Configuration management to stay compatible with the upgrade process

I am planning to make some customizations to my Omnia router: is there any advice/wiki/readme about what must not be changed/done, because it definitely breaks the upgrade? I understand that I should not be renaming the guest interface/zone. Anything else?

Perhaps depends on how much want to remain aligned with Foris or LuCI or whether you are more into manually manipulating config files. I have done plenty, that including renaming the preset guest iface/fw-zone (which is not relevant for pkgupdate anyway), but not all of it reflects in Foris/LuCI or is configurable via Foris/LuCI.

Unless you break upstream connectivity (that incl. DNS resolving) in general there should be hardly any setting breaking pkgupdate which is patched on top of opkg - for its transport it relies on curl and that in turn for TLS connectivity on libopenssl.

Thx, I am not building a multi use server out of it. I just need a secure router with an easy upgrade process. That being said, I have changed wan/guest forward action from REJECT to DROP, created wired VLAN’s and additional WiFi AP’s and added them to the existing guest interface/zone, fixed guest zone isolation, added sqm, adblock, and bcp38. I still need to allow access to the modem, though.
The goal is to set it up once as a dedicated router (maybe enable NAS later) and then just keep updating it. I would rather not spend time troubleshooting upgrade issues.

The openwrt config-backup process ime includes files which were not modified by the user.
So having a own “repository” is helpful.
One way would be a setup-script that will implement/install your customizations starting from a stock-config. (eg. https://gist.github.com/stephanschuler/74a6dcdb80c72490ea4cc7f9de65e372)

Keeping it simple is a good start as eventually an upgrade will break stuff and then you’d want to have as little moving parts (customizations you dont know by heart) as possible.

At least sqm and adblock are untouched. I use those and the upgrade leaves them alone.