• servers
• neru

neru has modest hardware specs but I'm not planning to use her as a router. She's a small, low-power appliance that can run containers and takes a USB stick for extra storage.

neru is a hexS 2025 model:

• Homepage: https://mikrotik.com/product/hex_s_2025

• Product code: E60iUGS

Features and uses

• 5x 1G RJ45 ports
• 1x 2.5G SFP port
• PoE powered
• arm CPU, meaning we can run containers

Hardware

• CPU: EN7562CT

• Switch chip: EN7523 (https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features)

A surprisingly decent switch chip for such a cheap device, it does hardware STP and VLAN filtering sensibly.

Config

Notes from when I set her up as a PXE server, running TFTP (native) and HTTP (nginx in a container), serving files from the USB stick.

Served up here: http://neru.thighhighs.top:8080/

I have aris, she's an original hex S with microSD card slot and USB. She has an mmips CPU, which means no container support

But I have neru, she's a hex S 2025 model, no microSD but with USB. I'd prefer microSD because I have spares, but beggars can't be choosers. I really don't want stuff sticking out, so it'll have to be a micro-profile USB stick.

I've already messed with this before, I've enabled container mode (https://help.mikrotik.com/docs/spaces/ROS/pages/93749258/Device-mode#Devicemode-Enablingdevice-modefeature) and installed the container package.

pop in the usb stick (Sandisk Ultra Fit 64gb USB 3.2 gen1 5Gbps), it already has a partition and FS. Set the mountpoint and format it.

/disk/set usb1-part1 mount-point-template=usb1p1
/disk/settings/set auto-media-sharing=no auto-smb-sharing=no

/disk/format usb1-part1 file-system=ext4 label=neru-data

Follow the network setup outline, I've picked an IP range that shouldn't conflict with any of my stuff. The suggested docker network settings are fine in most cases though: https://help.mikrotik.com/docs/spaces/ROS/pages/84901929/Container#Container-RunningPi-hole

/interface/bridge/add name=containers priority=0xD000 protocol-mode=mstp vlan-filtering=yes
/ip/address/add address=172.25.0.1/24 interface=containers

/interface/veth/add name=netbooting address=172.25.0.2/24 gateway=172.25.0.1
/interface/bridge/port/add bridge=containers interface=netbooting

/ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.25.0.0/24

Setup container stuff

/file/add type=directory name=usb1p1/containers
/file/add type=directory name=usb1p1/srv
/file/add type=directory name=usb1p1/tmp

/container/config/set tmpdir=usb1p1/tmp
/container/config/set registry-url=https://registry-1.docker.io
/container/config/set memory-high=256MiB

/container/add auto-restart-interval=1m domain-name=thighhighs.top hostname=neru interface=netbooting logging=yes memory-high=128.0MiB mount=/usb1p1/srv:/var/www:ro name=caddy remote-image=library/caddy root-dir=/usb1p1/container-roots/caddy start-on-boot=yes workdir=/srv

The container dies immediately after start, log shows "exited with signal 4", which is a SIGILL. I'm almost certain this is an architecture limitation. Sure enough...

> For devices with EN7562CT CPU like the hEX Refresh, only arm32v5 container images are supported

I bet it's more than just that. I need a caddy image that supports v5 specifically. It's probably pulled a v7 or v8 image.

Okay caddy is too much fucking work. I'd have to build it myself on a different machine, and the Dockerfile for it only uses alpine, which isn't supported on arm32v5. I'll just use nginx, I only need static fileserving anyway so it's all moot.

https://hub.docker.com/r/arm32v5/nginx

/container/add name=nginx remote-image=arm32v5/nginx:trixie check-certificate=yes interface=netbooting mount=/usb1p1/srv:/usr/share/nginx/html:ro hostname=neru domain-name=thighhighs.top memory-high=128.0MiB root-dir=/usb1p1/container-roots/nginx start-on-boot=yes logging=yes

/container/start nginx

/ip/firewall/nat/add chain=dstnat dst-address=192.168.1.25 dst-port=8080 protocol=tcp action=dst-nat to-addresses=172.25.0.2 to-ports=80

Configure it:

root@abc3def4c047:/etc/nginx/conf.d# cat default.conf
server {
    listen       80;
    server_name  localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}