tollgate-fleet · design

One network, many routers

Routers broadcast !TollGate and pass phones straight through FIPS to one gateway. The gateway does everything else.

1 gateway · DHCP · portal · mint N routers · access points only 0 WireGuard · FIPS encrypts 1 image · flash & go
01

Topology

Internet NAT · one public IP Gateway NixOS · 89.125.35.167 br-lan dnsmasq proxyd tollgated mintd merchantd fleet grafana ip6gretap over fips0 · fd ↔ fd Router A GL-MT3000 · fleet-agent Router B GL-MT3000 · fleet-agent Router C GL-MT3000 · fleet-agent WAN WAN WAN Router D no WAN · mesh only its tunnel rides the mesh via B or C FIPS mesh 802.11s · 2.4 GHz walks over · same IP, same session every router: !TollGate on 5 GHz

One Layer-2 network for every phone: the routers bridge, the gateway thinks. A router without its own uplink reaches the gateway through its neighbours; FIPS picks the path.

02

Inside a router

GL-MT3000 radio 2.4 GHz 802.11s mesh FIPS backhaul · ch 6 radio 5 GHz !TollGate !FIPS z_npub1abcd..efgh hidden · admin br-tg tunnel → gateway fleet-agent · every 5 s SSID · on/off · channel kicks · clock · firewall tunnel no DHCP · no TollGate nothing to lose if it dies

Access points never share the mesh's radio: on these chips that stops the mesh peering.

03

A packet on its way

fips0 · 1280 bytes FIPS · Noise-encrypted, per node IPv6 40 · fd router → fd gateway GRE 4 Ethernet 14 · the phone's frame ≤ 1222 the phone's IP packet DHCP tells Android 1222 TCP clamped to 1182 QUIC refused → TCP no second encryption

58 bytes of wrapping. FIPS never fragments, so the gateway keeps every packet small enough.

04

From box to fleet

1 Flash one image, any router 24.10 · 25.12 2 First boot own npub · !FIPS · mesh no SSH, no internet 3 Knocks asks the gateway !TollGate still off 4 fleet pending npub proven add it · switch 5 Live !TollGate on within 30 s already on OpenWrt + FIPS? scripts/provision-router.sh does steps 1–3 over SSH
05

One file steers every router

$ fleet … fleet.json ssid: shared · unique · per npub disabled: [npub…] channel: 2g 6 · 5g 36 · apply_at kicks: [seq, mac] every 5 s over FIPS agent A agent B agent C routers pull; the gateway never pushes an offline router catches up when it returns
06

Fails closed, heals itself

!TollGate ON !TollGate OFF 3 failed fetches 2 good fetches boots OFF · retries the tunnel every minute !FIPS and the admin SSID never go off
07

Changing channel without losing the mesh

publish fleet channel 5g 44 apply_at 0 · held every router reports it ?v=… on each fetch laggards named · --force apply_at = now + 30 s by the gateway's clock switch all at once lost one searches recent channels
08

On the day

fleet statusevery router, SSID, tunnel, last contact
fleet pendingnew routers knocking
fleet ssid uniquetell routers apart
fleet off entranceone router's !TollGate off
fleet channel 5g 44everyone switches together
fleet kick aa:bb:…make one phone rejoin
fleet ssh entranceshell on a router, over FIPS
fleet free onemergency: everyone online, no portal