PURE — Network-Wide Ad Blocker

PURE sits next to the home router and answers every DNS query on the network: requests for ad and tracker domains go nowhere, everything else resolves normally. It is a Luckfox Pico Max — a Rockchip RV1106G3 Cortex-A7 with 181 MB of usable RAM and 256 MB of SPI NAND — running Buildroot Linux, with the resolver cross-compiled for armv7 as a single static Go binary so the whole system fits on the NAND without a microSD card.

Most of the work was making a development image behave like a product. The stock image shipped with an empty CA store, so the encrypted upstreams failed silently while the service looked healthy; a launch script overwrote the static address with a DHCP lease; a boot race left the board without a default route; and the ownership of /root made sshd reject keys. Each is fixed in the image rather than by hand on every unit, and the init chain was extended so the box can find its own place on a network it has never seen.

Everything is sized for the hardware. Five services share the RAM, and the extra features — outage log, speed tests, new-device alerts, Telegram notifications — run in one Python process on one timer loop instead of five. The board runs 24/7 on flash with a finite write life, so raw data stays in RAM. Features the kernel cannot support — NAT, VPN, packet filtering — were measured and ruled out instead of promised.

Production is written down as a per-unit process around a golden NAND image: flash, verify, strip the development tooling, reset to the setup wizard so the customer sets their own password, and sign off an exit checklist per serial number.