We'll use 192.168.0.0/24 address space for our network. DHCP will handle other computers, but for the router we'll set 192.168.0.1 as static address. This IP is bound to the virtual interface bridging enp2s0, enp3s0, wlp1s0 and wlp5s0. While hostapd will link the wireless interfaces automatically to this bridging interface br0, we'll bind the wired interfaces here. We'll add the following to /etc/network/interfaces.

auto br0 enp4s0
iface enp2s0 inet manual
iface enp3s0 inet manual
iface enp4s0 inet dhcp

iface br0 inet static
    bridge_ports enp2s0 enp3s0
    address 192.168.0.1
    broadcast 192.168.0.255
    netmask 255.255.255.0
    gateway 192.168.0.1

ISC DHCPd is configured in /etc/dhcp/dhcpd.conf. I don't really care for in-LAN name resolution derived from computer names, so I've left domain-name as default essentially. Fallback DNS is Cloudflare's 1.1.1.1. The router and its DNS cache use ISP DNS received via enp4s0.

option domain-name "lan";
option domain-name-servers 192.168.0.1, 1.1.1.1;

default-lease-time 3600;
max-lease-time 86400;

ddns-update-style none;
authoritative;

subnet 192.168.0.0 netmask 255.255.255.0 {
  range 192.168.0.10 192.168.0.99;
  option routers 192.168.0.1;
}

host fed-imac-wired {
  hardware ethernet 3c:07:54:18:b7:51;
  fixed-address 192.168.0.7;
} # .. etc

# internet of shit - LAN-only
host zigbee {
  hardware ethernet D4:A6:51:26:90:32;
  fixed-address 192.168.0.200;
} # .. etc

To translate network addresses, block non-essential ports, and block the IoT IP range, we'll set up /etc/nftables.conf. First we'll block non-essential ports from internet access. The LAN is a trusted zone as I can't be bothered with configuring firewall whenever I try out some in-LAN service. By default we drop everything, but then accept everything from br0 and from select ports on the WAN interface (enp4s0). I run SSH on port 404 to cut down on traffic. mosh and Wireguard require opening some UDP ports.

#!/usr/sbin/nft -f

flush ruleset

table ip firewall {
        chain incoming {
                type filter hook input priority 0; policy drop;
                ct state established, related accept
                ct state invalid drop
                iifname "lo" accept
                iifname "br0" accept
                icmp type echo-request accept
                tcp dport { 80, 404, 443 } accept
                udp dport { 51820, 60000-61000 } accept
        }
}

Then we'll set up stateful NAT using type nat hook and masquerade rules. Since it has a prerouting chain, it can also handle blocking any traffic coming in br0 from .200-.250 range that has a destination address outside LAN.

table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
                iifname "br0" ip saddr { 192.168.0.200-192.168.0.250} \
                              ip daddr != { 192.168.0.0/24, 224.0.0.0/8, \
                                            239.255.255.0/24, 255.255.255.255 } drop
        }

        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oifname "enp4s0" masquerade
        }
}

I've previously run Pi-hole bare for straightforward setup. However, it doesn't use Debian's repositories making it too hacky (but modern and trendy) for my tastes. This time I'll use a Docker container, since I only need its DNS service on port 53 without web GUI or DHCP, and container abstracts the mess of an installation away, although pay attention on what interfaces ports bind on. Docker will happily and silently poke holes in the firewall we set up above, if only e.g. 53:53/tcp is used, exposing the resolver to the internet. Unfortunately in isn't easy to passthrough host's DNS records in Docker, so we'll have to hardcode my ISP's DNS servers, which luckily have remained static. We'll use the following docker-compose.yml.

