The OpenWrt package feed of Skyglide. Skyglide runs secure Wi-Fi at cafés and event venues, and gives each member one private network for their devices wherever they are. This feed puts it on OpenWrt routers:

Package	For	What it does
`skyglide-venue`	The router at a venue (the GL.iNet Flint 2 is recommended)	Runs the location: the `skyglide.com` and `skyglide.com_guest` Wi-Fi networks, per-member passwords and networks, the guest network's captive portal (openNDS), the site tunnel to the Skyglide cloud and the device observations the cloud needs
`luci-app-skyglide-venue`	Venue staff	A LuCI page with counts (members and guests online, guest passes, vouchers), vouchers for customers and the venue's own networks. Staff sign in as `staff` and see nothing else of the router
`skyglide-home`	A member's own router at home	Makes it a site of its owner's network: the home LAN reachable from the owner's devices anywhere, the home connection as their internet exit, and home addresses for their devices away from home
`luci-app-skyglide-home`	The router's owner	Services → Skyglide: pairing with a join key from the member portal, the tunnel's state, and switches for home LAN access, the internet exit and home addresses

skyglide-venue and skyglide-home exclude each other. The agents in both packages, /usr/sbin/skyglide-venue and /usr/sbin/skyglide-home, come from skyglide.com/rustapp.

Status: a first cut. The packages build for every architecture of the test matrix below and pass their checks in OpenWrt 24.10.8 VMs of x86/64, x86/generic, arm64, 32-bit ARM and MIPS, and in an OpenWrt 23.05.6 x86/64 VM, with the real agents; nothing has run on real router hardware yet.

Supported routers

Skyglide recommends the GL.iNet Flint 2 and supports any router that runs OpenWrt 23.05 or newer with firewall4 and kernel WireGuard. A venue also needs a full hostapd build (wpad-mbedtls, wpad-openssl or wpad-wolfssl, not a -basic or -mini one), at least 128 MB of RAM (256 MB recommended) and 16 MB of flash (32 MB recommended); a home router needs 64 MB and 8 MB (128 MB and 16 MB recommended). Both agents check this themselves (skyglide-venue check, skyglide-home check, shown on their LuCI pages): every item is ok, limited or missing, with the reason. Vendor firmware built on OpenWrt is best effort.

Matrix target	Package architecture	Agents built for	Tested in
mediatek/filogic (GL.iNet Flint 2)	`aarch64_cortex-a53`	`aarch64-unknown-linux-musl`	armsr/armv8 VM
ramips/mt7621	`mipsel_24kc`	`mipsel-unknown-linux-musl`	malta/le VM
ipq40xx/generic	`arm_cortex-a7_neon-vfpv4`	`armv7-unknown-linux-musleabihf`	armsr/armv7 VM
x86/64	`x86_64`	`x86_64-unknown-linux-musl`	x86/64 VM
x86/generic	`i386_pentium4`	`i586-unknown-linux-musl`	x86/generic VM

The static binaries depend on no library of the router, so the same packages install on OpenWrt 23.05 and 24.10. Other targets of these architectures (mvebu, ath79 with mips_24kc, …) need only an SDK run of their own; skyglide.mk maps OpenWrt's ARCH to the Rust target. Pairing and configuration wait for the Skyglide cloud, which is not built yet; until then the agents take a development configuration (see rustapp's readme).

Using the feed

In an OpenWrt 23.05 or 24.10 buildroot or SDK, add the feed to feeds.conf:

src-git skyglide https://code.foss.global/skyglide.com/openwrt.git

Then install and build:

./scripts/feeds update skyglide
./scripts/feeds install -p skyglide -a
make package/skyglide-venue/compile SKYGLIDE_DIST_DIR=<dir>

<dir> holds the agents built from the rustapp commit pinned in skyglide.mk, as <dir>/<rust target>/skyglide-home and <dir>/<rust target>/skyglide-venue (see the matrix above). ci/agents.sh builds them for the matrix with rustapp's ci/router/build.sh.

Where the binaries come from

The agents are Rust programs. They are not compiled with the packages feed's Rust: it bootstraps Rust 1.94 and LLVM from source in every SDK, which took 28 minutes at 16 jobs and peaked at 21 GB for one SDK on the shared build host (2026-10-29), every architecture and every release again, since its binaries link the router's own musl.

