v0.5.0

TollGate v0.5.0 (tollgate-wrt)

Released: 2026-07-03

v0.5.0 is the resilience-and-hardening release. The headline theme is that a TollGate now degrades gracefully instead of falling over: a failing Cashu mint no longer blocks purchases, the merchant drops into a degraded mode (and recovers) when no mint is reachable, and the reseller path — one TollGate buying from another over Wi-Fi — got a dedicated upstream Wi-Fi manager plus a series of two-router autopay reliability fixes. Around that core, the captive portal gains HTTPS, Lightning checkout, and a balance view; configuration becomes schema-driven with a JSON CLI for admin-UI integration; packaging adds .apk output for OpenWrt 25.x and an x86_64 target; and a security pass hardened password generation, proxy-header trust, and the captive-portal firewall posture.

At a glance

• Per-mint health tracking, try-all-mints fallback on payment, and automatic recovery of mints that come back online.
• Merchant degraded mode: the router keeps serving and recovers dynamically when mints become reachable again, with a matching captive-portal UI.
• New upstream Wi-Fi manager: startup connectivity check, TollGate-aware probing, and a cross-radio DHCP nudge to recover stuck links.
• Captive portal: HTTPS with a self-signed certificate mode, Lightning checkout, and a balance view.
• Schema-driven configuration with tollgate --json config schema/get/set/save for admin-UI integration; config schema moves to v0.0.8 with in-place migration.
• Packaging: .apk output for OpenWrt 25.x alongside .ipk, an x86_64/amd64 target for virtual-lab testing, and a local OpenWrt SDK build helper.
• Releases are published redundantly: NIP-94 events on multiple Nostr relays, with every successful Blossom mirror listed as a download URL.
• Security: crypto/rand password generation, X-Forwarded-For trusted only from localhost, IP/MAC input validation, a request-body cap, and an IPv6 captive-portal bypass closed.

What's new

Mint resilience and merchant degraded mode

v0.5.0 assumes mints fail, because they do. The wallet now tracks health per mint, payment tries all accepted mints instead of giving up on the first failure, and mints that come back online are recovered automatically (#120). All accepted mints are registered in the wallet at startup (#167), and the startup health check retries aggressively so a router that boots faster than its uplink still finds its mints.

When no mint is reachable, the merchant no longer wedges: a zero-dependency PaymentMerchant interface (#138), mint-health provider plumbing (#139), and dynamic upgrade/downgrade between full and degraded operation (#140) let the router advertise its state honestly, with a degraded-mode captive-portal UI so customers see what is happening (#141).

V2 keyset IDs are now supported, keeping payments working against mints running CDK 0.16.0+ (#126).

Reseller mode: upstream Wi-Fi management and autopay reliability

The buying side — a TollGate purchasing access from an upstream TollGate and reselling it — got its own manager for the Wi-Fi link (#109, #122): a startup connectivity check, TollGate-aware probing of candidate gateways, and a cross-radio DHCP nudge that recovers links stuck after a handoff.

Two-router autopay got a matching reliability pass. The valve now retries ndsctl auth briefly so a payment's gate-open no longer fails when NoDogSplash hasn't yet registered the reseller client (#170) — previously this surfaced as "failed to open gate" and only recovered via token recovery a minute later. A stale valve timer callback can no longer delete its replacement, and payout math is guarded against division-by-zero and uint64 underflow (#161). Data-metered (bytes) sessions always open the gate on purchase (#167).

Captive portal: HTTPS, Lightning checkout, balance view

SSL/HTTPS management for the captive portal is new in this release and implemented in Go with wrapper scripts (#123, #142): a self-signed certificate mode, hostname setup (the router presents as TollGate), and captive-portal domain configuration. Along the way this fixed a uhttpd crash loop, keeps NoDogSplash on port 80, and makes the certificate CN match the actual hostname.

The portal itself gains a Lightning checkout flow and a balance view (#107).

