feat: kit-busrouter v2.0 — complete Synology + GL fleet router platform

Includes: - package/ GL-XE3000 kit-busrouter (opkg) - scripts/provision.sh (GL) and provision-synology.sh (Synology) - syno-balance/ — new WAN balancer replacing aiwanbal (SmartWAN adapter) - kit-connect/ — unified connectivity SPK (Tailscale + reverse SSH) - docs/deployment/synology-rt2600ac-checklist.md — 62-point checklist - docs/provisioning/device-identity.md — fleet identity spec - docs/pilot/checklist.md — field pilot validation - x4078_20260721.dss — reference config backup Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-22 00:07:14 +00:00
commit f15ac69925
41 changed files with 5083 additions and 0 deletions
@@ -0,0 +1,58 @@
+#!/bin/sh
+# wg-mgmt-fix.sh — apply ONE mgmt-tunnel robustness fix at a time, then bounce wgclient1.
+# Run ON THE ROUTER over LAN:  ssh root@192.168.8.1 (pw kitPLANE1!!)
+#   sh wg-mgmt-fix.sh keepalive   # set persistent_keepalive=25  (TRY FIRST)
+#   sh wg-mgmt-fix.sh mtu         # set wgclient1 mtu=1280       (fixes PMTU black-holes / SSH data)
+#   sh wg-mgmt-fix.sh rpfilter    # persist loose rp_filter (=2) + hotplug re-assert
+#   sh wg-mgmt-fix.sh all         # keepalive + mtu + rpfilter
+# MUTATING but reversible (each is a uci change). Bounces the tunnel ~5s; touches nothing else.
+# After each: re-test  ping -c3 -W2 -I 10.88.0.2 10.88.0.1  (expect replies).
+# Rationale + goal (mgmt over EITHER WAN): docs/handoff/2026-07-01-wg-mgmt-incident-and-resume.md
+set -e
+IFACE=wgclient1
+
+bounce() { echo ">> uci commit network; ifup $IFACE"; uci commit network; ifup "$IFACE"; sleep 5; }
+
+do_keepalive() {
+  echo "== persistent_keepalive=25 on $IFACE (hold NAT mapping open on whichever WAN) =="
+  uci set network.$IFACE.persistent_keepalive='25'
+  bounce
+}
+
+do_mtu() {
+  echo "== mtu=1280 on $IFACE (safe under cellular + ATT-fiber/PPPoE path MTUs) =="
+  uci set network.$IFACE.mtu='1280'
+  bounce
+}
+
+do_rpfilter() {
+  echo "== persist loose rp_filter (=2) so multi-WAN policy-routed mgmt isn't dropped =="
+  grep -q 'busrouter: loose reverse-path' /etc/sysctl.conf 2>/dev/null || cat >> /etc/sysctl.conf <<'EOF'
+# busrouter: loose reverse-path filtering for multi-WAN WG mgmt failover
+net.ipv4.conf.all.rp_filter=2
+net.ipv4.conf.default.rp_filter=2
+EOF
+  # apply now
+  sysctl -w net.ipv4.conf.all.rp_filter=2 >/dev/null
+  for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 2 > "$f"; done
+  # re-assert on WAN flaps (GL DHCP hooks may re-tighten per-iface)
+  mkdir -p /etc/hotplug.d/iface
+  cat > /etc/hotplug.d/iface/99-busrouter-rpfilter <<'EOF'
+#!/bin/sh
+[ "$ACTION" = ifup ] || exit 0
+for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 2 > "$f" 2>/dev/null; done
+EOF
+  chmod +x /etc/hotplug.d/iface/99-busrouter-rpfilter
+  echo "   rp_filter now: all=$(cat /proc/sys/net/ipv4/conf/all/rp_filter)"
+}
+
+case "$1" in
+  keepalive) do_keepalive ;;
+  mtu)       do_mtu ;;
+  rpfilter)  do_rpfilter ;;
+  all)       do_keepalive; do_mtu; do_rpfilter ;;
+  *) echo "usage: $0 {keepalive|mtu|rpfilter|all}"; exit 2 ;;
+esac
+
+echo
+echo ">> Now verify:  ping -c3 -W2 -I 10.88.0.2 10.88.0.1   (replies = mgmt tunnel healthy)"