Instead ci/agents.sh builds them with rustup's prebuilt std for aarch64, 32-bit ARM, i586 and x86_64, and with a dated nightly and -Zbuild-std for MIPS (a Rust tier 3 target), using each target's OpenWrt SDK only for its C compiler and linker (jemalloc is C). They are static musl binaries; the packages ship them unchanged: OpenWrt's strip is switched off for them, and the files in a package match rustapp's build byte for byte.

Next step, once rustapp releases: attach the binaries to rustapp's releases and download them with a checksum (PKG_SOURCE and PKG_HASH) instead of SKYGLIDE_DIST_DIR.

On the router

Configuration is /etc/config/skyglide. The agent's state, including the router's WireGuard key, is in /etc/skyglide/ (mode 0700). sysupgrade keeps both.
procd runs the agent (/etc/init.d/skyglide-venue or skyglide-home).
rpcd exposes it to LuCI as the ubus object skyglide.venue or skyglide.home. The plugins in /usr/libexec/rpcd/ call the agent with --json. A join key reaches the agent on its standard input, never on its command line.
Venue staff:
- The operator gives the staff login a password with passwd skyglide-staff. Until then it cannot sign in.
- The login may call only the skyglide.venue status and voucher methods, plus LuCI's own minimal calls (skyglide-venue-staff-luci: its features, its settings in /etc/config/luci, and session checks).
- It reads no other configuration and no files.
- The agent's device observations are no ubus method at all.
openNDS reads all sections of its config as one instance. skyglide-venue removes every openNDS section except its own (opennds.skyglide) when it is installed, and keeps openNDS off until the agent has rendered that section.
skyglide-venue needs dnsmasq-full (the captive portal's walled garden) in place of the release's dnsmasq: opkg remove dnsmasq before opkg install, or -dnsmasq in an image build. It brings PHP (php8-cli, php8-mod-openssl) and ca-bundle, which openNDS's secure remote FAS uses to reach the Skyglide cloud.

Building and testing here

The scripts in ci/ use Docker for the SDK and QEMU for the test VMs (KVM for x86, emulation in Docker for ARM and MIPS). Downloads go to .nogit/cache/ in the canonical checkout and are checked against the release's sha256sums. SDKs go to .nogit/sdk/ (about 1 GB each), and all SDKs share one checkout of the base, packages and luci feeds in .nogit/feeds/.

dist=$(ci/agents.sh)                          # the agents for the whole matrix, from the pinned rustapp commit
ci/sdk.sh x86/64 --dist "$dist"               # all four packages into .nogit/packages/x86-64/
ci/sdk.sh ramips/mt7621 --dist "$dist" skyglide-home skyglide-venue   # the agents' packages of another target
ci/vm-test.sh home --packages .nogit/packages/x86-64 --dev-config <rustapp>/examples/home-config.json
ci/vm-test.sh venue --packages .nogit/packages/x86-64 --dev-config <rustapp>/examples/desired-venue.json
ci/vm-test.sh home --packages <dir with the mipsel_24kc agent and the LuCI app> --dev-config … --target malta/le
ci/matrix.sh --home-config <rustapp>/examples/home-config.json --venue-config <rustapp>/examples/desired-venue.json   # everything, every target
PUPPETEER=<puppeteer package dir> node ci/shots.mjs <http port> <user> <password> <LuCI path> <out.png>

ci/vm-test.sh installs the packages in a fresh OpenWrt 24.10.8 VM (--target: x86/64, x86/generic, armsr/armv8, armsr/armv7, malta/le), then checks:

that the agent runs;
that check runs and its result reaches the status as capabilities (a VM has no radio, so it reports the venue role unsupported, as it should);
the ubus objects;
pairing and switching through rpcd;
that the router's key never reaches the status;
that only Skyglide's openNDS section is left, openNDS stays off until the desired state is applied, and then runs it with authmon;
that the staff login is locked until a password is set, and that it can't reach the WireGuard key, the Wi-Fi passwords, other configuration, files or system pages;
that the LuCI pages load.

With --keep the VM stays up for ci/shots.mjs. test/stubs/ holds contract stubs of the two agents, for testing the packaging without rustapp; they are never packaged for release.

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

skyglide.com/openwrt