Schema-driven configuration and the JSON CLI

Configuration is now schema-driven: GetConfigSchema() describes every field, and dot-path get/set with validation backs a new tollgate --json config schema/get/set/save command family (plus health and wallet queries) built for admin-UI integration (#147). The schema ships with a contract lint and a build-purity contract test in CI, so the schema, the Go types, and any JS consumer cannot drift apart silently.

Packaging and distribution

• OpenWrt 25.x .apk. The CI matrix now produces .apk packages alongside .ipk (#97, #183). Install with apk add --allow-untrusted; the .ipk continues to cover OpenWrt 24.10 and earlier via opkg.
• x86_64 / amd64 target for virtual-lab testing (#80).
• Local OpenWrt SDK build helper (scripts/build-sdk-package.sh) for reproducing package builds off-CI (#105, #79).
• Redundant release distribution. Packages are uploaded to multiple Blossom servers and announced as NIP-94 events on multiple Nostr relays (#152, #155), with every successful mirror included as a url tag (#183), so one dead mirror doesn't strand a release.

Behavior changes worth flagging

These affect operators on upgrade.

• Config schema is now v0.0.8. Existing v0.0.7 configs are migrated in place on first start: the version is bumped and missing upstream-Wi-Fi defaults are filled in; your explicit settings are preserved (#178).
• Default profit share now splits the dev cut individually. The 0.21 developer share in fresh default configs is replaced by three maintainer identities at 0.07 each (c08r4d0r, amperstrand, origami74), each with its own Lightning address; the 0.79 owner share is unchanged (#165). Existing configs keep whatever profit_share they already have.
• IPv6 is disabled on the LAN at installation. Clients could previously route around the captive portal over IPv6; NoDogSplash only gates IPv4 (#148, #160).
• NoDogSplash gateway port is now 2050, and a malformed BOLT11 invoice no longer aborts startup (#158).
• The router presents as TollGate: hostname and captive-portal domain are configured at setup, and the TLS certificate CN matches (#123).

Notable bug fixes

The CHANGELOG has the exhaustive list. The operator-relevant subset:

• Payment correctness bundle: case-insensitive mint URL comparison, proper spent-token detection, and valve re-auth without a stale in-memory cache (#104).
• Transport reliability on OpenWrt: TLS 1.2 is forced and HTTP clients get timeouts, so requests no longer hang indefinitely on constrained routers (#137).
• First-boot stability: the reboot race is gone, uci-defaults run faster, the AP SSID is unified (#84), and postinst executes UCI defaults and reloads services so a fresh install comes up correctly (#90).
• .ipk installs on stock OpenWrt: the package is wrapped as a gzipped tar instead of an ar archive (#100).
• Expired timed sessions are evicted and the scan loop actually starts (#106).
• Duplicate NoDogSplash firewall rules in `users_t...

v0.3.1

1. Fixed Wi-Fi Network Auto-Detection: Wi-Fi networks are now properly detected as upstream connections. Previously, wireless interfaces were incorrectly filtered out, preventing automatic gateway discovery over Wi-Fi.

2. Compressed Build Variants: New compressed package variants are now available for devices with limited storage (16MB flash). These packages are 40-60% smaller and visible in the release explorer at releases.tollgate.me.

Bug Fixes:

• Wi-Fi Detection (#66): Removed wireless interfaces from Crowsnest's ignore list, enabling automatic detection of Wi-Fi-based upstream gateways

Enhancements:

• UPX Compression (#63): Added compressed package variants using UPX compression
  • Multiple compression levels supported (fast, best, brute, ultra-brute)
  • Compression type included in filename and metadata tags
  • Reduces package size by 40-60% for constrained devices
  • Both compressed and uncompressed variants published to release explorer

Manual Installation:

1. Visit releases.tollgate.me
2. Filter by package name tollgate-wrt, version v0.3.1, and your architecture
3. Choose compressed variant for devices with <32MB flash, uncompressed otherwise
4. Install: opkg install /path/to/package.ipk

• Arjen (@Origami74) - Wi-Fi network detection fix
• Amperstrand (@Amperstrand) - UPX compression implementation

---

For more information, visit the TollGate project repository.

v0.0.2 - Improved Configuration, Multi-Mint Support, and auto update

Summary of Key Changes in v0.2.0

This document provides a high-level summary of the key changes in this release. This release builds upon v0.2.0-beta1 with a much better captive portal.

