adam/steward

0 Fork 0

Files

T

abrown38andClaude Opus 5.5 3ad2f981d4 Allow and deny lists per subnet; every option of a DHCP message in words

- A subnet is a deny-list subnet (the default: everyone not denied) or
  an allow-list subnet (only clients allowed or with a reservation);
  the deny list counts in both. Entries are MAC addresses, prefixes
  (aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
  in the activity log, with an Allow button) or a NAK on renewal.
  steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
  decoded into words (dhcp4.Describe): the parameter request list by
  name, client IDs, lease times. ▸ on an Activity row, steward
  activity show N / --details, GET /events/{id}.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-18 20:27:51 +01:00

4.8 KiB

Raw Blame History

Validation

Every change is checked as a whole configuration before it is saved. An error stops the change; a warning is reported with it, and stays on the dashboard and in steward status until fixed. Each problem has a stable code, shown by the CLI as [code] and in the API as problems[].code. stewardd check runs the checks on the saved configuration.

The warnings marked host compare the configuration with this machine's interfaces. They come from stewardd, not from a configuration on its own.

Settings

Code		When
`lease_time_range`	error	a lease time (settings or subnet) under 1 minute or over 365 days
`ping_timeout_range`	error	the ping timeout isn't 50 to 5000 ms
`decline_hold_range`	error	the decline hold isn't 1 minute to 30 days
`address_order`	error	an address order (settings, subnet or pool) that isn't `sequential`, `reverse` or `random`

Options

These apply to options anywhere (settings, subnets, reservations).

Code		When
`option_code`	error	a number outside 1 to 254
`option_reserved`	error	an option Steward sets itself, such as the lease time or the subnet mask (options.md)
`option_duplicate`	error	the same option twice in one place
`option_invalid`	error	a value that doesn't fit the option's type (`dns.example` for `domain-name-servers`)

Subnets

Code		When
`subnet_prefix`	error	not an IPv4 network, or host bits set (`10.0.10.5/24`; the message gives the network)
`subnet_size`	error	shorter than /8 or longer than /30
`subnet_overlap`	error	it overlaps another subnet
`subnet_name`	error	the name has spaces, slashes or commas
`subnet_name_taken`	error	another subnet has the name (names are compared without case)
`subnet_interface_missing`	error	no interface given
`subnet_interface_name`	error	not an interface name (over 15 characters, or spaces, `/` or `:`)
`subnet_no_pools`	warning	no pools: only clients with a reservation get addresses
`pool_invalid`	error	a pool that ends before it starts
`pool_outside_subnet`	error	a pool not inside the subnet
`pool_network_address`	error	a pool with the network or broadcast address
`pool_overlap`	error	two pools overlap
`pool_order`	error	a pool order that isn't `listed` or `random`
`router_outside_subnet`	warning	a `routers` address outside the subnet: clients can't reach it
`router_in_pool`	warning	a `routers` address inside a pool. The ping check keeps it from being handed out while it answers, but take it out of the pool
`interface_unknown`	warning, host	the interface doesn't exist on this machine. It is served once it appears
`interface_no_address`	warning, host	the interface has no address in the subnet. Clients renew with that address, so give it one
`pool_includes_server`	warning, host	a pool has the server's own address. It is never handed out, but take it out of the pool

Reservations

Code		When
`reservation_no_client`	error	neither a MAC address nor a client identifier
`reservation_ip`	error	not an IPv4 address
`reservation_no_subnet`	error	the address is in no subnet; add the subnet first
`reservation_network_address`	error	the network or broadcast address of its subnet
`reservation_ip_taken`	error	the address is reserved already
`reservation_client_taken`	error	the client has a reservation in this subnet already (one per subnet; a device on two VLANs may have one in each)
`reservation_denied`	warning	a reservation's client is on its subnet's deny list, so it gets no address
`access_mode`	error	a subnet's access is not `deny-list` or `allow-list`
`access_entry`	error	an allow or deny list entry that isn't a MAC address, a prefix (`aa:bb:cc:*`) or `id HEX`
`access_entry_duplicate`	error	an entry is on the same list twice
`allow_list_empty`	warning	an allow-list subnet with no allow list entries and no reservations: nobody gets an address
`reservation_hostname`	error	not a host name (letters, digits and `-`, labels up to 63 characters)
`reservation_server_address`	warning, host	the server's own address

Certificate

Not configuration problems, but shown with them on the dashboard and in steward status, to administrators (certificates.md):

Code		When
`certificate_failed`	warning	the last attempt to get the web UI's certificate failed (the message says where)
`certificate_expiring`	warning	the certificate ends in less than 14 days and hasn't been renewed
`certificate_staging`	warning	the certificate is from Let's Encrypt's staging service, which browsers don't trust

4.8 KiB Raw Blame History