AI Disclosure:
This is just part of my workflow now. I use a main profile within hermes called “buildmo” and there’s a pipeline of agents it manages for (Ingestion, Writing, Codegen, and Validation)
buildmo really controls the main task and then off loads that to each of the above helper models.
I’m using a mix of qwen3.8, Zlm 5.3, and Deepseek 4.1 all flash, because I’m cheap
I used AI to help with the planning, drafting of the write up here, and preparing the install with some IAAC scripts to get this up and running quickly (ish), repeatably, and to share!
Any who with that out of the way heres the premise
My Devember project: a code-auditable, self-hosted 5G travel router carrying my traffic and my phone service into infrastructure I control. Desired appearance is the above lol
Why? OSS/FULU and a burning passion for owning everything I can and not being content with the level of surveillance we are all aware of with Cellular communications and SMS messaging.
How is this homelab related? Think of it like bringing the homelab into the public and on the go. Its a mini portable homelab but explicitly its the “forbidden router” plus some extra’s that make this more than just: I’m running debian on a pi with openWRT as a container, needs to be able to intercept and interface with the SMS messaging and VoLTE functionality but done through a second service that will pipe this into my matrix instance in my homelab.
Couldn’t you just buy a travel router Yes! And the Gl.iNet Mudi 7 and Spitz 7 models did offer compelling cases for a buy then plug and play with a sim card, BUT (and this is a big butt), I wouldn’t be certain theres no shenanigans being done within the firmware blob that is bundled with these devices. Could hack something together there… but why not just hack something together with commodity hardware! But I would definitely love to see someone in the community free these hardware pieces so you don’t have to have such an interesting/horrifying device to lug around.
but… here we are:
the “Godless” router
| part | price | | Simcom SIM8260G-M2 — X62 / R16, M.2 3042 Key-B | $281.99 | | Waveshare PCIe-to-M.2 4G/5G HAT (Key-B 3042/3052 slot, 5G-4IN1 PCB antenna) | $44.99 | | GeeekPi 4-layer stackable case (ships four Armor Lite coolers) | $33.99 | | **Total so far ** | ~$370 |
Your most important choice that effects this build entirely is what carrier you will be using. Consult Modem manufactures documents to see if compatible and accomidating for your needs. (Im Verzion so a lot is restricted for my choices)
The module is the single biggest line item by a mile and yeah, that sucked. The radio costs that because of what it is: X62, R16, n77 plus B13/B66/B41, and a documented call-control set on the SIM82XX family… There are better options IF VoLTE is not a priority for you or your needs.
Which means you can choose between rasp pi or some SBC of your choosing, just be cautious of the Modem you choose Quectel V Simcon and their compatibility with the bridge/Hat you choose.
A self-hosted router removes the router layer entirely from an audibility case: routing, NAT, DNS, the AP, the UI. All mine to read and control… with great power such and such. What it does not remove is the modem: a Simcom SIM8260G-M2, SIM82XX family, or Quectel RN5XX family tracking and funny business. Closed silicon in someone else’s firmware, and no router config changes that. You can’t configure away an unauditable modem, so I try to mitigate it…
Architecture of GRtr
Internet
|
[ cellular WAN: SIM8260G-M2 (X62 / R16, 3042 Key-B) in the Waveshare PCIe M.2 HAT ]
| n77 5G, B13/B66/B41 LTE fallback <-- the only link the modem sees
| (PCIe lane, not a shared USB 2.0 bus)
|
[ Raspberry Pi 5, 4GB — Debian 13 minimal (OpenWrt is the alternate) ]
| nftables NAT | dnsmasq | hostapd wlan0 AP | eth0 LAN
| wg0 WireGuard client: tunnel OVER the cellular iface, split-tunnel off,
| MTU 1280 + mtu_fix on the tunnel zone
| ModemManager / qmicli control plane -> LAN-only daemon, token-authed
| phone service: SMS daemon (tty, +CMT URC -> Matrix) | call bridge later
|
[ laptop / phones / clients ] (eth0 + wlan0, NAT'd, DNS via dnsmasq)
┌───────────── the Matrix plane ─────────────┐
[ Pi 5: SMS daemon ]──appservice/bot──> [ Synapse + Element, home ] <── [ Element on phone ]
[ Pi 5: call bridge ]──────────────────> (LiveKit + coturn) <── [ Element on laptop ]
^ ^
└──────────── wg0 tunnel ────────────────┘ (rides the cellular link;
the only inbound path, since
the carrier is CGNAT)
Traffic that leaves the box:
client -> wlan0/eth0 -> nftables NAT -> wg0 -> cellular (ciphertext) -> home -> Internet
Traffic the modem can see: ciphertext only.
Traffic the modem can always see: IMSI, cell ID, timing. unavoidable.
The modem always sees IMSI, cell ID and timing; :anguish: We can do some tom foolery here to pipe cypher text to the modem so traffic cannot be viewed so readily. But see above for how this in of itself is kinda futile, but at least its something… To me this network topology isn’t too crazy and I think the wireguard authentication loop can probably be subbed out for a tailscale client, so I’ll be updating as I go along in this journey.
The payoff: The IT Crowd joke, “That Jen. Is the internet”
SMS and voice (maybe) landing in my own self-hosted Matrix homeserver (Synapse + Element, LiveKit and coturn already up for Element Call). I should be able to read texts, take calls, from Element on any device I own. My server, my log, my retention policy. Everything else here is plumbing for the GRtr.
TO-BUILD. SMS into Matrix: ModemManager over D-Bus (mmcli --messaging-list-sms) or plain AT on the modem tty ( AT+CMGF=1, AT+CMGS, AT+CMGL). The one existing bridge I found is unmaintained, so I write a small daemon: hold the tty, watch for +CMT: URCs, push sender and body into a Matrix room. A weekend project … damn, this used to take months.
LATER. A SIP trunk plus Asterisk and an appservice gives a real PSTN number … but it’s the trunk’s number, not the SIM’s… this piece is kinda wonky and I haven’t the tools here yet to test properly.
MOONSHOT. VoLTE/IMS on the module itself, with no audio path on this HAT. I’ll attempt it last… should just be data right? … right?
Custom router UI: a small LAN-only daemon just needs to display the roughs of what I need but can also be an attack vector so need to be catious in implementation. Want to keep it simple and just be the page I check to see if its working and alive.
OS and stack. Leaning Debian 13 minimal: ModemManager, Asterisk, Python and a real toolchain are what the phone service wants, and I’m not fighting a router distro to install a SIP stack. That’s ~30 lines of nftables I write myself instead of netifd. OpenWrt stays the alternate; vendor integration already done, netifd handles the plumbing, phone daemon in a container or netns beside it.
IaC/automation ideas welcome: I manage the rest of my homelab as code from my laptop with an agent fleet, and a reproducible flash-and-configure path is a real goal. Hypervisor, autossh or anachronistic takes, Or something wacky I’m all for. This is a real frankenstein box and a middle finger to Apple and Google as my phone is one of the last pieces of tech that actively spys on me and harvest pieces of my identity.
Ramble done. Thank you for reading! I’ll post more here, and direct my previous thread to this one as this became a devember proj during planning. Happy deving y’all