diff --git a/config/ap.nix b/config/ap.nix
index 0f98ba3..9996391 100644
--- a/config/ap.nix
+++ b/config/ap.nix
@@ -1770,6 +1770,7 @@
       model = "unifiac-mesh";
       location = "Coswiger Str.";
       interfaces = {
+        roof.type = "phys";
         mgmt = {
           gw4 = "mgmt-gw";
           gw6 = "mgmt-gw";
@@ -1789,7 +1790,7 @@
           ssids = {
             "Zentralwerk" = {
               net = "roof";
-              type = "sta";
+              mode = "sta";
             };
           };
         };
diff --git a/config/secrets-production.nix.gpg b/config/secrets-production.nix.gpg
index f4cad42..46ffc9a 100644
--- a/config/secrets-production.nix.gpg
+++ b/config/secrets-production.nix.gpg
@@ -1,62 +1,63 @@
 -----BEGIN PGP MESSAGE-----
 
-hQEMA2PKcvDMvlKLAQf/VrM3oRXn8dHbFyxWAps/OAhk83HD4RCIlSQUcEHYHi9i
-hMr44NqNVms4/E02bWMKlkUZmeEaVo92QmTUYyDF8hZUgZ59Kh0gQoXbSukA+8Kn
-lJ0HWg3HuAr/XqCDm3AWBzHAhuL8rYg8tKxwbvKNjk5uKd3VhpyEHYapBKmPgP5D
-yeP+OoMwHxm9ltCrNKehWJavGpI0NolcLqoaOVrltwwlLCC6cWxH0SWnM1NUigJ5
-3FfakgI2uD4wsfUB2DsIfP5rraCmC/K7PFSRxJ8z4LRDAG1WNxK7CA9oYFSqEIo7
-axMDZvRfFViqs1grXruTQzI2GAodvMt4Sqw9TXGi4tLrAU8a+GvXDcoIYHe2MmUP
-dxN/tq8nJUE+PEq6RtdIcuOv1yhkgXHAfzcf7gWIugREglGywfX0Ops9+Mp8UQnz
-kRbPI4m7zkzIozsq0Q7CSrKVAwT/CC+gpMFtOx+uZOPC02p4za6yL5GMgPBKHmr8
-qbMujryv30Ua48SeVRhgI+ScnUxXBau6VGWOPX4U7v6Y5jtJkea9lFHurNpByAaf
-4y12GFlePqbcVrGdcfCL15fDkhfi5ba1nlpi+dILJYegttis5iNMyueKb2jDzFjk
-vpY9PG0Npxa9YCq1IPawTEwU4/sFh00psM9jdXBNne33FNyYcpy+gF0+fCU6Y0o6
-qXB2V1iSaVLxW1te5UQV2rn0QAKwpbE+c7IL2oEizktBzNEDB94ls0hdzo8j1Umd
-wCk6x7UGU0iJCZtg/a6THmDEoa7ib7U4qeBB8XoJYW6VA113ROc+VFbdl1aDyA3o
-jCB5zQR0/RI+xrvc9Vn57bmlrOsTVkG0kf17a3MWVfYobpHCg2OBTLlaGEfvdcZ1
-EwMGTJhnakJIkbKJdO1b2ljp6NaJMxJdQLVHjyFB6JjDRosZPeW4qO5jRgShMaVL
-4ZZb3XORms679ItX19DanCEP2ouo8MP9Fbt3y6C/s0YqOOAOOa5o4Wb04098Upod
-7TH70faAtzgcx9nZ4aoPsXWgbvoEGWyJZvoRxF/6X887z+cLYtY+6K709TSsYc+F
-3TGt8gpt+kzfwuGv9QUQ/tDAdvR3LPQ4zKJ4COJ89ybuop4+GlrQC2v/FvE58LJ+
-q1yS/kim+/FsvmwAM+7vYj/wn6hXAWn2rleWTcFgmu4MwIyxfwjUcTXRrUptvnRS
-juY71sqQMe/44QB2KZNDvNX6efj2ay0Uvx6MXBN2Wfkn0lFrlspcgP1eDdQZDgDU
-HyemCXAYmylUYXVNgwENksKpaV5vbSZSuN0QHzzcpNR/ur3Jne9uPe2AqzXanep9
-ozQoz7YCOlXxqqWzI2dV0JqszoLQA0OarFlGAmR1eA2tfxnUayMjHl85LEk2PGI6