Key Changes

1. New Captive Portal

• Completely rebuilt the captive portal interface
• Added a proper success page that shows when you're connected
• Better error messages when things go wrong
• Works better on mobile devices now

2. Better Payment Experience

• Cleaner interface for both Cashu and Lightning payments (LN coming soon)
• Real-time token validation for Cashu
• Added internationalization support (English for now)
• Improved accessibility for screen readers

Steps to Reproduce Results

1. Flash Router with New Image

Flash the router with the latest image containing the v0.2.0-beta2 release.

2. Configure Upstream Gateway

• Connect to the router's WiFi network and configure the upstream gateway settings
• Enable reseller mode in /etc/tollgate/config.json to become a beta tester of automated purchasing

3. Test the New Captive Portal

• Connect a device to the router
• Navigate to the captive portal (should redirect automatically)
• Try both Cashu and Lightning payment methods
• Test the QR code scanner with your camera
• Try pasting tokens/invoices from clipboard
• Verify the window closes automatically after payment

4. Verify Internet Connectivity

• Complete a payment through the new portal
• Check that you get internet access
• The router should automatically purchase internet from the best available upstream gateway
• Monitor with logread | grep "tollgate" to verify session top-up works
  • logread -fe tollgate for live tailing

5. Use the CLI Interface

SSH into the router and use the tollgate command to check service status, wallet balance, and other available commands.

Notes

This release keeps all the functionality from v0.2.0-beta1:

• Automated Internet Purchases (Crow's Nest)
• CLI interface via SSH
• Raspberry Pi 4 support
• Wallet draining to Cashu tokens
• Testing infrastructure

The main focus of v0.2.0-beta2 is making the captive portal actually usable and pleasant to interact with.

Download

The release is available for download at:
https://releases.tollgate.me

Installation instructions can be found in the main documentation.

Install

This release includes two types of files: TollGate WRT (.ipk) packages and TollGate OS (.bin) images. Here’s how to understand the difference and choose the correct file for your hardware.

TollGate WRT (.ipk packages)

Use case: To install TollGate as an application on a router that is already running OpenWRT.

These are software packages that add TollGate functionality to your existing OpenWRT system. This method preserves all your current settings, files, and installed programs.

• How to choose the correct file:
  The filenames are based on CPU architecture (e.g., aarch64_cortex-a53.ipk, mips_24kc.ipk). You must select the .ipk package that matches your router's specific processor architecture.

• How to install:
  Replace <architecture>.ipk with the filename you downloaded.

  opkg install <architecture>.ipk

TollGate OS (.bin images)

Use case: To perform a fresh installation of an operating system that comes with TollGate pre-installed.

These are full firmware images that will replace your router's entire operating system. This process provides a clean, minimal OS environment optimized for TollGate.

Warning: Installing a .bin image will wipe all existing data, configurations, and programs from your device.

• How to choose the correct file:
  The filenames correspond to specific, supported router models (e.g., gl-mt3000.bin, glar300m16.bin). You must select the .bin file that exactly matches your router model.

• How to install:
  Replace <model>.bin with the filename you downloaded.

  sysupgrade -n <model>.bin

Configure

Set your lightning address as shown in the quick start guide.

Summary

Installation Type	Filename Format	Purpose	Effect on Device
TollGate WRT	<architecture>.ipk	Add TollGate to an existing OpenWRT system	Preserves all existing data and settings
TollGate OS	<model>.bin	A complete, fresh OS with TollGate built-in	Wipes the device completely

v0.0.3

Release Notes for v0.0.3

General Release Notes (Non-Technical Users)

The v0.0.3 release of TollGateOS introduces several significant improvements and new features from tollgate-basic-module-go v0.0.3:

1. Automatic Lightning Payouts: The router now automatically pays out accumulated funds to Lightning addresses, making it easier to receive your earnings without manual intervention.
2. Profit Sharing: Added support for splitting payments between multiple Lightning addresses, allowing for flexible revenue distribution among partners or service providers.
3. Improved Configuration: Enhanced configuration options for mints with more detailed settings for balance management and payout preferences.

