How to set up Alpine as a wireless router

=== Pi Zero W Wireless Router ===
This page describes building a Wireless Access Point with two wired ethernet ports for building a home router that connects to the internet with one wired port, and an internal LAN with the second wired port and the on-board WiFi.
The intent is to provide this:
 |<-->eth1 <-->| 
Internet <--> eth0 <-->FireWall<-->br0 Internal<--> ssh,bind,dhcp, with ssh reverse ssh connections.
 |<-->wlan0<-->|
=== Overview ===
I generally run Debian and when forced by Red Hot Irons, Red Hat. This is my first foray into Alpine. So far I am very impressed. I mirrored the 3.12 armhf repos so I had things local when I needed them. Word to the wise, it comprises 13 GB of apk files.
One *really* nice feature of Alpine is apk, the yum/apt replacement:
* It is simple and to the point.
* The same tool provides *repo* level dependency reporting!
* Install of single packages without repo signing (I never did get the signing correct, but I can install).
=== Prepare ===
* Obtain a microSD card (or HDD) you can wipe the data from. We will assume it is /dev/sdc.
* Make a 256M FAT16 partition (sudo mkfs.vfat -n ALPBOOT /dev/sdc1)
* The rest of the device can be ext2 (ext3/4 on HDD) (sudo mke2fs -m1 -L alext3 /dev/sdc2).
* Untar the alpine-rpi-3.12.3-armhf.tar.gz and copy all of the files to the fat16 partition which can be as large as 2G. 
* Make sure you have all the packages from the package list below installed on the SD card. This will save you lots of time.
* Add this to usercfg.txt at the root of the FAT16 partition:
 enable_uart=1
 gpu_mem=16
 dtparam=audio=off
* This is the contents of cmdline.txt:
 modules=loop,squashfs,sd-mod,usb-storage console=tty1 console=ttyAMA0,115200
=== First Boot ===
* Put the SD into the pi zero
* Connect the serial port
* Run minicom with the parameters set to 115200,n,8,1, no flow control.
* Power up the Pi.
=== Copy Root ===
* mkdir /stage
* mount /dev/sda2 /stage
* for d in $(ls -1 /|grep -v 'media\|stage\|dev\|proc\|sys'); do cp -a /$d /stage; done
* modules are loop mounted to /.modloop, and lib/modules is symlinked to that, so
* rm /stage/lib/modules
* cp -a /.modloop /stage/lib/modules
* Fix cmdline.txt
 mount -o remount,rw /media/mmcblk0p1
 echo 'root=/dev/mmcblk0p2' >> /media/mmcblk0p1/cmdline.txt
* reboot
=== Install ===
* verify you are now operating from the ext2 filesystem where you copied the rootfs.
* install openssh, openssh-server, openssh-client, openssh-server-common,
* install dnsmasq, ethtool, hostapd*, busybox extras, iptables*, iw,net-tools, tree, wireless-tools.
* edit all the configurations supplied here.
===== ssh config =====
The allowed users are not normal names since I want the names to be a little obfuscated. Not that it really matters, since this is a key driven setup
AddressFamily inet
ListenAddress 0.0.0.0
HostKey /etc/ssh/ssh_host_rsa_key
LogLevel INFO
LoginGraceTime 30
PermitRootLogin no
StrictModes yes
AllowUsers Som123X Extern4524User
PubkeyAuthentication yes
AuthorizedKeysFile	/etc/ssh/authorized_keys
HostbasedAuthentication yes
IgnoreUserKnownHosts yes
IgnoreRhosts yes
PasswordAuthentication no
ChallengeResponseAuthentication no
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding no
===== dnsmasq.conf =====
/etc/dnsmasq.conf
This has two subnets. One for normal dhcp, the other for pseudo static - dhcp provided by MAC. One example here.
interface=br0
except-interface=eth0
dhcp-range=subnet0,192.168.0.10,192.168.0.100,255.255.255.0,24h
dhcp-range=subnet1,192.168.0.4,192.168.0.6,255.255.255.0,24h
bind-interfaces
#log-queries
#log-dhcp
dhcp-host=70:85:66:c4:48:55,192.168.0.4,nas
===== /etc/hosts =====
dnsmasq provides DNS answers from the hosts file. Nice. 
127.0.0.1	localhost localhost.localdomain
::1		localhost localhost.localdomain
192.168.0.3 wireless
192.168.0.4 nas
192.168.0.5 mpd
===== hostapd.conf =====
/etc/hostapd/hostapd.conf
interface=wlan0
bridge=br0
hw_mode=g
channel=7
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
ssid=Whatever
wpa_passphrase=YouMakeItUp
===== interfaces =====
/etc/network/interfaces
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
 hostname ANYNAME
 hwaddress ether FE:ED:BE:EF:33:DD
iface eth1 inet manual
iface wlan0 inet manual
auto br0
iface br0 inet static
 pre-up ifconfig eth1 up
 bridge-ports eth1 wlan0
 bridge-stp off
 address 192.168.0.3
 broadcaset 192.168.1.255
 netmask 255.255.255.0
===== Permissive iptables =====
Do NOT use this connected to the internet! There is NO protection.
