The most obvious discovery is the web interface, which helpfully explains where to get the password (SN on the bottom of the box), but doesn't offer much configuration.
A web search revealed ssh access uses the username 'meraki', and the SN as password. They use the duplicate entries in /etc/password trick to give this user root access.
The root filesystem is a ramdisk, so anything persistant should be put in /storage.
The system uses busybox, /etc/inittab calls /etc/init.d/rcS on startup, which runs all the scripts in /etc/init.d. The S80meraki script will run all scripts in /storage/late-startup, where custom startup scripts should be placed.
/usr/bin/brain.rb is a glorified shell script that sets up the system. The config files are found in /storage, and you can find some undocumented config options there.
ath0, ath1, and ath2 are the wireless interfaces, they seem to be hard-coded
to Master, Managed, and Monitor modes. In addition to iwconfig, I see there
is also wlanconfig. I needed to run
wlanconfig ath0 destroy to
bring down the primary interface and prevent it advertising a network.
The dhcp server config is buried in /etc/sr2.linuxmodule.template. I edit that in early-startup (all scripts in /storage/early-startup) to hand out my dns server and search order.