xlab-gateway: route CN destinations via local WAN

skydick/datapool: document iSCSI block-volume provisioning runbook ...

Add an admin runbook for provisioning iSCSI targets (first: rh1288v3 for
10.0.200.11, thin 8T zvol dick/system/vm/rh1288v3). Covers the imperative
targetcli->saveconfig model restored at boot by iscsi-target.service (not
target.service), thin-vs-thick guidance for a near-full pool, IQN ACL +
CHAP auth, server + client command sequences, and the [::0] wildcard-portal
and missing-openssl gotchas.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab-gw: punch v6 CERNET holes in the WireGuard table (fix AAAA-preferred CERNET sites) ...

The freedom-wgnet policy table (1002) had IPv4 throw routes for the Tsinghua/
CERNET ranges (101.6/16, 166.111/16, ...) so LAN clients reach them direct via
the campus uplink (wan99.0), but had NO IPv6 equivalent -> every v6 destination,
including CERNET, was default-routed through the wg tunnel to skyw-gw. Since
mirrors.tuna.tsinghua.edu.cn is AAAA-preferred, LAN clients hit the tunnel path
for v6 and timed out (TCP handshake started, cert/data flight black-holed),
while v4 worked -- looking like a "TLS downgrade" but actually a routing detour.

Add v6 throw routes for the CERNET blocks (2402:f000::/32 Tsinghua/tuna,
2001:da8::/32 CERNET2, 2001:250::/35 CERNET), mirroring the v4 throws and
skyw-gw's cn_net_v6 direct set. Verified live on xlab-gw: LAN v6 client -> tuna
now egresses wan99.0 direct (http 200), was timeout.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

xlab-gateway: performance governor + BBR/fq + larger socket buffers ...

WG-crypto + routing appliance tuning: powerManagement.cpuFreqGovernor=performance
(pin cores -> consistent WG throughput + lower forwarding jitter); load tcp_bbr +
net.ipv4.tcp_congestion_control=bbr + net.core.default_qdisc=fq; rmem/wmem_max 64M
+ tcp_rmem/tcp_wmem 64M autotune ceiling + netdev_max_backlog 16384 for high-RTT
abroad BDP. Helps xlab-originated TCP; forwarded transit keeps endpoints' own CC.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick/datapool: stamp RoCEv2 RDMA-CM ToS 96 (DSCP 24) for prio-3 QoS ...

roce-rdma-cm-tos oneshot writes default_roce_tos=96 (DSCP 24) to every RDMA
device's rdma_cm configfs before nfsd accepts client QPs, so skydick's RoCE
egress is classified into priority 3 (the switch/client PFC lossless queue).
Marking half only ("decision C") — PFC on prio 3 deferred: ConnectX-3/mlx4
does PCP-based PFC with no upstream trust-dscp. Also corrected the stale
"ConnectX-5/mlx5_bond_0" comment -> the RoCE fabric is ConnectX-3 Pro / mlx4_0
on bond40g (the mlx5/CX-4-LX ports are DOWN since the 2026-05-15 40G cutover).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab: persist CAPWAP DF-clear so Cisco APs can join the WLC over the wg tunnel ...

The lab 3802 (b08b.cfa8.4fa8) joins the C9800 (10.0.10.10) via opt43/DNS, but its
DTLS cert is a ~1469B DON'T-FRAGMENT packet that blackholes on the 1420-MTU
wg-to-wgnet tunnel (AP ignores PMTUD + DHCP interface-mtu). Add a systemd service
that clears DF on UDP->10.0.10.10 at bond.lan254 ingress (tc pedit) so the cert
fragments through and the WLC reassembles it. With this live the AP reached
Operation Status: Registered. See memory cisco-wlc-discovery.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab/kea: pin AP wired MTU to 1420 (interface-mtu) so CAPWAP joins over WG ...

The 3802 sends 1441-byte DF DTLS packets to the WLC and ignores PMTUD
frag-needed (mtu 1420), so the join blackholes on the 1420 wg-to-wgnet tunnel
and cycles every 30s. Add DHCP option-26 interface-mtu=1420 to the cisco-ap
class so APs cap their wired MTU and never exceed the path MTU.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab/kea: announce Cisco WLC 10.0.10.10 via DHCP option 43 (cisco-ap class) ...

