162 lines
5.9 KiB
YAML
162 lines
5.9 KiB
YAML
# =============================================================
|
|
# Parental Controls Package
|
|
# Requires OPNsense firewall alias "parental_blocked" + rule
|
|
# See README.md for full setup instructions
|
|
# =============================================================
|
|
|
|
input_text:
|
|
parental_control_config:
|
|
name: Parental Controls Configuration
|
|
max: 10000
|
|
initial: '{"users":[]}'
|
|
icon: mdi:shield-account
|
|
|
|
# ------------------------------------------------------------------
|
|
# OPNsense API calls
|
|
# Secrets required in secrets.yaml — see secrets_example.yaml
|
|
# ------------------------------------------------------------------
|
|
rest_command:
|
|
|
|
parental_block_ip:
|
|
url: !secret opnsense_alias_add_url
|
|
method: post
|
|
headers:
|
|
Authorization: !secret opnsense_basic_auth
|
|
payload: "address={{ address }}"
|
|
content_type: "application/x-www-form-urlencoded"
|
|
verify_ssl: false
|
|
|
|
parental_unblock_ip:
|
|
url: !secret opnsense_alias_del_url
|
|
method: post
|
|
headers:
|
|
Authorization: !secret opnsense_basic_auth
|
|
payload: "address={{ address }}"
|
|
content_type: "application/x-www-form-urlencoded"
|
|
verify_ssl: false
|
|
|
|
parental_apply_firewall:
|
|
url: !secret opnsense_apply_url
|
|
method: post
|
|
headers:
|
|
Authorization: !secret opnsense_basic_auth
|
|
payload: "{}"
|
|
content_type: "application/json"
|
|
verify_ssl: false
|
|
|
|
# ------------------------------------------------------------------
|
|
# Scripts — called from the dashboard via HA WebSocket
|
|
# ------------------------------------------------------------------
|
|
script:
|
|
|
|
parental_block_ip:
|
|
alias: "Parental Controls — Block IP"
|
|
description: "Adds an IP to the OPNsense parental_blocked alias"
|
|
icon: mdi:block-helper
|
|
fields:
|
|
ip:
|
|
description: "IP address to block"
|
|
required: true
|
|
selector:
|
|
text:
|
|
sequence:
|
|
- service: rest_command.parental_block_ip
|
|
data:
|
|
address: "{{ ip }}"
|
|
|
|
parental_unblock_ip:
|
|
alias: "Parental Controls — Unblock IP"
|
|
description: "Removes an IP from the OPNsense parental_blocked alias"
|
|
icon: mdi:check-circle-outline
|
|
fields:
|
|
ip:
|
|
description: "IP address to unblock"
|
|
required: true
|
|
selector:
|
|
text:
|
|
sequence:
|
|
- service: rest_command.parental_unblock_ip
|
|
data:
|
|
address: "{{ ip }}"
|
|
|
|
parental_apply_firewall:
|
|
alias: "Parental Controls — Apply Firewall"
|
|
description: "Tells OPNsense to commit alias changes to the live firewall"
|
|
icon: mdi:shield-refresh
|
|
sequence:
|
|
- service: rest_command.parental_apply_firewall
|
|
|
|
# ------------------------------------------------------------------
|
|
# Optional: schedule enforcer automation
|
|
# This runs every 5 minutes and enforces block schedules even when
|
|
# the dashboard page isn't open. Enable by uncommenting below.
|
|
# ------------------------------------------------------------------
|
|
|
|
# automation:
|
|
# - id: parental_controls_schedule_enforcer
|
|
# alias: "Parental Controls — Schedule Enforcer"
|
|
# description: "Enforces scheduled blocks from the parental controls config"
|
|
# trigger:
|
|
# - platform: time_pattern
|
|
# minutes: "/5"
|
|
# condition:
|
|
# - condition: template
|
|
# value_template: >
|
|
# {{ states('input_text.parental_control_config') not in ['unknown', 'unavailable', ''] }}
|
|
# action:
|
|
# - variables:
|
|
# config: "{{ states('input_text.parental_control_config') | from_json }}"
|
|
# is_weekend: "{{ now().weekday() >= 5 }}"
|
|
# current_time: "{{ now().strftime('%H:%M') }}"
|
|
# - repeat:
|
|
# for_each: "{{ config.users }}"
|
|
# sequence:
|
|
# - variables:
|
|
# user: "{{ repeat.item }}"
|
|
# sched: "{{ repeat.item.schedule }}"
|
|
# - condition: template
|
|
# value_template: "{{ sched.enabled | default(false) }}"
|
|
# - variables:
|
|
# slot: "{{ sched.weekend if is_weekend else sched.weekday }}"
|
|
# bt: "{{ slot.block_time }}"
|
|
# ut: "{{ slot.unblock_time }}"
|
|
# should_block: >
|
|
# {% if bt == ut %}
|
|
# false
|
|
# {% elif bt < ut %}
|
|
# {{ current_time >= bt and current_time < ut }}
|
|
# {% else %}
|
|
# {{ current_time >= bt or current_time < ut }}
|
|
# {% endif %}
|
|
# - repeat:
|
|
# for_each: "{{ user.devices }}"
|
|
# sequence:
|
|
# - variables:
|
|
# device: "{{ repeat.item }}"
|
|
# dev_mac: "{{ device.mac | lower }}"
|
|
# dev_ip: >
|
|
# {% set trackers = states.device_tracker
|
|
# | selectattr('attributes.mac', 'defined') | list %}
|
|
# {% for t in trackers %}
|
|
# {% set t_mac = (t.attributes.mac | default('')) | lower %}
|
|
# {% if t_mac == dev_mac and t.attributes.ip is defined %}
|
|
# {{ t.attributes.ip }}{% break %}
|
|
# {% endif %}
|
|
# {% endfor %}
|
|
# - choose:
|
|
# - conditions:
|
|
# - condition: template
|
|
# value_template: "{{ should_block and dev_ip | length > 0 }}"
|
|
# sequence:
|
|
# - service: script.parental_block_ip
|
|
# data:
|
|
# ip: "{{ dev_ip }}"
|
|
# - conditions:
|
|
# - condition: template
|
|
# value_template: "{{ not should_block and dev_ip | length > 0 }}"
|
|
# sequence:
|
|
# - service: script.parental_unblock_ip
|
|
# data:
|
|
# ip: "{{ dev_ip }}"
|
|
# - service: script.parental_apply_firewall
|