This is my stopopen in my replacement iptables
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD ACCEPT
iptables -F FORWARD
iptables -F -t nat
iptables -F
=== References ===
apk notes:
* Create, index and check dependencies on a list of apk files: apk index -o APKINDEX.unsigned.tar.gz *.apk
* Install a package: apk add iw OR apk add /path/to/iw-5.4-r0.apk
* remove a package: apk del iw
* repository lists are in: /etc/apk/repositories
 * Local URL: /media/mmcblk0p1/apks
 * Remote URL: http://dl-cdn.alpinelinux.org/alpine/v3.12/main
FAT16/32 limits
udhcpc
ez-ipupdate
Dynamic_DNS
Alpine Linux Bridge
Connect to wireless AP
dnsmasq listen restrictions
Disable IPV6
dnsmasq Docs
HostApd Docs
[rsync://rsync.alpinelinux.org/alpine Alpine Repos]
Set Static DNS names
Reverse SSH tunnel
===== Pi Related =====
NanoPi NEO build script
===== Pi Specific =====
Pi Wifi Repeater
WiFi Bridge
Alpine Install
Classic Sys Install on Pi
==== Not Related, but Interesting ====
AP and Managed Mode
AP and MQTT
==== Package List ====
Put these in the apks/armhf directory on the 256M Fat partition:
iptables-1.8.4-r2.apk openssh-8.3_p1-r1.apk
iptables-openrc-1.8.4-r2.apk openssh-client-8.3_p1-r1.apk
abuild-3.6.0-r1.apk iw-5.4-r0.apk openssh-keygen-8.3_p1-r1.apk
alpine-base-3.12.3-r0.apk kbd-bkeymaps-2.2.0-r2.apk openssh-server-8.3_p1-r1.apk
alpine-baselayout-3.2.0-r7.apk libacl-2.2.53-r0.apk openssh-server-common-8.3_p1-r1.apk
alpine-conf-3.9.0-r1.apk libattr-2.4.48-r0.apk openssh-sftp-server-8.3_p1-r1.apk
alpine-keys-2.2-r0.apk libblkid-2.35.2-r0.apk openssl-1.1.1i-r0.apk
alpine-mirrors-3.5.10-r0.apk libc-utils-0.7.2-r3.apk patch-2.7.6-r6.apk
apk-tools-2.10.5-r1.apk libcap-2.27-r0.apk pcsc-lite-libs-1.8.26-r0.apk
attr-2.4.48-r0.apk libcom_err-1.45.6-r0.apk pkgconf-1.7.2-r0.apk
bash-5.0.17-r0.apk libcrypto1.1-1.1.1i-r0.apk ppp-atm-2.4.8-r2.apk
bash-completion-2.10-r0.apk libcurl-7.69.1-r3.apk ppp-chat-2.4.8-r2.apk
bonding-2.6-r4.apk libedit-20191231.3.1-r0.apk ppp-daemon-2.4.8-r2.apk
bridge-1.5-r4.apk libev-4.33-r0.apk ppp-l2tp-2.4.8-r2.apk
bridge-utils-1.6-r0.apk libgcc-9.3.0-r2.apk ppp-minconn-2.4.8-r2.apk
busybox-1.31.1-r19.apk libmnl-1.0.4-r0.apk ppp-passprompt-2.4.8-r2.apk
busybox-extras-1.31.1-r19.apk libnftnl-1.1.6-r0.apk ppp-passwordfd-2.4.8-r2.apk
busybox-initscripts-3.2-r2.apk libnftnl-libs-1.1.6-r0.apk ppp-pppoe-2.4.8-r2.apk
busybox-suid-1.31.1-r19.apk libnl3-3.5.0-r0.apk ppp-radius-2.4.8-r2.apk
c-ares-1.16.1-r0.apk libpcap-1.9.1-r2.apk ppp-winbind-2.4.8-r2.apk
ca-certificates-20191127-r4.apk libssl1.1-1.1.1i-r0.apk readline-8.0.4-r0.apk
ca-certificates-bundle-20191127-r4.apk libstdc++-9.3.0-r2.apk scanelf-1.2.6-r0.apk
chrony-3.5.1-r0.apk libtls-standalone-2.9.1-r1.apk signature.tar.gz
chrony-openrc-3.5.1-r0.apk libusb-1.0.23-r0.apk ssl_client-1.31.1-r19.apk
curl-7.69.1-r3.apk libuuid-2.35.2-r0.apk tar-1.32-r1.apk
dbus-libs-1.12.18-r0.apk lzip-1.21-r0.apk tcpdump-4.9.3-r2.apk
dnsmasq-2.81-r0.apk mii-tool-1.60_git20140218-r2.apk tree-1.8.0-r0.apk
e2fsprogs-1.45.6-r0.apk musl-1.1.24-r10.apk tzdata-2020c-r1.apk
e2fsprogs-libs-1.45.6-r0.apk musl-utils-1.1.24-r10.apk usb-modeswitch-2.6.0-r1.apk
ethtool-5.6-r0.apk ncurses-libs-6.2_p20200523-r0.apk vlan-2.2-r0.apk
ez-ipupdate-3.0.10-r9.apk ncurses-terminfo-base-6.2_p20200523-r0.apk wireless-tools-30_pre9-r1.apk
fakeroot-1.24-r0.apk net-tools-1.60_git20140218-r2.apk wpa_supplicant-2.9-r5.apk
haveged-1.9.8-r1.apk network-extras-1.2-r0.apk wpa_supplicant-openrc-2.9-r5.apk
haveged-openrc-1.9.8-r1.apk nghttp2-1.41.0-r0.apk zlib-1.2.11-r3.apk
hostapd-2.9-r2.apk nghttp2-libs-1.41.0-r0.apk
hostapd-openrc-2.9-r2.apk openrc-0.42.1-r11.apk