hejhej.devA small blog.Zola2026-10-30T00:00:00+00:00https://hejhej.dev/atom.xmlAn agentic home router?2026-10-30T00:00:00+00:002026-10-30T00:00:00+00:00
Unknown
https://hejhej.dev/agentic-router/<figure>
<img src="https://hejhej.dev/processed_images/pi-screen.c011abaf5dc9b919.png" width="1600" height="960" alt="A black screen of grey bars: upload above a time axis running from late evening to morning, download hanging below it, with the line's status, today's totals and the current rate along the top" loading="lazy" decoding="async"><figcaption>The Raspberry Pi's screen: the internet line's last 12 hours, upload above the axis, download below, a bar per five minutes.</figcaption>
</figure>
<p>My home router is a small x86 box running <a rel="noopener noreferrer external" target="_blank" href="https://nixos.org">NixOS</a>, mostly built with an AI
coding agent. That sounds risky, but the setup keeps it reasonable, and the payoff is a prompt
for any question about my network.</p>
<figure style="max-width: 320px">
<img src="https://hejhej.dev/processed_images/router.63dc0443ed215ad5.jpg" width="640" height="386" alt="A small black fanless box with cooling fins on top and, on the front, four Ethernet ports labelled ETH0 to ETH3, two USB ports, two HDMI ports and a 12 V power jack" loading="lazy" decoding="async"><figcaption>The router: a fanless mini PC with four 2.5 GbE ports (the seller's photo).</figcaption>
</figure>
<h2 id="ask-it-anything">Ask it anything</h2>
<p>The router logs every connection, DNS answer, block and drop into
<a rel="noopener noreferrer external" target="_blank" href="https://www.postgresql.org">PostgreSQL</a> on the home server, already labelled with device
names. So I just ask:</p>
<ul>
<li>“Why was there a traffic spike last night?”</li>
<li>“Why is my Mac uploading so much?”</li>
<li>“Which device started talking to a new domain?”</li>
</ul>
<figure>
<img src="https://hejhej.dev/processed_images/blocked.97b7936df5a90576.png" width="1520" height="1016" alt="A terminal window: the question 'what's getting blocked the most today?', the SQL query the agent wrote, a table of blocked domains per device with counts (a Datadog log intake 614 times from the server, Teams telemetry 248 from the Mac, the Wi-Fi controller's traces 136), and the agent's answer that it's almost all telemetry" loading="lazy" decoding="async"><figcaption>One question, one query: today's blocklist hits are almost all telemetry.</figcaption>
</figure>
<p>The agent writes the SQL and explains the answer. Questions that keep coming back become
<a rel="noopener noreferrer external" target="_blank" href="https://grafana.com/oss/grafana/">Grafana</a> panels, or the
<a rel="noopener noreferrer external" target="_blank" href="https://www.raspberrypi.com">Raspberry Pi</a> screen at the top.</p>
<h2 id="why-it-works">Why it works</h2>
<ul>
<li><strong>Config in git.</strong> The router is a <a rel="noopener noreferrer external" target="_blank" href="https://wiki.nixos.org/wiki/Flakes">Nix flake</a>; every
change is a diff I can read.</li>
<li><strong>Tested in VMs.</strong> NixOS’s
<a rel="noopener noreferrer external" target="_blank" href="https://nixos.org/manual/nixos/stable/#sec-nixos-tests">test framework</a> boots a router
between a fake ISP and LAN clients; a red test stops the deploy.</li>
<li><strong>Deploys undo themselves</strong> unless I confirm within 120 seconds.</li>
<li><strong>I decide when it ships.</strong></li>
</ul>
<h2 id="privacy-and-security">Privacy and security</h2>
<p>Network logs are personal, and some of them are written by strangers (User-Agents, domain
names), which an agent could be steered by. So the sensitive part stays home:</p>
<ul>
<li><strong>A local model reads the raw logs</strong> and hands the hosted agent only a summary.</li>
<li><strong>Queries use a read-only database role.</strong></li>
<li><strong>Log questions run without deploy keys.</strong></li>
</ul>
<p>Depending on the model you use, this may not be a great idea for your security or privacy.</p>
<h2 id="was-it-worth-it">Was it worth it?</h2>
<p>For most people, no: the router from the ISP does everything they need. If you want more,
there are good options that just work: a mesh system like
<a rel="noopener noreferrer external" target="_blank" href="https://store.google.com/category/connected_home">Google Nest Wifi</a>, a
<a rel="noopener noreferrer external" target="_blank" href="https://ui.com/cloud-gateways">UniFi</a> gateway with a nice dashboard, or
<a rel="noopener noreferrer external" target="_blank" href="https://opnsense.org">OPNsense</a> and <a rel="noopener noreferrer external" target="_blank" href="https://openwrt.org">OpenWrt</a> if you want more control. But if
you’re curious how networks are
put together (zones, DHCP, DNS, what your devices actually do all day), building one like this
teaches a lot, and any question about my network is now one sentence away.</p>