In use
Main
Our machines and phones.
Network
Our own network, from the ground up.
We run Lumbridge, the engine, on machines we own, and those machines sit on a network we built: our own internet line, our own routers, firmware we build ourselves, and records we keep in our own database. It is not open source and it is not a product. It is how we run our lab, from the line inward.
01 · The stack
From the line to the engine.
Read it from the bottom. Each layer stands on the one below it, and every layer here is ours to change.
SystemUbuntuThe long-term-support release, unchanged
MachinesOur machinesWorkstations and GPU boxes on the main network
RecordsCollectorEvery device, lookup and connection, in our own databaseMonitoringMetrics from the routers and the line
LineOur own internet lineThe modem only passes traffic: no Wi-Fi, no routing
02 · Routers
Firmware we build, never settings we click.
Our routers run an image we build ourselves on top of OpenWrt. A unit is never configured by hand. A change is made in the repository, built into an image, and flashed. A hand edit is lost at the next flash, by design.
2.1One source
The repository is the network.
The architecture, the address plan, the settings of every site and unit, and the recipe for the firmware all live in one private repository. Each site gets its own image from it.
2.2Roles
A unit learns its job on first boot.
One router per site runs the firewall, hands out addresses, answers name lookups and broadcasts Wi-Fi. Every other unit is an access point wired back over ethernet. A unit that is not on the site’s list keeps its radios off and waits to be added.
2.3Closed by default
Nothing listens on the internet side.
The internet side rejects everything inbound. Shell access is by key only and the web admin is HTTPS only, both from inside the network. Wi-Fi is WPA3, with WPA2 for older devices, and WPS is off.
2.4Secrets
No secret in the repository.
Wi-Fi keys and the admin password are read from our secret store during the build. They end up inside the image, so images are treated as secret and never committed.
03 · Networks
Separate networks, separate rules.
A site is split into networks. Each one has its own addresses and its own firewall rules, and a Wi-Fi name belongs to a network, not to the system.
Ready
Guest
Visitors get the internet and nothing else: no main network, no routers, no private ranges, and no other guests.
Planned
Gadgets
Smart-home devices.
Planned
Management
The units’ own admin traffic.
04 · Records
Every device, lookup and connection.
A collector we wrote in Rust keeps the history of the network: which devices were on, what names they looked up, where they connected and how much they moved. It writes to our own PostgreSQL, on our own machines.
4.1Kept apart
Main and guest never mix.
Both are recorded in full and stored separately, each readable on its own. No query mixes them unless it names both.
4.2Retention
Detail for 90 days, summaries kept.
Connections and lookups are kept for 90 days. A daily summary per device is kept after the detail is gone. The raw streams are archived too, so the database can be rebuilt from them.
4.3What it can’t see
Not the contents.
The contents of encrypted traffic are not visible, and nothing here tries to see them. A device that uses its own private DNS or a VPN shows few lookups.
05 · Monitoring
We watch it ourselves.
Our routers serve their metrics inside our own network only. Our own monitoring collects them, along with the line’s state, speeds, latency and drops, and the history stays with us.
06 · Research
Reading the air from our own radios.
This part is research. We read Wi-Fi channel state information (CSI) from our own routers: how the channel between a device and a router’s antennas looks, frequency by frequency. We have no results to report yet.
- It comes from a driver change we build into our own image. The radio firmware is the stock one, and no third-party binaries are used.
- Only devices on the main network are kept. A device known on any other network, guest included, is dropped as it arrives.
- The records go to the same collector as everything else, on our own machines.
07 · Not open source
Ours to run, not to sell.
The network is not open source and it is not something we sell. Lumbridge, the software on top, is open source, and Lumbridge 1 is the model you can call. The network is what our own machines, and the engine on them, run on.
Built on
Standing on OpenWrt.
Questions about how we run it?
Write to us. A person reads every message.