I see the fresh re-install suggestions probably work but that's tedious and risky.

I use arch, btw.

[0] https://forum.endeavouros.com/t/only-black-screen-after-logi...

So kinda like how people joke about Ikea furniture being difficult to build. I mean... it's not, it's quite intuitive. But even if it wasn't then it's purely an exercise in ability to read instructions

Do keep in mind that the OpenWRT backup does not contain information about which extra packages were installed after firstboot. I solved this adding a cron job which runs opkg list-installed > /etc/opkg_installed.txt and adding that last filepath to /etc/sysupgrade.conf so it gets added to backups.

    ls /overlay/upper/usr/lib/opkg/info/*.list | sed -e 's/.*\///' | sed -e 's/\.list//'

    # mount|grep ext4
    /dev/mapper/pve-vm--501--disk--0 on / type ext4 (rw,relatime,stripe=512)

    # ls -l /|grep -E 'overlay|rom' 
    drwxr-xr-x    2 root     root          1024 Jan 27 23:53 overlay
    drwxr-xr-x    2 root     root          1024 Jan 27 23:53 rom

systemd-networkd + kea + corerad is the software I use.

https://openwrt.org/toh/tp-link/eap615-wall is the device I use as an AP, which runs OpenWRT.

CoreRAD is about the same thing, but for NDP instead of DHCP.

I could have used systemd-networkd for serving DHCP and NDP, but prefer to use separate modular privilege-separated deamons, especially if I get memory safety too.

All updates except semi-recent DSA changes were seamless.

That's EOL now, so nowadays I'd look to ARM e.g. https://radxa.com/products/network-computer/e52c

For wireless AP i have an Mediatek MT7621 device, they are very well supported and provide proper wifi throuput

My setup is honestly simple enough that a write-up would not benefit many. My Unbound setup to block many malicious sites is also fairly well documented by others. The null routing of commonly used DoH servers is straight forward. My Chrony setup would just annoy people as I only use stratum-1 servers and the options would just look like cargo-culting to some.

About the only thing not commonly discussed is the combination of thc_cake and some sysctl options to keep buffer bloat low but OpenWRT has their own take on that topic already.

That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212

> Nobody actually cares about security for packages that are not in the default install.

Probably an exaggeration, but it's clear there are some packages that are insecure out-the-box.

   cd /etc
   git init
   git add .
   git commit -m 'default config'
   git remote add ...
   git push
   # modify your configs
   git diff HEAD
   git commit -m 'yay i changed stuff and i know what i did'
   git push

https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-...

https://openwrt.org/supported_devices/432_warning

NixOS works well for x86-64 and aarch64, but not so much armv7l, as so many consumer routers are.

The PC Engines happens to be x86-64 with decent storage expansion, but for sure if you want to target armv7l, NixOS is not a good choice.

The website for the US distributor listed on PCEngines webssite is now selling "BoingFire" products instead of PCEngines.

https://manestate.com