Andreas WredeandClaude Opus 4.8
97309970ec
Tiered list of candidate improvements toward a robust unattended van router, with an "already in place" section so nothing gets redone. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
69 lines
3.5 KiB
Markdown
69 lines
3.5 KiB
Markdown
# TODO — robustness backlog for the van router (`wayback`)
|
|
|
|
Candidate improvements toward a robust unattended mobile router, tiered by
|
|
value-for-effort. Generated 2026-06-29 from a robustness review of the live box.
|
|
|
|
## Already in place (for reference — don't redo)
|
|
|
|
- [x] Multi-WAN failover (wifi → Starlink → 4G) — `van-failover`
|
|
- [x] Thermal monitoring + alerts + history — `van-thermal`
|
|
- [x] Battery low-charge Pushover alerts + safe auto-shutdown — `van-battery`
|
|
- [x] Mains ↔ battery transition alerts
|
|
- [x] Cockpit dashboard (AP, temps, battery, failover, WAN)
|
|
- [x] Never-sleep / lid-closed operation
|
|
- [x] `unattended-upgrades` enabled
|
|
- [x] `smartd` active (SMART being read) — but see Tier 2 (alerts go nowhere)
|
|
- [x] Time sync healthy (NTP synced)
|
|
- [x] journald within sane ZFS limits
|
|
|
|
---
|
|
|
|
## Tier 1 — high value, pieces already on hand
|
|
|
|
- [ ] **systemd hardware watchdog** — `/dev/watchdog` exists but isn't wired. A hung
|
|
kernel/driver currently needs someone to open the lid. Given the EC-latch and
|
|
USB-hub-hang history, auto-reboot-on-hang is the biggest unattended win.
|
|
Set `RuntimeWatchdogSec` (and `RebootWatchdogSec`) in `/etc/systemd/system.conf`.
|
|
- [ ] **Auto power-on when mains returns** — the 10% auto-shutdown is currently a
|
|
one-way trip; a laptop won't boot itself when solar/shore power returns. Needs the
|
|
BIOS "restore on AC loss → power on" setting (cannot be set from the OS). Without
|
|
it the safe-shutdown can strand the router. **Manual BIOS toggle.**
|
|
- [ ] **Heartbeat / dead-man's switch** — every existing alert can only fire if the box
|
|
is alive. A periodic ping to healthchecks.io (or similar) inverts it: silence =
|
|
something is dead (panic, no-boot, total power loss).
|
|
- [ ] **Connectivity alerts → Pushover** — `van-failover` already knows when it fails
|
|
over or when ALL WANs are down; it just logs it. Pipe those events to the Pushover
|
|
plumbing so internet loss is alerted, not just battery.
|
|
|
|
## Tier 2 — worth doing soon
|
|
|
|
- [ ] **smartd → Pushover** — smartd alerts default to emailing root (a black hole on a
|
|
headless box). Wire `-M exec` to a Pushover script so NVMe SMART/wear warnings
|
|
(reallocated sectors, wear-leveling) actually reach a phone.
|
|
- [ ] **ZFS hygiene** (root is `zroot`) — schedule a periodic scrub (with zfs-zed
|
|
alerting), and auto-snapshot before `deploy.sh` for one-command rollback. Cap ARC if
|
|
RAM ever gets tight.
|
|
- [ ] **Security hardening**:
|
|
- [ ] Cockpit binds `*:9090` (all interfaces incl. WANs unless nftables drops inbound —
|
|
confirm). Restrict to LAN/ZeroTier.
|
|
- [ ] Add `fail2ban` for Cockpit/SSH.
|
|
- [ ] WPA3-transition on the AP.
|
|
- [ ] Guest SSID isolated from trusted devices.
|
|
- [ ] **Cellular data-cap tracking** — `vnstat` or nftables counters on the gsm iface +
|
|
a Pushover alert near the monthly cap, to avoid bill shock when parked on 4G.
|
|
|
|
## Tier 3 — situational
|
|
|
|
- [ ] **Captive-portal handling** for public-WiFi WANs (campsites / neighbour APs) —
|
|
detection at minimum, auto-auth for frequently-used ones.
|
|
- [ ] **GPS** — location logging / geofencing / offline time source.
|
|
- [ ] **Secrets backup** — git covers configs, but `/etc/van-battery/pushover.json` and
|
|
other secrets are intentionally out of git. Document a restore path so a disk swap
|
|
doesn't lose them.
|
|
|
|
---
|
|
|
|
**Suggested next:** Tier 1. The watchdog and connectivity-alerts are quick and reuse
|
|
existing plumbing; the AC-restore BIOS setting is what makes the battery auto-shutdown
|
|
genuinely safe rather than a trap.
|