Andreas WredeandClaude Opus 4.8
97309970ec
Tiered list of candidate improvements toward a robust unattended van router, with an "already in place" section so nothing gets redone. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3.5 KiB
3.5 KiB
TODO — robustness backlog for the van router (wayback)
Candidate improvements toward a robust unattended mobile router, tiered by value-for-effort. Generated 2026-06-29 from a robustness review of the live box.
Already in place (for reference — don't redo)
- Multi-WAN failover (wifi → Starlink → 4G) —
van-failover - Thermal monitoring + alerts + history —
van-thermal - Battery low-charge Pushover alerts + safe auto-shutdown —
van-battery - Mains ↔ battery transition alerts
- Cockpit dashboard (AP, temps, battery, failover, WAN)
- Never-sleep / lid-closed operation
unattended-upgradesenabledsmartdactive (SMART being read) — but see Tier 2 (alerts go nowhere)- Time sync healthy (NTP synced)
- journald within sane ZFS limits
Tier 1 — high value, pieces already on hand
- systemd hardware watchdog —
/dev/watchdogexists but isn't wired. A hung kernel/driver currently needs someone to open the lid. Given the EC-latch and USB-hub-hang history, auto-reboot-on-hang is the biggest unattended win. SetRuntimeWatchdogSec(andRebootWatchdogSec) in/etc/systemd/system.conf. - Auto power-on when mains returns — the 10% auto-shutdown is currently a one-way trip; a laptop won't boot itself when solar/shore power returns. Needs the BIOS "restore on AC loss → power on" setting (cannot be set from the OS). Without it the safe-shutdown can strand the router. Manual BIOS toggle.
- Heartbeat / dead-man's switch — every existing alert can only fire if the box is alive. A periodic ping to healthchecks.io (or similar) inverts it: silence = something is dead (panic, no-boot, total power loss).
- Connectivity alerts → Pushover —
van-failoveralready knows when it fails over or when ALL WANs are down; it just logs it. Pipe those events to the Pushover plumbing so internet loss is alerted, not just battery.
Tier 2 — worth doing soon
- smartd → Pushover — smartd alerts default to emailing root (a black hole on a
headless box). Wire
-M execto a Pushover script so NVMe SMART/wear warnings (reallocated sectors, wear-leveling) actually reach a phone. - ZFS hygiene (root is
zroot) — schedule a periodic scrub (with zfs-zed alerting), and auto-snapshot beforedeploy.shfor one-command rollback. Cap ARC if RAM ever gets tight. - Security hardening:
- Cockpit binds
*:9090(all interfaces incl. WANs unless nftables drops inbound — confirm). Restrict to LAN/ZeroTier. - Add
fail2banfor Cockpit/SSH. - WPA3-transition on the AP.
- Guest SSID isolated from trusted devices.
- Cockpit binds
- Cellular data-cap tracking —
vnstator nftables counters on the gsm iface + a Pushover alert near the monthly cap, to avoid bill shock when parked on 4G.
Tier 3 — situational
- Captive-portal handling for public-WiFi WANs (campsites / neighbour APs) — detection at minimum, auto-auth for frequently-used ones.
- GPS — location logging / geofencing / offline time source.
- Secrets backup — git covers configs, but
/etc/van-battery/pushover.jsonand other secrets are intentionally out of git. Document a restore path so a disk swap doesn't lose them.
Suggested next: Tier 1. The watchdog and connectivity-alerts are quick and reuse existing plumbing; the AC-restore BIOS setting is what makes the battery auto-shutdown genuinely safe rather than a trap.