- Weekly schedule editor per device: a Monday-Sunday grid of blocking
windows, including windows that cross midnight.
- Blocklist/allowlist editor per device: app (Android package / Windows
process) and site (hostname) entries, tagged by the device platform.
- Effective desired state: a manual lock, an active schedule window, or
neither. While blocked the allowlist is honoured (Spotify stays while
other apps are blocked). Published retained with reason schedule/manual.
- Boundary-aware republish loop so a window turns on and off on time,
and manual lock expiry is cleared promptly.
- CONTROL_TIMEZONE (default Australia/Sydney) with embedded tzdata, so
wall-clock windows are evaluated in the family zone, not the container.
- Every change is written to the append-only audit log (FR-15).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- internal/mqtt: publish each device's desired state retained on
restrict/<device>/config; subscribe to restrict/+/status and
restrict/+/telemetry and write reports to SQLite; publish on every state
change, republish on connect and every 15 minutes from SQLite, so the broker
is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
telemetry upsert per (device, day, app, domain) via migration 002, allow and
block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
verifier that proves the policy on a throwaway broker. Not applied to the
shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
golang.org/x/crypto bump to v0.42.0.
Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Device registry: add/edit name, child and platform, persisted in devices.
- Stable per-device topic derived from name + id, unchanged by renames.
- Desired state persisted in state; timed locks expire and are audited.
- Dashboard cards: name, child, platform, status dot, state and time left.
- Manual lock/unlock forms with CSRF; every change appends to audit (FR-15).
- Append-only activity list on the dashboard. No hard deletes (rule 10).
- Store and handler tests; version bumped to 0.2.0-phase2.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs
as container webrestrict-control on port 8791.
- SQLite schema for the full AGENTS.md §7 data model via versioned migrations
(PRAGMA user_version); audit log is append-only.
- Configuration from the process environment; the real env file is gitignored
and a template is committed. No secrets in the repo.
- Separate session login (signed HMAC cookie + CSRF) for Sam.
- GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab
tokens.css (copied) and Inter fonts; dark mode; phone-friendly.
- Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's
Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy.
- Unit tests for config, auth and store.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