-IMyKIyB28tkue1ualu/deq+3CHBdJmWLUeC7DSSUH8NLzChcnJDZA+Vyiic4Ovdr
-N+hTeUQM6BHIGNtgX7LtH+2phdA4Mc9Vl2b7AtDghZmz5IcBA90G8PVkhSBY0I/j
-ssphtIroQwfC9Z8vQmmQkwAv/VgHIstp8UM51K1c24ckCFduu2Vo6SOaDUwV2efF
-x/F4RPHr/A2TzdAZj3cIe5S4Gkc9D/5p8PJ2w2MuP+fKWTE9Z3IM7BlbO6VlLbxq
-VZTIzjtivJKaD7B0hpyWcjqI6GU3o3FvMyOLCFTJvrXpWfCAErsHf1I8vtPI2T7I
-eBYl85LNOiqPTDkjqQHFe/BahPzNS8c1tdfdCmY1ILRdYCN2DM9RVZmbyypyt49z
-K3IHMi3G4RizGXQ+tdfmsqO/n7TInY9p3td2RcYcUT1AfQOkiMV9jBrBuylPcsvh
-q7AlmlIEPikhlXCxFIkt/zQPy6qyka2GS1n5yl0MyqE40e5pSZkkvBN1dt6+Kvxw
-EIUyxRPlFjoQXtDgtAA8vEgl5feNkD1QviM+72dvPOo4lszHLHxdI87hqYCysRCA
-XGaCa/qExxuG0Hl+6X7iI9adGlFz9iiQrVYjZoGOXC2z7Vkd8Dr4LY2xSyVHZDaQ
-W4h7PJ5OPGKhwUY9V8ZDgSdiwLa0Bgoc+fSf/mDZhzOjV34tDh8G4gU3GaZGjG4Z
-8J2Hj1H4At4McETx+Tg5aqJfFM71EG8no5PNBaKXQ5lInMR5dFh+OUVizGmLDQmi
-a2aK6SzvwEegijKQWMyHTvPEzJAg/mghM2s1EN4kg12VvO9LEMC7F65YWkpGktg3
-Zch0J4b5z+QMMDOC/gAkYfalRvraV6rDRzhbrLsQe870zqvdyArurHbmpBpvE1Sv
-sDgcYKWwZ4w8gcxaju4qk9NNkFkPaZP/Cz346HWUDWPr8SbZGZ3O7WNm0JvFy9oS
-HwOm32yc8RT2dfzRIj4faGMrGUsXG5dULoyrYfatxDM3ohMt8BvvqJ8i2EVHpZI2
-ZElpBo7qM08+9VpwBpBseBxjE3uAkqBAaBBwRfecJvQuFjgQowk8uOmhGvvPQ+v3
-lcTIErizNHDyKhbwMvzURNELa6TqThaeHQi3X9djiSvl+uUgu1nGnCZwK/ApYa0a
-Z0BvM7sap63DTdete3iWo/OKKTL+yU6QpmV69wUNmVn867E+naX7GeqgMS2PcwdI
-kFmWFzKf4m4BpodfJ8II0M3tE3nWYwGRKy72DjrP1TittRyhTIRMKh0N4jnYlh+g
-TeTodvcZL5xL2lwLvxBbULtz0wRVcloB1BPla2LiBlclpdKvKmgRk36gvq3E5N6/
-CJ+BQ94QjLa1EcEBjYtK557nyFW2s3Km8tD1+FAO+uj2X9BLq9Qyax/FMteiSwF5
-rPEfy9OhZH2v2jkYCfc9scFA69PkskfJQ6ZfnJT4mYMmn1UEN3L+Q2b66hdaeIbo
-SmH7Es9xofBN+2MYOYPTg5ptyYUAlLVdnJrgAnKIylPr3iedBLJ2mYK6aDoj3PWT
-7klVaCJfxNxb7siiwKJjTvs7Y/7eI1mN5dsPW0OWCWONzR+XGu4wwT+CcZURB086
-yD4DyFOpZb42RN8NBTwyiKOYVsd/7jUKXat0HQswRy7hDW3qs5aIkLJCaX1vd9an
-56b1Fwu9FMhIzEdLPPrJQMLA3xYDh4NiOwO0oy370Pdoy1aPa6lMA7QrQrZXfpsz
-eFpgRSEkzJFlDRTSYsdczx3Kdpe8L9Ha3KJ3m261mQIUucnIFQlES1tfv2au87x6
-48dZRT8EyAoTQiCH8e7sRpZUYllgM71peyQNWSnqoNERp9PL3eRTWzfa9xn9IglD
-CyuSAuRgivvSanVqNOX3xFQ1doAT4mfJ2HyA1IZOPXOxSGiueyAAOeUbQOsl7xHv
-7L7UdvHpVta2Rn1I8kuPrvAGiFkM5ROyMF6bBqkwu+cZ+oNdP8xwZ6ovxOBNeAwV
-Fx/ZEJZpnU2BAjkZrHA/OLJ7sgFo+Pqo0BpnDaZVO0xtVLYHUMBTqt4uGaHJ/qIJ
-3KPJDjHq1CRyLFwQ+HKT3QYu9IsvJ33PQGwFcqP8pyuhXX0z3QaLUs9tZ93jW4d3
-70XDQ0udMjazKHQnpLpqleVqvG6vDI5KcXRn8GzMyDHsSObak+pKNIm01TjYmDEj
