3252565c0644bdf954149720c6a6333f16d parent 8e36690ae2ad7439188bc2b2319da48e6d723faf Author: Peter Collingbourne Date: Sat, 23 May 2026 18:27:57 -0700 Enable CONFIG_HIGH_RES_TIMERS in the default kernel config At least on OpenWrt One, the kernel default of CONFIG_HIGH_RES_TIMERS=n causes slow SPI NAND access speeds. See: https://lore.kernel.org/all/CAPQLkRit9bRH2gnSpvt60evu31T=1YNFdTFH2emS6RSsY=eDJQ@mail.gmail.com/ Since this doesn't seem to be an inherently device-specific issue, and leaving it disabled may cause other performance problems that are difficult to debug, enable it in the default config.

Stop unnecessarily removing sections from the kernel binary

2026-05-17T03:18:05Z

commit c80e7d33ed25d785b12950f10dfb7729b37023f8 parent 8e36690ae2ad7439188bc2b2319da48e6d723faf Author: Peter Collingbourne Date: Sat, 16 May 2026 20:18:05 -0700 Stop unnecessarily removing sections from the kernel binary We just need -S here which removes non-SHF_ALLOC sections. SHF_ALLOC sections are generally required to be in the kernel image, and can't be removed (in the sense of shrinking the binary) by a tool like objcopy because that would alter the section layout which is fixed by the linker. objcopy was "removing" these sections by replacing them with zeros, so this wasn't reducing the size of the kernel anyway. In particular, this command was removing the .notes section containing the build ID which is readable from userspace via /sys/kernel/notes and may be used for symbolization on the host.

think

2026-05-11T11:23:32Z

commit 430ed1290210f8d444cd60f890a95f8935fe4903 parent 8e36690ae2ad7439188bc2b2319da48e6d723faf Author: Daniel Barlow Date: Mon, 11 May 2026 12:23:32 +0100 think

Merge remote-tracking branch 'pcc/upg'

2026-05-11T11:19:17Z

commit 8e36690ae2ad7439188bc2b2319da48e6d723faf parent 6a390fa716f77e29aa5fe8b9ce6567e40e12cea4 Author: Daniel Barlow Date: Mon, 11 May 2026 12:19:17 +0100 Merge remote-tracking branch 'pcc/upg'

add luad (unused yet)

2026-05-11T11:19:09Z

commit 6a390fa716f77e29aa5fe8b9ce6567e40e12cea4 parent 7e5d1ccf67064302d33da17e376b130bd744e4e2 Author: Daniel Barlow Date: Mon, 11 May 2026 12:19:09 +0100 add luad (unused yet)

openwrt: v25.12.1 -> v25.12.3

2026-05-08T07:35:53Z

commit b2a7ae4bc4083336ad0ce9cf476db8787ec855c2 parent 7e5d1ccf67064302d33da17e376b130bd744e4e2 Author: Peter Collingbourne Date: Fri, 8 May 2026 00:35:53 -0700 openwrt: v25.12.1 -> v25.12.3

fix tests thst need overlay.nix

2026-05-05T19:51:40Z

commit 7e5d1ccf67064302d33da17e376b130bd744e4e2 parent 93125bb09ba3726deacdf504293e50d4e2e0bce9 Author: Daniel Barlow Date: Tue, 5 May 2026 20:51:40 +0100 fix tests thst need overlay.nix

fix fennel errors in test

2026-05-05T19:50:53Z

commit 93125bb09ba3726deacdf504293e50d4e2e0bce9 parent 43fd9112aff40f45c4c203ac3a6b83ff9f4f8769 Author: Daniel Barlow Date: Tue, 5 May 2026 20:50:53 +0100 fix fennel errors in test

Merge remote-tracking branch 'pcc/fix1'

2026-05-05T13:25:43Z

commit 43fd9112aff40f45c4c203ac3a6b83ff9f4f8769 parent 482b60eb9136c144fa372e21147f8fc44c5c580a Author: Daniel Barlow Date: Tue, 5 May 2026 14:25:43 +0100 Merge remote-tracking branch 'pcc/fix1'

