Sam Rolfe
1275b1baaa
Adds windows/, the Python client for the kids' Windows computers, and proves both halves of the Phase 4 definition of done on the real box (DESKTOP-TE2RHV2). The client: - subscribes, retained, to its own config on the 8883 TLS device plane with its own broker account (FR-3, FR-6); - keeps the last valid config on disk and loads it before connecting, so a broker outage changes nothing (FR-14); - terminates every process on the blocklist while the device is effectively locked, with the allowlist winning and the client's own tree plus critical system processes protected (FR-4, FR-16); - publishes presence and daily per-app usage; the day's totals are held on disk and republished when the link returns (FR-7); - shows an always-on-top warning window naming what is blocked, why and until when (FR-9). install-scheduled-task.ps1 registers the logon Scheduled Task for the kid's account with an interactive token, and grants that account Modify on the state directory: a file created from an elevated shell inherits Administrators only, and the limited task is otherwise refused with Access denied. Evidence (windows/EVIDENCE.md, from the machine's own log): notepad.exe killed inside a scheduled window (pid 16600, then 9724), the device online in the Control Service with locked/until/reason, a telemetry row for the device (app=690s), enforcement continuing with the broker unreachable (192.168.20.13:8884), the warning window on the interactive desktop, and the Scheduled Task registered at logon as New Comp. Domains are deliberately not reported: Windows has no cheap per-process DNS attribution, so the client sends "domains": [] and the gap is documented rather than guessed. 54 unit tests, run with `make windows-test` (no broker, no Windows, no psutil). AGENTS.md §11 is now 10 of 10.
98 lines
3.4 KiB
Makefile
98 lines
3.4 KiB
Makefile
IMAGE ?= webrestrict/control:0.7.0-phase9
|
|
BUILD_VERSION ?= 0.7.0-phase9
|
|
|
|
# Bounded docker helper for the Go toolchain. The container runs as the current
|
|
# user, so the repository and the module cache stay owned by you.
|
|
GO_IMAGE ?= golang:1.25-alpine
|
|
GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
|
|
-e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
|
|
-v "$$PWD":/src -w /src $(GO_IMAGE)
|
|
|
|
# Scratch broker used by `make mqtt-verify` (see deploy/mosquitto/README.md).
|
|
MQTT_VERIFY_PORT ?= 18883
|
|
MQTT_IMAGE ?= eclipse-mosquitto:latest
|
|
|
|
.PHONY: help test vet build up down restart logs ps hash-password deps fmt \
|
|
mqtt-tls mqtt-verify mqtt-config verify-phase8 verify-phase9 windows-test
|
|
|
|
help:
|
|
@echo "make test run go test ./... in golang:1.25-alpine"
|
|
@echo "make vet run go vet ./... in golang:1.25-alpine"
|
|
@echo "make build build the container image ($(IMAGE))"
|
|
@echo "make up docker compose up -d --build"
|
|
@echo "make down docker compose down"
|
|
@echo "make logs follow container logs"
|
|
@echo "make ps docker compose ps"
|
|
@echo "make hash-password generate a bcrypt hash (PASSWORD=...)"
|
|
@echo "make deps go mod tidy + download (writes go.mod/go.sum)"
|
|
@echo "make mqtt-tls generate the lab CA and broker certificate"
|
|
@echo "make mqtt-config build the scratch broker config in deploy/mosquitto/build/"
|
|
@echo "make mqtt-verify prove TLS + credentials + topic ACLs on a scratch broker"
|
|
@echo "make windows-test run the kids' Windows client unit tests (python -m unittest)"
|
|
@echo "make verify-phase8 prove an API lock reaches a device in under a second"
|
|
@echo "make verify-phase9 prove the Hub answers and the Apprise alerts deliver"
|
|
|
|
test:
|
|
$(GO_RUN) go test ./...
|
|
|
|
vet:
|
|
$(GO_RUN) go vet ./...
|
|
|
|
deps:
|
|
$(GO_RUN) sh -c 'go mod tidy'
|
|
|
|
fmt:
|
|
$(GO_RUN) sh -c 'go fmt ./...'
|
|
|
|
build:
|
|
docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
|
|
|
|
up:
|
|
docker compose up -d --build
|
|
|
|
down:
|
|
docker compose down
|
|
|
|
restart:
|
|
docker compose restart control
|
|
|
|
logs:
|
|
docker compose logs -f control
|
|
|
|
ps:
|
|
docker compose ps
|
|
|
|
hash-password:
|
|
@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
|
|
docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'
|
|
|
|
# --- MQTT ---------------------------------------------------------------
|
|
# These targets never touch the shared Mosquitto. They build the material and
|
|
# prove it on a scratch broker on $(MQTT_VERIFY_PORT). See deploy/mosquitto/README.md.
|
|
|
|
mqtt-tls:
|
|
deploy/mosquitto/generate-tls.sh
|
|
|
|
mqtt-config: mqtt-tls
|
|
deploy/mosquitto/build-config.sh
|
|
|
|
mqtt-verify: mqtt-config
|
|
MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
|
|
deploy/mosquitto/verify-isolation.sh
|
|
|
|
# --- Windows client (Phase 4) ------------------------------------------
|
|
# Pure logic only: no broker, no Windows, and no psutil needed.
|
|
windows-test:
|
|
cd windows && python3 -m unittest discover -s tests -t .
|
|
|
|
# Phase 8 definition of done: lock through the admin API, measured until a real
|
|
# broker subscriber receives the retained config. Never touches the 1883 plane.
|
|
verify-phase8:
|
|
deploy/verify-phase8.sh
|
|
|
|
# Phase 9 definition of done: /capabilities, /ask, the alert engine and /notify
|
|
# against the deployed service, with Apprise delivery checked in the alerts
|
|
# table. Never touches the 1883 plane.
|
|
verify-phase9:
|
|
deploy/verify-phase9.sh
|