-cDk7a+5d5DNA4ELExj0Py/C3D8JtcQzycnZv6EwGsyLsDTtQhSkGHcvfK6u0SfvD
-aWg=
-=2R32
+hQEMA2PKcvDMvlKLAQf/e9SoMqSYDulVbI5ZJ4Q360gUjroINVvYpGkmZXNvOi3A
+k2WU9lCsrlTHVmV3ivziaAXqvjBaipGK2h0FPTrfNXZiwwDjVAuM9EDB76HXvwQE
+ReGQ2mEkiX0LBOFkiJ3PaLCfnu44sq4rw1bC+zmDEh1unTmfXOr/dGO4w1xkFpTc
+1Tl9TPAXZslZuzKhSg1oA9pVkjZSWBMsfZRxvIUtXewbcSM6Y9WnsuX9yDbYPgsu
+D39OWNNgcdArykxfI5ogZ7bIT7I50qi1y892QrCO8hfCz02OjH9OUcaIvRtln6KZ
+gL53F2tCVzyeSC5lVSofpJxIW7kRQmGMpxWiPa8fldLrAalI4A7aduEPT2Y5ynEY
+Wqt4FLbEP1FxxLvTgjuoaBxM75vUx4h5WOXOLI7JFB7kAe6wJTqsF7bqNgLWJtMZ
+pbm93uGlayKHtuCN7cJKfuV3z8tX2FdBbdaz2/V/Ef/phZIyG6qCnJ5s4/zON95G
+gYGlYAObFFcj0Oup/prGITPPow6q1kgckAyTqf0H8cG3SEDTCiyRcyVQKlsc20jW
+O3dNT1DVjP8Os3xgbjNUSd+/qiIY6u+u37vmb2QeJ4hjOKFN0NM3chfh6qeMbk6W
+NE9+GmS32k3XNJrm3VFCnguZmNg4iEawPYZHTjC4439lrbWFVqkB6KP7keVen0Gr
+p78QkmLo/+2wDg0ovJcwTmvZUDXFNaIRuxdJEPbkDscNSa8ojljRyp1+D1o2nkTX
+hJPFEVcIi90UQllGLA8f11kdK0+pD19whhn3nKAhwvUzIqefcIUlTZhc94cqTEU1
+kkmTXoNJgVvY+t87O/5BENMArsuOdMSE4YfwOqPcq3dZ7P71JpoPvktetQcAD1mm
+N4zm63H4tvbAQX6IURea1EJcYcHEIUhAsxTgBRjjIHGL3KCfLCr3hAsxPOreQUKW
+R6kquvyribDLGO6cQQPAOkLmqWKtX1imdWa+CUgnOTak1WBujAYNCTfItEzPvEuI
+EiJSw8l1CPyvREqrnW4+xS6CR2JpinHLerHVyH8FlkedsS3+rc5tmFl0p16VLCQd
+G8c9iFC9nqvfPxUTH4W4dB2+sHW5614h24yPQc7c5qAe2sOsjLVyMvQj6FusgRW4
+25W1t9oBchZ9gK/7TWrweAXdkYTZ9d3sYn9Ctqra0ZvGuBM8Qyse4xjSeslngbdK
+85SASssKchK5poVYVpJXaSciOJL6U3Cg6TGfAUmZzCjlxQTVN8qzv5oDT2igBku0
+waDMCTqe1vvxFD3maZEyxX00TYH8cAdx+PF3bfg9zBxJHJHn6wObdc+lAppvgS9y
+sqtNDAryOieA7/mMRCjgqsYgBm3ZzBCSBb03PpIh/lct1Iik21UzilE7FzyJ9KBZ
+61HOUF6DDFE1h20JOSyP0JpHf44EhIZanBS+qmVS606cWWbiSXBPtp0Hu3z1ShSB
+Ze+3hdqd0WzY8EyZyn5+MrWqMrK9MrOSAqTmOrqe53Tq+/Z8HeAptQszDuozVyWu
+kkTkKxBSafboYfbjdoIeAEr769pCg56tkhpOsu2RujlGjf6UaAuQK+xGYzFelI1K
+s6j0Orzs65FyktwwZEqcBa/LKFuRR66UeTfoejVz+0OI2d9LZuSE993KCHCtWmxz
+oqRw+Blhw+Kxp72/pbLOMHIKkdJq8yCLZd6GSOxmKy49/3DGAwKD7JZynXlyJ9yQ
+4uAV13yG9zK3Dr3LQfG0BVs5vVmUWd0EcP/dLz2LNV7JCrvrTY26auRfca3QJxcb
+D/ED9LQS7bd95h8+vTQ3Iq6TlrCPbRkB97I68+nuSKXVMTEefbWknDjnbuuMD5cj
+/evfmtZ1ZRQ4/dMeoF/KK4TRjOlSNwSlqzbDiutBkOgUP3AvnY55jUC1/F4jVoSu
+veXkylnH9apLSq495w2gxtnwFaX2NoVEY7I8AMNxFbReOTj4eN2IMZLlXKr7FUgw
+VyBI2a3YtvLqFGJe/pKYXaH6r9iA6fQbNpok2L0A61mSv+NlXhaoj7yWzxA/E8In