Merge remote-tracking branch 'pcc/fix5'

2026-05-05T13:18:20Z

commit 482b60eb9136c144fa372e21147f8fc44c5c580a parent 875a4ae512232e165fdc784fb8c0ee79a0281c57 Author: Daniel Barlow Date: Tue, 5 May 2026 14:18:20 +0100 Merge remote-tracking branch 'pcc/fix5'

Merge remote-tracking branch 'pcc/fix7'

2026-05-05T13:17:32Z

commit 875a4ae512232e165fdc784fb8c0ee79a0281c57 parent cf490e8c26bb5cb2bc5c280bc5a23b0b35c2702a Author: Daniel Barlow Date: Tue, 5 May 2026 14:17:32 +0100 Merge remote-tracking branch 'pcc/fix7'

Merge remote-tracking branch 'pcc/fix9'

2026-05-05T13:15:33Z

commit cf490e8c26bb5cb2bc5c280bc5a23b0b35c2702a parent ce56c9e1f49a24427670c43f04653c0bd9662297 Author: Daniel Barlow Date: Tue, 5 May 2026 14:15:33 +0100 Merge remote-tracking branch 'pcc/fix9'

anoia: Fix crash if a watched output directory does not exist

2026-05-03T07:34:24Z

commit b061e6903be847ba050aec8f15cd31612b79a6e1 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:34:24 -0700 anoia: Fix crash if a watched output directory does not exist

Merge remote-tracking branch 'pcc/fix10'

2026-05-03T12:35:23Z

commit ce56c9e1f49a24427670c43f04653c0bd9662297 parent 639e924ce2321c92257633c63c845187a0e5eaeb Author: Daniel Barlow Date: Sun, 3 May 2026 13:35:23 +0100 Merge remote-tracking branch 'pcc/fix10'

Merge remote-tracking branch 'pcc/fix11'

2026-05-03T12:31:59Z

commit 639e924ce2321c92257633c63c845187a0e5eaeb parent be882c62a6e36868636e349d702745fa606f7a36 Author: Daniel Barlow Date: Sun, 3 May 2026 13:31:59 +0100 Merge remote-tracking branch 'pcc/fix11'

Merge remote-tracking branch 'pcc/fix3'

2026-05-03T12:30:59Z

commit be882c62a6e36868636e349d702745fa606f7a36 parent ab93e0075ccd218e0b33197b2000b429de081e77 Author: Daniel Barlow Date: Sun, 3 May 2026 13:30:59 +0100 Merge remote-tracking branch 'pcc/fix3'

Merge remote-tracking branch 'pcc/fix2'

2026-05-03T12:30:27Z

commit ab93e0075ccd218e0b33197b2000b429de081e77 parent aead19df04caebec59eddd760592f1918718b8c8 Author: Daniel Barlow Date: Sun, 3 May 2026 13:30:27 +0100 Merge remote-tracking branch 'pcc/fix2'

Merge remote-tracking branch 'pcc/fix12'

2026-05-03T12:27:02Z

commit aead19df04caebec59eddd760592f1918718b8c8 parent 65847bec4b547c2184eafb7b2764c735407f4f32 Author: Daniel Barlow Date: Sun, 3 May 2026 13:27:02 +0100 Merge remote-tracking branch 'pcc/fix12'

Merge remote-tracking branch 'pcc/fix13'

2026-05-03T12:26:27Z

commit 65847bec4b547c2184eafb7b2764c735407f4f32 parent f2ec49f9f2d2d7769d9184441c6bb42550d546e8 Author: Daniel Barlow Date: Sun, 3 May 2026 13:26:27 +0100 Merge remote-tracking branch 'pcc/fix13'

Merge remote-tracking branch 'pcc/fix14'

