router-release signs a release as a binary cache; router-update verifies
it against the router's update keys, migrates settings.json, and applies
it with commit-confirm. Includes the web UI page and a VM test.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F
- Allow the WAN link to also carry LANs when the uplink is PPPoE on a
VLAN with IPv6 off; only the PPP device counts as an uplink then, so
LAN traffic can never match WAN rules.
- Add router.rollback: router-arm / router-confirm / router-rollback
plus `nix run .#deploy`, a commit-confirm deployment flow.
- Wait for the LAN devices instead of the uplink in networkd
wait-online, so an unplugged uplink cannot block boot or activation.
- Add examples/desktop (single NIC, PPPoE on VLAN 1001) as
nixosConfigurations.example, built as a flake check.
Covered by the onestick and rollback VM tests and new assertion cases.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
nilsandClaude Sonnet 5.5