# More info at https://github.com/pi-hole/docker-pi-hole/
# and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "192.168.0.1:53:53/tcp"
      - "192.168.0.1:53:53/udp"
    environment:
      TZ: 'Europe/Helsinki'
      PIHOLE_DNS_: '1.2.3.4;2.3.4.5'
      DNSMASQ_LISTENING: 'all'
      FTLCONF_LOCAL_IPV4: '192.168.0.1'
    # Volumes store your data between container upgrades
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    restart: unless-stopped

hostapd is a tool for running access points. To have both 2.4 GHz and 5 GHz networks, two different wireless cards and different SSIDs are needed. I have a laptop grade Qualcomm QCA6174 for the 2.4 GHz and an AP grade QCA9880 for 5 GHz. First, we configure the 2.4 GHz fallback network. I chose the channel by manually testing latency/bandwidth on a couple key channels. My building has a ton of 2.4G noise and I'm using it only for IoT and vintage devices. The key settings in my /etc/hostapd/wlp5s0.conf are

interface=wlp5s0
driver=nl80211
ssid=tazca24
channel=11
hw_mode=g
ht_capab=[DSSS_CCK-40][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1]
vht_capab=[RX-STBC-1][TX-STBC][RXLDPC]

auth_algs=1
ignore_broadcast_ssid=0
bridge=br0
ieee80211d=1
ieee80211h=1
ieee80211n=1

5 GHz is globally more regulated, and so cards have all kinds of doohickeys to determine correct regulations, and especially Intel ones are usually both extremely anal and confidently wrong about regulatory domains. We'll have to first find out where our QCA9880 thinks we are by running iw reg get.

global
country FI: DFS-ETSI

phy#0
country US: DFS-FCC

phy#1
country 99: DFS-UNSET

phy#0 is the 5G card, so we're apparently in the US. dmesg says its EEPROM let ath driver choose the domain. However it didn't set it to FI which was set by iw as global.

ath: EEPROM regdomain: 0x0
ath: EEPROM indicates default country code should be used
ath: doing EEPROM country->regdmn map search
ath: country maps to regdmn code: 0x3a
ath: Country alpha2 being used: US
ath: Regpair used: 0x3a

The US domain allows running the network on channel 42, so we could go with that. However, according to Finnish regulations we are allowed to use 5150–5725 MHz band for a home WLAN. With 80 MHz bandwidth, that means channels 42, 58, 106, 122, and 138, of which some will probably have less noise than 42. Let's see how to make ath understand the local regulations and my hardware.

With any IP protocol IoT devices/hubs blocked from internet, Home Assistant can be set up. docker-compose.yml:

services:
  homeassistant:
    container_name: homeassistant
    image: ghcr.io/home-assistant/home-assistant:stable
    privileged: true
    network_mode: host
    devices:
      - /dev/ttyzbbridge1:/dev/ttyzbbridge1
    environment:
      TZ: 'Europe/Helsinki'
    volumes:
      - './ha_volume:/config'
    restart: unless-stopped

The central radio runs Mopidy from a python virtual environment. Its development has been slow and it's buggy, but Mopidy allows streaming from Youtube, Bandcamp and Tidal from a web UI like Mopidy-Iris. When it works. Mopidy-Bandcamp, Mopidy-youtube and yt-dlp are better as nightly versions straight from GitHub.

$ pip install --upgrade mopidy Mopidy-MPD Mopidy-SoundCloud Mopidy-Iris Mopidy-Local Mopidy-Tidal pygobject
$ pip install --force-reinstall https://github.com/impliedchaos/mopidy-bandcamp/archive/refs/heads/master.zip
$ pip install --force-reinstall https://github.com/natumbri/mopidy-youtube/archive/refs/heads/develop.zip
$ pip install --force-reinstall https://github.com/yt-dlp/yt-dlp/archive/master.tar.gz

Snapcast server is run as a system Systemd service, but I also want to have Bluetooth speakers automatically hook up and play when needed. Enabling linger allows user services like wireplumber and snapclient to start without logging in.

# loginctl enable-linger username

Wireplumber also requires disabling seat monitoring in e.g. ~/.config/wireplumber/wireplumber.conf.d/80-disable-logind.conf.

wireplumber.profiles = {
  main = {
    monitor.bluez.seat-monitoring = disabled
  }
}

In Syncthing, to disable global discovery, put false in <globalAnnounceEnabled> in ~/.local/state/syncthing/config.xml.