2026-05-03T12:26:09Z

commit f2ec49f9f2d2d7769d9184441c6bb42550d546e8 parent 5a224c89807ade481fd098e315b610166cc4c2a2 Author: Daniel Barlow Date: Sun, 3 May 2026 13:26:09 +0100 Merge remote-tracking branch 'pcc/fix14'

Fix typo in sysctl name

2026-05-03T06:25:50Z

commit 22023812dad0a8563a59d9f03d796ef236a446ce parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sat, 2 May 2026 23:25:50 -0700 Fix typo in sysctl name

Fix race between lease-acquired and dependent services

2026-05-03T07:18:03Z

commit de1ccf138e27d0e232c9b3b115fbf86d7160f07d parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:18:03 -0700 Fix race between lease-acquired and dependent services We use s6-rc-up-tree to bring up all services depending on lease-acquired, but there's a race between copying the lease information into the lease-acquired service directory and dependent services reading from the service directory. Fix it by using the notification-fd mechanism to notify s6 when the files are copied.

Make Liminix usable as an input to a flake

2026-05-03T06:19:34Z

commit 17d8576cc45c72e8e6ef4e223655315393d4195b parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sat, 2 May 2026 23:19:34 -0700 Make Liminix usable as an input to a flake This change allows Liminix to be used as a non-flake input to a flake by making into a default argument. An example flake that makes use of this is here: https://github.com/pcc/liminix-flake-demo

ifwait: Fix flapping on bridged interfaces

2026-05-03T06:40:30Z

commit 15a886cf9a5ff668559352dbc70c6ee7b8d2cfba parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sat, 2 May 2026 23:40:30 -0700 ifwait: Fix flapping on bridged interfaces We use ifwait to monitor a bridged interface so we can add or remove it to the bridge by bringing the associated service up or down. However, bridge related netlink events can cause ifwait to incorrectly consider the interface to have gone down. For example, nlmsg_type=RTM_DELLINK with ifi_family=AF_BRIDGE, which is triggered by removing an interface from a bridge, and does not indicate that the interface itself was removed. Because a later RTM_NEWLINK will indicate that the link is still up, ifwait will bring the service down and then up again, triggering more netlink messages that keep ifwait in an infinite loop. Fix it by checking specifically for RTM_NEWLINK and RTM_DELLINK messages with ifi_family=AF_UNSPEC, which indicates an event related to the interface itself.

dnsmasq: Pass --bind-interfaces

2026-05-03T07:23:53Z

commit 86e55ff3cf2ef954005e521b96a63ba4c4807849 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:23:53 -0700 dnsmasq: Pass --bind-interfaces This allows users to run another DNS server, such as unbound, and have dnsmasq use it as the upstream.

ifwait: React to interface up by bringing up the service tree

2026-05-03T07:37:12Z

commit 33f2a9348943056ecf0dc9b050c7e64a713a4800 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:37:12 -0700 ifwait: React to interface up by bringing up the service tree This allows a system to be configured to dynamically bring up services associated with an interface. For example, attaching a USB ethernet adapter could trigger starting a DHCP client and an additional default route for failover to an additional upstream.

openwrt: Add a patch to fix the MT7915 build in 25.12

2026-05-03T07:46:20Z

commit 3dee66b3d5c61bfa9297bfa61906f8eae21e0d36 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:46:20 -0700 openwrt: Add a patch to fix the MT7915 build in 25.12 These changes are part of the patch that went upstream [1], but for some reason they're missing from OpenWrt's backport [2]. [1] https://github.com/torvalds/linux/commit/96326447d466ca62b713f660cfc73ef7879151a0 [2] https://github.com/openwrt/openwrt/blob/a0c7d5ecff4eb4d8760207d9fd71fbf154469bf5/target/linux/generic/backport-6.12/731-v6.18-net-mediatek-wed-Introduce-MT7992-WED-support-to-MT7.patch

Move extraRules to the end of the recursiveUpdate

2026-05-03T06:24:49Z

commit 83e7c6f2dce6f4eb86e4bc8d1a29503dd655b68c parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sat, 2 May 2026 23:24:49 -0700 Move extraRules to the end of the recursiveUpdate extraRules is the user-specified ruleset so this allows the user configuration to override the builtin rules.