Mirrors door1's kea-dhcp4 cisco-ap client-class so remote APs on the lab
(10.253.254.0/24) discover the Catalyst 9800-CL WMI: option-60 "Cisco AP*"
clients get vendor-encapsulated-options F1:04:0A:00:0A:0A (opt43 sub-opt 241).
Both scopes already hand out domain dev.skyw.top + DNS 10.0.0.1; the
CISCO-CAPWAP-CONTROLLER.dev.skyw.top A record (10.0.10.10) is the DNS-discovery
backup. Lab->WLC reachability over wg-to-wgnet confirmed (1.24ms).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick/samba: veto macOS .DS_Store / AppleDouble junk at the SMB layer ...

Add `veto files` + `delete veto files` to the Samba global so Finder turds
(.DS_Store, ._*, .Trashes, .TemporaryItems, .fseventsd, .apdisk) stop
accumulating on the rw shares. fruit:metadata=stream keeps genuine Apple
metadata in xattr streams, so vetoing ._* is safe.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick: read-only [torrents] SMB share + stale-doc fixes ...

Expose /srv/media/data (raw torrent payload) read-only & browseable to
@storage as \\SKYDICK\torrents, so every storage user can see the per-tracker
download tree and re-seed the same files without re-downloading. Seeding needs
only read access, so the share grants no write: door-pek's qBittorrent (uid
900), writing /srv/media over the rw,all_squash NFS export, stays the sole
writer. On-disk perms already permit @storage reads (payload 0640, dirs
0750/2775, group-readable by storage gid 997).

Docs:
- README: deploy-rs is the canonical push workflow (was "not consistently
  used"); skydick is bonded 2x40G ConnectX-3 / MTU 9200 (was "bonded 100G");
  IPv6 is enabled with stable token ::d1c0 (was the old enableIPv6=false gotcha).
- DATAPOOL.md: network header, new Torrents share row + "### Torrents" section
  with a re-seed runbook, connect examples, the remote door-pek writer note,
  and MTU 9200.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Added ajax to skydick

skydick: pin local CERNET NTP (ntp.tuna.tsinghua.edu.cn) instead of abroad pool ...

Default 0.nixos.pool.ntp.org resolved to a Vultr server abroad (137ms delay,
42ms jitter) -> ~60ms offset swings that flapped the clock-drift alert. tuna is
on-campus (0.58ms RTT); ntsc stratum-1 (~19ms) backup. Fixes the offset at the
source instead of widening the alert.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs: record implemented gateway optimizations (IPv4 egress, QoS, L7 DPI live) ...

IPv4 egress switch (347->65ms, live), wg-sgp-qos CAKE enabled (criterion 3),
DPI L7 confirmed live/scoped (corrects earlier inert mis-read), relay-RTT
Grafana panel. All 8 requested features now done or assessed.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs: gateway optimization & feature-feasibility assessment (2026-06-14) ...

Audit of .1 (R730, healthy) + feasibility of the requested features on the
current network. Key finding: abroad relay RTT 347ms (IPv6 mis-routed via LAX)
vs 65ms (IPv4 direct to Equinix SG) — IPv4 free here, blocked only by Oracle
security list. Plus L3-vs-L7 split, BT/exit QoS (CAKE), DNS-cage, RoCEv2-NFS
(already live), 10G-encrypted, Windows/Android handling. Relay-RTT Grafana panel
added.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick: lock ldx NFS export to single client (10.0.75.15 + v6 /128) ...

Was exported to the whole 10.0.0.0/16 LAN; restrict to ldx's host only,
per request. v6 uses the /128 (fd99:23eb:1682::75:15), NOT a /64 — the
LAN ULA /64 is shared by every host, so a /64 would defeat the lock
(unlike zhuyz24's /64, which is their own private remote network).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Merge PR #2 (xuelin): skydisk allow zzy via xuelin ip

skydisk: allow zzy via xuelin ip

skydick/networking: disable IPv6 temporary addresses on bond40g ...