+D5RpV7YuRSNtFC+kO5SNzs8B4ujTKbHa8pStJexTrB4fYdf595jcFdsOYbMjoK84
+BGUf1rxsMkkcvbGbTNUI6eg4nf18gJNQVZeOExR1PQMb+8uopHAmovCPEWgMHCmL
+jA/uTklD6qZGhVAQZfTYTcdE/JcR7NH5cdjtWSHD2Zx+4QBNZRz2Dl4OUUvPlf+D
+1RI1MXOEE+tm87NjcR23pYzlY3DYa9yl52kqICCciAOUMh6Tx5tTL4YfrFwvB5KQ
+5aYJNyrC3jnNLsDLmOujnzQib4gUFUOJBlbeqnJb47GcIhigFTH6aFv/AV8buk/t
+C4Y+2urVi6rR/xV+GYO5zBjp1lZrOC/aHWqGrerNqR/2rID+xg9QpST9/otb7Fim
+rJNE2R8O8HoZet0dlEpwgV/h3jYBmyd3YOylZmqQQrpz6MZI6/dfRW41eIkTpNQB
+tpm2dQQ6TxvqeTK4gEewL4FrKfv58Knq5cUKY9q8aOM9FWWDLyU+6to0v28OClU0
+PY9IlBv5QzCy7IGNmHdNfKi5RG5DkPJUDPbJrS0001NwsMSN7ZIxgdY55GxDzRCD
+/19YRt1XyvgjJGunVpX0LQhcurPFVg6ySSvSwrM6FZoMZSw2Q6unUEbWORlOeqxr
+g1qtLqIZj5cvXzs2yBvqosGaNXSUxIGPcRVRbInqiXpvLOynwj+BqgEHhUZQKfnv
+XCnIE7NHTlibfLV/hrN2qRKMeaQfJs40r9sb5x5vJsNEKqGVW9sd/gNCoqli7qN+
+GBfFLNKnjvZb82pnvpFzgZw9gNFBHgg6afKKGecn7gKXevPJDdKNJRH+QKvILxDy
+h7POvR61BkRlL2/30i+aWwtA0SRvKI4rc7XkDXaVHG7p21SQfZ0x7WmP+FTYKR5j
+dZR2WCowUsegm2NZXpA8/BpB0GR5tRY2nrtZxPVn79cOgbJljgbgNTlxvHiNp8BW
+1mFsUCXN/6iRDA+XnkbdivgtPxo/SjrddMfZaaiCIOGhvxPe1NMI4PiBzO+G+r5/
+c6urQag4s2OHrq/763YPplfBJEh06s/Ichf52QzUy20js4hZMy/MSSlfu4/Je1Ij
+RwLwxjIQy37923aBVa+OrdVyTApN9SD3KrTCdhEBBYm9tKXMyY9bmDSPScH+9rJT
+FmWw5NEV6J4hf7kowZccuBIjhdNR+v/JZjrzl1ITpZv7he7amfhxScNdlZul0S+X
+apdaTNSwM0zHmiH80OtKGpuhGY7laHbAleLDhqOo94rW5SC5EXgYIg9NCDehoqr6
+rtq0GihzbUYBY/bIAMnunzqcsAoJXTvkb7v/bI2ve472YkSS7BR/MzAIrtHPe82h
+y2/1lFmlbBUB5Zo89M+UjmtsmyTcscgxWZqPGn1YueYLKrCk+O62yaJamVX+h5Ij
+MpjwD9tKyFiJoA9F063oEZi/MXpA6IsjvoBhjbQcUc6+j/jzMrJI7ftw7DY7Pxpj
+y6a8uSKuepPt3YsMWUH4aXTXKeEqg1lbs1vUgFT2SoQQJ+5otwkjY48eF2LR63KO
+W2Kq+kNkP4UYksosAF3s7x7KwvL56ClydW+yfL46R4zE/r/JAwYaPaLJ5sVVUYnl
+GDjJ+TJQ8hfV9upOVOG7FH1gcAMrrFF1AEXRB0CfkjE8GIIVvqjxI2rMyY4BONTP
+bIdImjqRuOSoHB0R73LazvfeMWfZUDw=
+=B5Ak
 -----END PGP MESSAGE-----
diff --git a/nix/lib/config/options.nix b/nix/lib/config/options.nix
index c9ad2fa..56097be 100644
--- a/nix/lib/config/options.nix
+++ b/nix/lib/config/options.nix
@@ -452,7 +452,7 @@ let
                         type = nullOr str;
                         default = null;
                       };
-                      type = mkOption {
+                      mode = mkOption {
                         type = enum [ "ap" "sta" ];
                         default = "ap";