Avoid dependency on specific PCI addresses in qemu config

2026-05-03T06:22:51Z

commit e994e25d6e5f8691bda8337487e9c4352d185c5b parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sat, 2 May 2026 23:22:51 -0700 Avoid dependency on specific PCI addresses in qemu config These addresses will vary depending on the target architecture, so let's name them via /bus instead.

openwrt-one: Upgrade to kernel 6.12

2026-05-03T07:54:35Z

commit b832496802094b08e4e0b0a31b688722ffb5e10a parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 00:54:35 -0700 openwrt-one: Upgrade to kernel 6.12 The config changes here are a combination of: - Converting the output of (in the OpenWrt repo): ``` git diff v24.10.6:./target/linux/mediatek/filogic/config-6.6 v25.12.2:./target/linux/mediatek/filogic/config-6.12 ``` into Nix. - Removing some overspecification of the kernel configuration, not only for the 6.12 upgrade but also to support some changes that I made to my personal configuration.

kmodloader: Filter out builtin lines from modprobe output

2026-05-03T08:18:18Z

commit 0d5922c81183c319eb22939a4e6502b5ab62f9bf parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 01:18:18 -0700 kmodloader: Filter out builtin lines from modprobe output modprobe will print "builtin" lines for modules that are statically linked into the kernel, which confuses this shell pipeline. Fix it by adding a grep for "^insmod".

openwrt-one: Move the load address again

2026-04-27T03:13:39Z

commit 5a224c89807ade481fd098e315b610166cc4c2a2 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 26 Apr 2026 20:13:39 -0700 openwrt-one: Move the load address again U-Boot declares a reserved-memory region at address 0x4fc00000 which makes 0x48000000 problematic for very large images. Move it again to 0x50000000.

tufted: Roll over the tid on overflow

2026-05-03T08:24:23Z

commit 57f6656d87e1c06a253a3d1149e9713acc207607 parent d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 Author: Peter Collingbourne Date: Sun, 3 May 2026 01:24:23 -0700 tufted: Roll over the tid on overflow The specific rollover value is unspecified, but we assume that the other side is U-Boot which rolls over to 0. https://github.com/u-boot/u-boot/blob/bb0f3eebb3c196d9b6efbbd1e5aa9b16abbb9ad6/net/tftp.c#L275 This allows for very large images to be transferred, which is sometimes necessary for running debugging or profiling tools designed for normal Linux distributions such as perf.

add configuration for gateway test

2026-04-29T12:23:18Z

commit d0376d41016e0ddbd532b63f7fd3b2f4fcbcdf37 parent 5f2abc0d2b30eb5878d60488a72138958c228976 Author: Daniel Barlow Date: Wed, 29 Apr 2026 13:23:18 +0100 add configuration for gateway test it can't share the rotuer example as rotuer's secrets aren't checked into git

test that rotuer example builds

2026-04-26T17:10:56Z

commit 5f2abc0d2b30eb5878d60488a72138958c228976 parent c03d50235af20adc7aa9a87699b0a2697e644ed2 Author: Daniel Barlow Date: Sun, 26 Apr 2026 18:10:56 +0100 test that rotuer example builds there is no test in CI that builds the firewall or any of those modules, so this is temporary-ish to increase coverage

