feed

An agentic home router?

published 2026-10-25 words 581 min 3

A black screen of grey bars: upload above a time axis running from late evening to morning, download hanging below it, with the line's status, today's totals and the current rate along the top
The Raspberry Pi's screen: the internet line's last 12 hours, upload above the axis, download below, a bar per five minutes.

My home router is a small x86 box running NixOS, mostly built with an AI coding agent. That sounds risky, but the setup keeps it reasonable, and the payoff is a prompt for any question about my network.

A small black fanless box with cooling fins on top and, on the front, four Ethernet ports labelled ETH0 to ETH3, two USB ports, two HDMI ports and a 12 V power jack
The router: a fanless mini PC with four 2.5 GbE ports (the seller's photo).

Ask it anything

The router logs every connection, DNS answer, block and drop into PostgreSQL on the home server, already labelled with device names. So I just ask:

  • “Why was there a traffic spike last night?”
  • “Why is my Mac uploading so much?”
  • “Which device started talking to a new domain?”
A terminal window: the question 'what's getting blocked the most today?', the SQL query the agent wrote, a table of blocked ad and tracking domains per device with made-up names (sell-my-logs 614 times from the server, sponsored-meeting 248 from the Mac, wifi-coupons 136 from the Wi-Fi controller, crash-sale-50-off), and the agent's answer: mostly things trying to sell you, and the blocklist didn't buy any of it
One question, one query: today's blocklist hits are mostly things trying to sell me something.

The agent writes the SQL and explains the answer. Questions that keep coming back become Grafana panels, or the Raspberry Pi screen at the top.

Why it works

  • Config in git. The router is a Nix flake; every change is a diff I can read.
  • Tested in VMs. NixOS’s test framework boots a router between a fake ISP and LAN clients; a red test stops the deploy.
  • Deploys undo themselves unless I confirm within 120 seconds.
  • I decide when it ships.

Privacy and security

Network logs are personal, and some of them are written by strangers (User-Agents, domain names), which an agent could be steered by. So the sensitive part stays home:

  • A local model reads the raw logs and hands the hosted agent only a summary.
  • Queries use a read-only database role.
  • Log questions run without deploy keys.

Depending on the model you use, this may not be a great idea for your security or privacy.

Was it worth it?

For most people, no: the router from the ISP does everything they need. If you want more, there are good options that just work: a mesh system like Google Nest Wifi, a UniFi gateway with a nice dashboard, or OPNsense and OpenWrt if you want more control. But if you’re curious how networks are put together (zones, DHCP, DNS, what your devices actually do all day), building one like this teaches a lot, and any question about my network is now one sentence away.