These changes make the TollGate Module more autonomous, allowing you to receive your earnings automatically and share profits with partners or service providers with minimal manual intervention.

Technical Release Notes (Technical Contributors)

For developers and technical contributors, the v0.0.3 release includes:

1. Lightning Integration: New lightning package implementing the lightning payouts

2. TollWallet Enhancements:

   • MeltToLightning functionality for converting Cashu tokens to Lightning payments
   • Adaptive payment amounts with automatic fee handling
   • Fallback strategies for handling failed payments

3. Merchant Service:

   • Introduced merchant module, responsible for all financial decisions made by the TollGate
   • New automatic payout routine that periodically checks balances
   • Configurable minimum balances and payout thresholds
   • Implementation of profit sharing between multiple lightning addresses based on configured factors

4. Configuration Manager Updates:

   • New MintConfig structure with detailed per-mint settings including:
     • Minimum balance requirements
     • Balance tolerance percentages (tolerance = variance in minimal balence to account for unpredictable lightning fees during payouts)
     • Payout intervals and minimum payout amounts
   • New ProfitShareConfig structure supporting:
     • Multiple Lightning addresses for payouts
     • Configurable distribution factors for each recipient
   • Default configuration with 70%/30% profit sharing example. Should be updated by owner on first boot.

5. Code Organization:

   • Modular architecture with separation of concerns between wallet, merchant, and lightning components
   • Improved error handling and logging across components
   • Better test coverage for new features

These technical changes provide an automated, flexible payment distribution system built on top of the existing TollGate functionality, enhancing the module's value proposition for operators and making it more self-managing.

Installation Instructions

To install the v0.0.3 release of TollGate Module Basic Go, you have two options:

Option 1: Automatic Update via JANITOR (For Existing v0.0.2 Installations)

If you are already running v0.0.2 of TollGate Module Basic Go, the JANITOR service will automatically handle the update process:

1. The JANITOR service periodically checks for new versions of installed packages
2. When v0.0.3 is detected, it will automatically download and install the update
3. After installation, you'll need to configure your profit sharing settings as described in the Configuration Example section below

Option 2: Fresh Installation via TollGate Installer

For new installations or manual updates, use the TollGate Installer to get the latest TollGateOS:

1. Visit the TollGate Installer repository
2. Follow the installation instructions for your specific router hardware
3. The installer will configure the entire TollGateOS system, which includes the TollGate Module Basic Go v0.0.3
4. After installation, you'll need to configure your profit sharing settings as described in the Configuration Example section below

Configuration Example

After installation, you should configure your profit sharing settings in the configuration file. Here's an example configuration:

Config location: /etc/tollgate/config.json

"profit_share": [
  {
    "factor": 0.70,
    "lightning_address": "your@lightningprovider.com"
  },
  {
    "factor": 0.30,
    "lightning_address": "tollgate@minibits.cash"
  }
]

This configuration will automatically split profits with 70% going to the primary Lightning address and 30% to the tollgate address.

v0.0.2 - Improved config, Multi-Mint Support, Auto-Update

Revised Release Notes for v0.0.2

General Release Notes (Non-Technical Users)

The v0.0.2 release of TollGate OS introduces several significant improvements and new features:

1. Enhanced Build and Deployment: We've streamlined our build process with new GitHub Actions workflows, making it easier to create and publish releases. The build workflow now automatically determines the OS version and release channel.
2. Improved Configuration Management: The configuration management system has been enhanced, allowing for more flexible and robust setup options.
3. Randomized LAN IP: The system now randomizes the LAN IP address on first boot, improving security and reducing potential IP conflicts.
4. Updated First Boot Configuration: The first boot script has been updated to configure the network settings more effectively, including setting DNS servers to CloudFlare DNS.
5. New Release Management: We've introduced a new release.json file to manage module versions and dependencies.
6. Package Management: We've added package management files (packages_dev.json and packages_stable.json) to define external and custom packages for the OS.