Move openwrt-one TFTP load address after reserved-memory regions

2026-04-26T05:35:43Z

commit c03d50235af20adc7aa9a87699b0a2697e644ed2 parent f1277b0564b17dc3f1eee3fe155346ceef957f1a Author: Peter Collingbourne Date: Sat, 25 Apr 2026 22:35:43 -0700 Move openwrt-one TFTP load address after reserved-memory regions I was seeing random filesystem corruption when booting larger images over TFTP, and it turned out to be caused by the image being loaded on top of some reserved-memory regions (see link below). https://github.com/torvalds/linux/blob/897d54018cc9aa97fd1529ca08a53b429d05a566/arch/arm64/boot/dts/mediatek/mt7981b.dtsi#L72

make elfutils build

2026-04-26T11:33:32Z

commit f1277b0564b17dc3f1eee3fe155346ceef957f1a parent 16fb3f53439f5a1dfcad32b9c6007026d227fa23 Author: Daniel Barlow Date: Sun, 26 Apr 2026 12:33:32 +0100 make elfutils build

Remove iptables modules

2026-04-25T18:20:48Z

commit 16fb3f53439f5a1dfcad32b9c6007026d227fa23 parent 9c62e8333df8ca577b6210df79addaebef4e4a4a Author: Peter Collingbourne Date: Sat, 25 Apr 2026 11:20:48 -0700 Remove iptables modules With Linux 6.12, some of the iptables modules are no longer directly selectable, leading to a failure to build the module loader. We don't need them anyway as we use nftables, so remove them.

think

2026-04-26T10:57:06Z

commit 9c62e8333df8ca577b6210df79addaebef4e4a4a parent dc62a8b75f84b7c9580a34b54745f724b1b0d82b Author: Daniel Barlow Date: Sun, 26 Apr 2026 11:57:06 +0100 think

disaable util-linux lastlog support as it depends on PAM

2026-03-30T13:03:02Z

commit dc62a8b75f84b7c9580a34b54745f724b1b0d82b parent 7f6b05ef965d1751ce7c3cfe681783f4a3b25cb3 Author: Daniel Barlow Date: Mon, 30 Mar 2026 14:03:02 +0100 disaable util-linux lastlog support as it depends on PAM

switch from mainline ag71xx driver to openwrt version

2026-03-30T12:35:19Z

commit 7f6b05ef965d1751ce7c3cfe681783f4a3b25cb3 parent 4299293cc508a03c76cd1980b4a2d590620ad80c Author: Daniel Barlow Date: Mon, 30 Mar 2026 13:35:19 +0100 switch from mainline ag71xx driver to openwrt version

backport OF "compatible" changes for ath79

2026-03-28T21:17:55Z

commit 4299293cc508a03c76cd1980b4a2d590620ad80c parent b6b420bc5b455fef9e7197b42321add3110059ba Author: Daniel Barlow Date: Sat, 28 Mar 2026 21:17:55 +0000 backport OF "compatible" changes for ath79

gl-ar750 upgrade ath10k firmware

2026-03-28T21:17:08Z

commit b6b420bc5b455fef9e7197b42321add3110059ba parent 5af28615f1fd4639423e48dd39c7c7efe4c36a90 Author: Daniel Barlow Date: Sat, 28 Mar 2026 21:17:08 +0000 gl-ar750 upgrade ath10k firmware

gl-ar750: update to newer kernel + openwrt

2026-03-28T21:15:51Z

commit 5af28615f1fd4639423e48dd39c7c7efe4c36a90 parent e8a60d286006abb8a4d559e13df5e8659ffefab3 Author: Daniel Barlow Date: Sat, 28 Mar 2026 21:15:51 +0000 gl-ar750: update to newer kernel + openwrt this device is not (yet?) in mainline, but openwrt 25.12 has the right patches to make it work with linux 6.12

bordervm switch usb passthru from ehci to xhci

2026-03-22T15:23:50Z

commit e8a60d286006abb8a4d559e13df5e8659ffefab3 parent 82164d3968ab568404a956e3c51d6bea137cf135 Author: Daniel Barlow Date: Sun, 22 Mar 2026 15:23:50 +0000 bordervm switch usb passthru from ehci to xhci this was to fix a bug that turned out to be something else, but the qemu docs say it's better anyway