                       };
diff --git a/nix/pkgs/ap.nix b/nix/pkgs/ap.nix
index b5ff070..db65836 100644
--- a/nix/pkgs/ap.nix
+++ b/nix/pkgs/ap.nix
@@ -127,7 +127,7 @@ let
             else []
           ) (builtins.attrValues openwrtModel.ports)
           ++
-          lib.optionals (hostConfig.interfaces ? ${port}) [ "${port}.${toString vlan}" ]
+          lib.optionals (hostConfig.interfaces ? ${port} && vlan != null) [ "${port}.${toString vlan}" ]
         ) ports
       ) (
         builtins.attrValues (
@@ -193,12 +193,15 @@ in ''
 
   # mgmt network
   uci set network.mgmt=interface
-  uci set network.mgmt.ifname=${
+  uci set network.mgmt.ifname='${
     if builtins.length (networkInterfaces "mgmt") > 0
     then lib.concatStringsSep " " (networkInterfaces "mgmt")
     else throw "No interface for mgmt"
-  }
+  }'
   uci set network.mgmt.proto=static
+  ${lib.optionalString (hostConfig.interfaces.mgmt.type == "bridge") ''
+    uci set network.mgmt.type=bridge
+  ''}
   uci set network.mgmt.ipaddr=${config.site.net.mgmt.hosts4.${hostName}}
   uci set network.mgmt.netmask=${self.lib.netmasks.${toString config.site.net.mgmt.subnet4Len}}
   uci set network.mgmt.gateway=${config.site.net.mgmt.hosts4.mgmt-gw}
@@ -250,8 +253,7 @@ in ''
     in optionalString (iface.type == "vxlan") ''
       uci set network.${name}=interface
       uci set network.${name}.proto=vxlan
-      uci set network.${name}.tunlink='${name}'
-      uci set network.${name}.peeraddr='${iface.vxlan.peer}'
+      uci set network.${name}.peer6addr='${iface.vxlan.peer}'
       uci set network.${name}.port=4789
       uci set network.${name}.mtu=1600
       uci set network.${name}.rxcsum=0
@@ -287,7 +289,7 @@ in ''
           uci set wireless.@wifi-iface[-1].ifname=${ifPrefix}-${ssidConfig.net}
           uci set wireless.@wifi-iface[-1].device=radio${toString index}
           uci set wireless.@wifi-iface[-1].ssid='${ssid}'
-          uci set wireless.@wifi-iface[-1].mode=ap
+          uci set wireless.@wifi-iface[-1].mode=${ssidConfig.mode}
           uci set wireless.@wifi-iface[-1].network=${ssidConfig.net}
           uci set wireless.@wifi-iface[-1].mcast_rate=18000
           ${if (ssidConfig.psk != null)