GADNET specification and the hardware you need
Raspberry Pi 5, the USB Ethernet adapter you also need, storage, cryptography, retention — and the four steps from flashing a card to an admin account.
Technical specifications
Hardware
| Device | Raspberry Pi 5 (4 GB or 8 GB) |
| Power | Official 27 W USB-C PSU (non-official chargers can cause brownouts under network load) |
| Cooling | Active cooling case required — without it the Pi 5 slows down when it overheats |
| Storage | 32 GB Class A2 microSD — the supported medium. Redis AOF + audit-log rotation wear the card; expect replacement every 12-24 months under heavy use |
| NVMe | Not yet tested — booting from an NVMe HAT is not a supported configuration today |
| Network | Pi 5 has one onboard 1 GbE port (WAN). For a wired LAN add a USB 3.0 Ethernet adapter or HAT — strongly recommended; a Wi-Fi-only setup (clients on the Pi's own radio) is also supported. Wi-Fi 5 (802.11ac) on the built-in radio; Wi-Fi 6 (802.11ax) switches on automatically with a supported USB/M.2 Wi-Fi 6 adapter |
| Throughput | About 1 Gbps is the theoretical ceiling of the onboard port; not yet benchmarked with the full GADNET stack. No hardware offload and a deliberately single-worker control plane — this is a security-first router, not a multi-gig appliance |
| Kernel | linux-rpi 6.18 |
Operating System
| Distribution | Alpine Linux 3.24 stable (ARM64) |
| Package floors | OpenSSL ≥3.5 (PQC), Python ≥3.14, Redis 8 (extended ACL categories) — all from Alpine 3.24 stable. No edge repository is configured on the image |
| Init | OpenRC, single-worker uvicorn |
| Persistence | Alpine LBU apkovl + /data partition |
Authentication
| Admin sign-in | Two alternative two-factor paths: device certificate + PIN (phones) or passkey / FIDO2 key (computers) |
| Passkeys | W3C WebAuthn Level 2, AAL2 (COSE algs: ES256, EdDSA, ES384, ES512, RS256); Level 3 is a W3C Recommendation since Aug 2026 |
| Certificate sign-in | Device certificate issued by the internal CA, bound to the device's IP address, plus a PIN |
| Recovery | Recovery phrase (seed phrase) generated in the admin panel |
| Password hash | Argon2id (64 MiB, 3 iterations, 4 threads — exceeds OWASP recommendations, tuned for RPi5) |
Cryptography
| TLS 1.3 KEMs | X25519MLKEM768 + SecP256r1MLKEM768 (hybrid PQC, NIST FIPS 203 — Aug 2024) on the router's own TLS endpoints |
| PKI signatures | EC P-384/P-256 + parallel ML-DSA-65 (NIST FIPS 204 — Aug 2024) |
| Envelope encryption | AES-256-GCM with HKDF-SHA-256 |
| Key derivation | HKDF-SHA-256 (RFC 5869, per-purpose info registry) for at-rest envelopes. PBKDF2-HMAC-SHA-256 at 600k iterations survives only for legacy envelopes, re-derived on their next write |
Network
| Default zones | 5 built-in (Isolation, Trusted, IoT, Guest, Admin) + unlimited custom |
| Firewall | iptables stateful, zone matrix, fail-secure circuit breaker. ip6tables rules ship with it, but IPv6 is off by default and enabled deliberately |
| DHCP | Dnsmasq, per-zone subnet |
| DNS | Unbound resolver; DoT upstream on by default, DoH listener opt-in, DoQ needs a custom resolver build; rule-based category filtering (UT1, RPZ) with lists you add |
| Captive portal | RFC 8908 + Apple/Android/Windows/Firefox vendor probes (byte-exact) |
Data & Storage
| Primary store | Redis 8 with RDB + AOF persistence |
| Fallback | File-based circuit-breaker (fail-secure, not silent SQLite) |
| At-rest encryption | AES-256-GCM envelope for SENSITIVE_KEY_PREFIXES; no full-disk encryption yet (LUKS is planned) |
| Backup tiers | LBU apkovl + on-device snapshot by default; off-device SSH (rsync) and S3 (rclone) once AUDIT_BACKUP_DESTINATION / AUDIT_BACKUP_S3_REMOTE are set. All signed (SLH-DSA manifest), verified before restore; off-device copies are not encrypted by the router. Restore covers the Redis database; keys need a recovery bundle (not yet producible) |
Observability
| Audit log format | Structured JSONL with stable event_type fields |
| Auth log retention | 90 days (TTL_AUTH_ATTEMPT) |
| Security audit retention | Extended (forensic reconstruction; target 7 years) |
| Threat detection | Rule-based port-scan detection, DNS category filtering, IsolationForest network-flow anomaly detection; IPS in dry-run except for critical detections |
| PII handling | IPv4 /24 + IPv6 /48 masking in outbound notifications and webhooks |
Software & Licensing
| Backend | Python 3.14 + FastAPI + Pydantic 2 |
| Frontend | Vanilla JS ES2024+ + PWA + Service Worker |
| SBOM | CycloneDX 1.6 (ECMA-424) per release — Python, PWA and Alpine alike; 1.7 available since Oct 2025 |
| License | Apache 2.0 — the source will be published with the first stable release |
How to get started
About 20 minutes from a blank SD card; a phone or a laptop is all you need to sign in · you buy the hardware yourself: Raspberry Pi 5 4 GB + official 27 W PSU + active-cooling case + 32 GB A2 microSD + a USB 3.0 Ethernet adapter (the Pi has one onboard Ethernet port, used for the internet side; the adapter gives you a wired LAN and is strongly recommended)
Download & flash
Flash GADNET to an SD card
5 minConnect & boot
Connect to your modem
10 minSet up Wi-Fi
Connect to GADNET-Setup
3 minCreate admin account
Create a local account & add devices
3 min