think

2026-03-22T15:23:19Z

commit 82164d3968ab568404a956e3c51d6bea137cf135 parent 0b179a6e04bd755c432cb1c3223b42c5c723b1b5 Author: Daniel Barlow Date: Sun, 22 Mar 2026 15:23:19 +0000 think

force create ca-certificate symlink

2026-03-22T15:22:56Z

commit 0b179a6e04bd755c432cb1c3223b42c5c723b1b5 parent 29d51396f5ac723ff285b74fc10baf9456c5e0db Author: Daniel Barlow Date: Sun, 22 Mar 2026 15:22:56 +0000 force create ca-certificate symlink

s6-rc-up-tree doesn't need runtime fennel

2026-03-18T21:09:55Z

commit 29d51396f5ac723ff285b74fc10baf9456c5e0db parent 5f92529f4f9f9fa7985d6ba63cf0ead1b15a3928 Author: Daniel Barlow Date: Wed, 18 Mar 2026 21:09:55 +0000 s6-rc-up-tree doesn't need runtime fennel

odhcp6c: upgrade to newer (but not new) upstream

2026-03-18T21:07:49Z

commit 5f92529f4f9f9fa7985d6ba63cf0ead1b15a3928 parent a1d7c49e22152a9bcf0e3677be9749109dafde52 Author: Daniel Barlow Date: Wed, 18 Mar 2026 21:07:49 +0000 odhcp6c: upgrade to newer (but not new) upstream * we need new enough for cmake 3 * but not so new it depends on libubox This is a "get it working again" patch, not a long-term solution. Either we should add libubox to liminix or we should find another dhcp6 client

luaossl: remove .orig file after patching

2026-03-18T21:06:19Z

commit a1d7c49e22152a9bcf0e3677be9749109dafde52 parent 7f23c5dc0f442de9fe07c076297c3a74f2a34e72 Author: Daniel Barlow Date: Wed, 18 Mar 2026 21:06:19 +0000 luaossl: remove .orig file after patching *something* tries to patch src/openssl.c again in the install phase (I haven't figured out what) and dies because it can't make src/openssl.c.orig if it exists already.

update dropbear, simplify authorized_keys patch

2026-03-11T18:22:39Z

commit 7f23c5dc0f442de9fe07c076297c3a74f2a34e72 parent c364095c441d8891ac8d942261eccf3fd24b5423 Author: Daniel Barlow Date: Wed, 11 Mar 2026 18:22:39 +0000 update dropbear, simplify authorized_keys patch

build our own fennel

2026-03-11T07:45:00Z

commit c364095c441d8891ac8d942261eccf3fd24b5423 parent ef07dcc10ad6d56ea37ce6ff4d26d35b4225c9b5 Author: Daniel Barlow Date: Wed, 11 Mar 2026 07:45:00 +0000 build our own fennel final.lua53Packages.fennel seems somehow to drag in glibc

bump ubifs max leb count

2026-03-11T07:38:00Z

commit ef07dcc10ad6d56ea37ce6ff4d26d35b4225c9b5 parent 4b40e51a1d817190c649dea245b290c583d193c9 Author: Daniel Barlow Date: Wed, 11 Mar 2026 07:38:00 +0000 bump ubifs max leb count

run-liminix-vm tell qemu not to reboot when guest terminates

2026-03-11T07:30:00Z

commit 4b40e51a1d817190c649dea245b290c583d193c9 parent 9fef673ca0dd06ecd08f686b8c4e86dab30384df Author: Daniel Barlow Date: Wed, 11 Mar 2026 07:30:00 +0000 run-liminix-vm tell qemu not to reboot when guest terminates

remove ci.nix "all" attribute

2026-03-09T12:01:19Z

commit 9fef673ca0dd06ecd08f686b8c4e86dab30384df parent 7b1324208b75b47b90be05aa2883d8327fceb029 Author: Daniel Barlow Date: Mon, 9 Mar 2026 12:01:19 +0000 remove ci.nix "all" attribute use ci-all.nix instead if you want to do all the jobs