The IPv6 SLAAC config aimed to pin the stable ::d1c0 token address as the
source, but NixOS emits net.ipv6.conf.bond40g.use_tempaddr=2 by default,
so the kernel generated and preferred a rotating temporary privacy
address. networkd's IPv6PrivacyExtensions=false does not override that
sysctl. Set the interface tempAddress = "disabled" so NixOS emits
use_tempaddr=0 — a storage server needs a fixed IPv6 source for ACLs,
logging, and reverse DNS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick/networking: mkForce IPv6PrivacyExtensions to fix eval conflict ...

The merged IPv6 PR set IPv6PrivacyExtensions = false on the 40-bond40g
networkd unit, but NixOS unconditionally sets it to "kernel" at normal
priority for every interface in networking.interfaces. Equal-priority
double definition aborted evaluation. mkForce resolves it while keeping
the intent: disable privacy extensions so the stable ::d1c0 token
address is the source for outbound IPv6.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick/monitoring: drop InfluxDB zpool_io, add Prometheus pool-member map ...

The Grafana dashboards (skynet-web on door1) query Prometheus, not InfluxDB —
nothing queries skydick's InfluxDB — so the zpool_io telegraf collector fed
nothing. Replace it with a node-exporter textfile metric skyw_zpool_member{pool,
device}, refreshed from live `zpool status` each run. Grafana joins it onto
node_disk_*_completed_total to get honest *physical* per-pool IOPS, drift-proof
against kernel device renames (unlike a hardcoded device regex).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skydick/monitoring: add zpool_io physical pool IOPS collector ...

Telegraf inputs.zfs poolMetrics emits per-objset *logical* read/write
counters that include ARC cache hits, so RAM-served reads appear as huge
pool IOPS with zero disk activity (misled a 2026-05-30 mountd probe). Add
a zpool-iostat exec collector emitting real vdev-layer ops as measurement
zpool_io for an honest physical-IOPS view.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Merge pull request #1 from Skyworks/xuelin ...

skydisk: add IPv6 address

skydisk: IPv6 不加 via 路由

skydisk: add IPv6 address

nfs-rdma: bind listener lifecycle to nfs-server.service ...

The nfsd-rdma-listener oneshot writes "rdma 20049" to
/proc/fs/nfsd/portlist exactly once (at boot or first activation).
It then stays in `active (exited)`. But the nfsd kernel module's
portlist is wiped when nfs-server.service STOPS — and every
`nixos-rebuild switch` that touches services.nfs.server or its
config cycles nfs-server. After the cycle, port 20049 silently
goes dead while the listener unit shows "active" (it never re-ran).

Caught today (2026-05-26):
  01:05:31  ldx ran nixos-rebuild switch on skydick
  01:05:49  nfs-server stopped → portlist wiped
  01:05:52  nfs-server started, port 2049 back up
            nfsd-rdma-listener.service NOT restarted (still in
            "active exited"), so 20049 stays unbound
  ~14h later: door-pek's NFS-RDMA mount finally hangs hard, df
            blocks, telegraf disk input stops emitting, my
            disk-data-full alert goes NoData and pages with
            "[no value]" labels. qBittorrent unhealthy from
            its /mnt/media-touching healthcheck. *arr health
            issues climb.

Fix: add `partOf = [ "nfs-server.service" ]`. systemd then
propagates restart from the parent unit to the listener oneshot,
which re-runs its ExecStart (re-writes "rdma 20049" into
portlist) on every nfs-server cycle. Also added the listener
to nfs-server.service's wantedBy so a stop-then-start sequence
brings the listener back too.

Manual mitigation already applied — port 20049 is back up after
`sudo systemctl restart nfsd-rdma-listener.service`. This commit
is the structural fix so the next nfs-server cycle doesn't
silently break NFS-RDMA again.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

skydick: onboard zhuyz24 to datapool ...

LDAP user (uidNumber 2200000020). Local override pins UID; GID stays at
100 (users) per existing convention so on-disk ownership matches what
NFS exports anongid to.