These changes collectively enhance the functionality, reliability, and maintainability of TollGate OS.

Technical Release Notes (Technical Contributors)

For developers and technical contributors, the v0.0.2 release includes:

1. Build System Overhaul: The introduction of a new build workflow in .github/workflows/build-firmware.yml automates the package creation process across multiple architectures and OpenWRT versions. It now determines the OS version and release channel based on the GitHub ref.
2. Random LAN IP Script: A new script (95-random-lan-ip.sh) has been added to randomize the LAN IP address on first boot, improving security.
3. Release JSON: A new release.json file has been introduced in files/etc/tollgate/ to manage module versions and dependencies.
4. First Boot Script Updates: The first boot script (91-os-firstboot-script.sh) has been updated to configure network settings, including setting DNS servers to CloudFlare DNS and setting the domain to 'lan'.
5. Package Management Files: New files (packages_dev.json and packages_stable.json) have been added to define external and custom packages for the OS.

These technical changes provide a more robust, maintainable, and scalable foundation for TollGate OS, while also introducing new features and improving existing functionality.

Installation Instructions

To install the v0.0.2 release of TollGate OS, follow these steps:

1. Download the firmware image using the following command:

wget https://blossom.swissdash.site/[correct_blossom_file_hash].bin -O tollgate-os-v0.0.2.bin

2. Upgrade your device using the downloaded image:

sysupgrade -n tollgate-os-v0.0.2.bin

You can get the blossom URL from the NIP94 event here:

{
  "id": "a867f15ca7edc95a69e1557539a624466147584f68c62a16c47fe9bca3778312",
  "pubkey": "***",
  "created_at": 1747475980,
  "kind": 1063,
  "tags": [
    [
      "url",
      "https://blossom.swissdash.site/[correct_blossom_file_hash].bin"
    ],
    [
      "m",
      "application/octet-stream"
    ],
    [
      "x",
      "[correct_blossom_file_hash]"
    ],
    [
      "ox",
      "[correct_blossom_file_hash]"
    ],
    [
      "architecture",
      "aarch64_cortex-a53"
    ],
    [
      "device_id",
      "glinet_gl-mt3000"
    ],
    [
      "supported_devices",
      "glinet,gl-mt3000 glinet,mt3000-snand"
    ],
    [
      "openwrt_version",
      "24.10.1"
    ],
    [
      "tollgate_os_version",
      "v0.0.2"
    ],
    [
      "release_channel",
      "stable"
    ]
  ],
  "content": "TollGate OS Firmware for glinet_gl-mt3000"
}

v0.0.1

Initial release

Installation

• Connect your TollGate to the internet using the WAN port or via WiFi in the browser UI.
• Ensure that your TollGate's DHCP server doesn't distribute the same IP address range as its upstream gateway
• Download and install the new image on your TollGate

ssh root@[TollGateIPAddress]
cd /tmp
wget --no-check-certificate [image URL]
sysupgrade -n [image file]

• wait a few minutes. Reconnect your computer to find out if your TollGate is ready.
• connect your TollGate to the internet via WAN or WiFi again. The browser UI is now available at [TollGate IP]:8080
• ensure that your TollGate's DHCP server isn't conflicting with its upstream gateway's DHCP server again
• pay your TollGate with e-cash notes from mint.minibits.cash
• your TollGate stores its e-cash in files on the root directory ls /[npub hex]

Features

• has captive portal
• takes money
• gives internet
• saves money in files '/[pubkey]'
• Hardcoded pricing/pubkeys/etc... will be fixed in future versions

Binary source

https://github.com/OpenTollGate/tollgate-os/actions/runs/14118121519/job/39552965172