# TODO — robustness backlog for the van router (`wayback`)

Candidate improvements toward a robust unattended mobile router, tiered by
value-for-effort. Generated 2026-06-29 from a robustness review of the live box.

## Already in place (for reference — don't redo)

- [x] Multi-WAN failover (wifi → Starlink → 4G) — `van-failover`
- [x] Thermal monitoring + alerts + history — `van-thermal`
- [x] Battery low-charge Pushover alerts + safe auto-shutdown — `van-battery`
- [x] Mains ↔ battery transition alerts
- [x] Cockpit dashboard (AP, temps, battery, failover, WAN)
- [x] Never-sleep / lid-closed operation
- [x] `unattended-upgrades` enabled
- [x] `smartd` active (SMART being read) — but see Tier 2 (alerts go nowhere)
- [x] Time sync healthy (NTP synced)
- [x] journald within sane ZFS limits

---

## Tier 1 — high value, pieces already on hand

- [ ] **systemd hardware watchdog** — `/dev/watchdog` exists but isn't wired. A hung
  kernel/driver currently needs someone to open the lid. Given the EC-latch and
  USB-hub-hang history, auto-reboot-on-hang is the biggest unattended win.
  Set `RuntimeWatchdogSec` (and `RebootWatchdogSec`) in `/etc/systemd/system.conf`.
- [ ] **Auto power-on when mains returns** — the 10% auto-shutdown is currently a
  one-way trip; a laptop won't boot itself when solar/shore power returns. Needs the
  BIOS "restore on AC loss → power on" setting (cannot be set from the OS). Without
  it the safe-shutdown can strand the router. **Manual BIOS toggle.**
- [ ] **Heartbeat / dead-man's switch** — every existing alert can only fire if the box
  is alive. A periodic ping to healthchecks.io (or similar) inverts it: silence =
  something is dead (panic, no-boot, total power loss).
- [ ] **Connectivity alerts → Pushover** — `van-failover` already knows when it fails
  over or when ALL WANs are down; it just logs it. Pipe those events to the Pushover
  plumbing so internet loss is alerted, not just battery.

## Tier 2 — worth doing soon

- [ ] **smartd → Pushover** — smartd alerts default to emailing root (a black hole on a
  headless box). Wire `-M exec` to a Pushover script so NVMe SMART/wear warnings
  (reallocated sectors, wear-leveling) actually reach a phone.
- [ ] **ZFS hygiene** (root is `zroot`) — schedule a periodic scrub (with zfs-zed
  alerting), and auto-snapshot before `deploy.sh` for one-command rollback. Cap ARC if
  RAM ever gets tight.
- [ ] **Security hardening**:
  - [ ] Cockpit binds `*:9090` (all interfaces incl. WANs unless nftables drops inbound —
    confirm). Restrict to LAN/ZeroTier.
  - [ ] Add `fail2ban` for Cockpit/SSH.
  - [ ] WPA3-transition on the AP.
  - [ ] Guest SSID isolated from trusted devices.
- [ ] **Cellular data-cap tracking** — `vnstat` or nftables counters on the gsm iface +
  a Pushover alert near the monthly cap, to avoid bill shock when parked on 4G.

## Tier 3 — situational

- [ ] **Captive-portal handling** for public-WiFi WANs (campsites / neighbour APs) —
  detection at minimum, auto-auth for frequently-used ones.
- [ ] **GPS** — location logging / geofencing / offline time source.
- [ ] **Secrets backup** — git covers configs, but `/etc/van-battery/pushover.json` and
  other secrets are intentionally out of git. Document a restore path so a disk swap
  doesn't lose them.

---

**Suggested next:** Tier 1. The watchdog and connectivity-alerts are quick and reuse
existing plumbing; the AC-restore BIOS setting is what makes the battery auto-shutdown
genuinely safe rather than a trap.