Revert "skydick/samba: advertise RSS + speed for SMB Multichannel" ...

The `interfaces = "lo;capability=DYNAMIC,speed=1 10.0.1.1;capability=RSS,speed=..."`
directive from 4f21721 is malformed for Samba's parser. Samba's
interfaces list uses spaces between entries and semicolons to attach
multichannel options to a single interface, but the parser in 4.22
splits on semicolons FIRST, producing 6 invalid tokens instead of 2
tagged interfaces:
  lo capability=DYNAMIC speed=1 10.0.1.1 capability=RSS speed=80000000000

Symptom chain caused by this:
  - getaddrinfo failed for "capability=DYNAMIC" (logged in smbd debug)
  - interfaces table corrupted → rpcd_classic crash-loops with
    NT_STATUS_CONNECTION_DISCONNECTED on svcctl endpoint init
  - SMB auth from real clients rejected as "Authentication error"
    even with valid credentials (LDAP backend was fine; the proximate
    cause was the broken RPC fabric below the auth layer)
  - Both ldx@MacBook and ldx@Mac-mini couldn't connect via Finder
    SMB to \\10.0.1.1\ldx (verified with smbutil view -N //[email protected]
    → "server rejected the authentication")
  - LDAP entries were intact (sambaNTPassword still 981fb5a6...,
    POSIX userPassword still SSHA-hashed, account flags [U  ])

Reverting drops `interfaces`, `bind interfaces only`, and keeps only
`server multi channel support = yes` so clients can still negotiate
multichannel (just without the server-side RSS advertise hint).

Re-enabling capability advertising can be tried later with verified
syntax. Candidate per the Samba wiki examples:
  interfaces = bond40g;capability=RSS,speed=80000000000
(without loopback's DYNAMIC tag, which may be what tripped the parser).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

skydick/samba: advertise RSS + speed for SMB Multichannel ...

Closest thing to "use the whole bond from SMB" without the
ksmbd/userspace fork dilemma. `server multi channel support = yes`
was already on but the client side (macOS, Windows) needs an
explicit capability hint to actually open more than one TCP
stream — without `interfaces ... ;capability=RSS,speed=...`,
Sequoia clients negotiate a single channel and that's it.

Now advertised:
  lo         capability=DYNAMIC speed=1                (loopback)
  10.0.1.1   capability=RSS     speed=80_000_000_000   (bond40g aggregate)

Effect: Sequoia 15.4+ opens up to 32 channels per SMB3 session;
LACP layer3+4 xmit hash distributes those streams across both
40 GbE bond slaves. Expected SMB throughput improvement is 2-4×
on bulk Finder copies vs single-channel TCP, with zero feature
loss (still userspace smbd: LDAP, Spotlight, fruit, recycle, TM
all intact).

Paired with `bind interfaces only = yes` so smbd doesn't listen
on any incidental interface (the existing `hosts allow` IP filter
stays as a second layer).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

skydick/networking: tidy bond40g comments + reference cisco Po5

skydick/networking: drop bond0, rename references to bond40g ...

bond0 (ConnectX-4 LX 25G, active-backup) was carrying 10.0.1.1/16
until the 2026-05-15 cutover onto bond40g (2× 40G ConnectX-3 LACP
layer3+4, MTU 9200). With cutover done and verified — Aggregator ID
1 on both slaves, jumbo end-to-end to gateway, traffic flowing —
the old bond is dead weight.

* Remove the `bonds.bond0` and `interfaces.bond0` blocks.
* Rename the remaining active `bond0` references to `bond40g`:
  - `systemd.network.networks."40-bond0"` → `."40-bond40g"`
  - `"net.ipv6.conf.bond0.accept_ra"` sysctl
  - `skyworks.monitoring.netInterfaces = [ "bond0" ]`
  - wait-online and RA-leak comments
* The freed enp4s0f0np0/enp4s0f1np1 are now standalone DOWN,
  available for future use.

The live kernel `bond0` device persisted past nixos-rebuild
because networkd doesn't destroy unmanaged ifaces; cleaned up
manually with `ip link set <slave> nomaster; ip link del bond0`.