Filter levels

What a young child, a standard child, a teen and a visitor may reach. A level applies to everyone on it: change the Young level and every young child's devices change with it, within a few seconds, through their AdGuard client. The level in the database wins: a client tuned by hand in the AdGuard UI is put back to its level on the next change.

The household blocklists (adult sites, malware, trackers) are global and are not part of a level. AdGuard applies a filter list to every device or to none, so a level cannot add or drop one.

Moving somebody rebuilds their AdGuard client from the new level straight away. Their minutes change from tomorrow. Everything else about them is on the Family page.

What a cut-off child can still reach

Three lists, three promises. All three survive a total cut: internet off, dinner, bedtime, out of time. The firewall allows them by address, and addresses are shared, so whatever else lives on the same servers is reachable by address too; the name layer (AdGuard) only answers for the names below. A promise about a name needs a rule that reads the name, and that is what the search list is.

The youth help lines and schoolwork. Nothing removes these: not this page, not the command line, not the database's own superuser. A trigger refuses it. To add a help line, edit config/db/seed.sql; that is a decision for the repo, not a box.

Reference sites a child out of time can still read, so learn-to-earn is not a memory test. Reference and reading, not discussion, not video, nothing with a feed (docs/READING-LIST.md has the five tests). example.org covers www.example.org. Rows shipped with Genkan cannot be removed here, because a schema reload would only put them back; rows you add can.

Each of these is one exact host and nothing under it. google.com is allowed so a child can search; mail.google.com, Meet, Chat and Messages are not, and accounts.google.com is deliberately absent because that is where a sign-in starts.

Household switches

The things that are off until a parent turns them on, and the numbers the whole house shares. A default is never flipped by an update. Anything that lives in a file rather than the database is shown here as it is, with where it lives.

Storage

How big the database is, what is in it, and how long each kind of record is kept. Everything Genkan records lives in one Postgres database on this box and never leaves the house. It does not have to stay forever either: a complete record of a child's adolescence sitting in a cupboard is not what anybody agreed to.

One rule per table. The nightly prune deletes whatever is older than the rule and nothing else. Pick a preset or type any number of days from 1 to 3650. A change is audited in the block log like every other save on this page.

Tables without a retention row are reference data or settings (the category and vendor lists, the quiz banks, the Tor relay list, who lives here) and are never pruned.

The preview asks the pruner what it would delete and changes nothing. Delete runs the same nightly prune now, after showing you the numbers.

A one-off for the table that grows fastest. It does not change the rule above: keep 30 days as the rule and clear back to 7 today, if that is what you want.

What a prune cannot undo. A deleted row is gone. Genkan keeps no copy and makes no backup of its own; docs/OPERATIONS.md has the one-line pg_dump that does, and the backup is yours to keep in the house. After a delete, Postgres keeps the freed space for new rows, so the sizes here shrink straight away only when the rows at the end of a table have gone; the rest is reused rather than returned. This is the demo: the figures are the demo's own database, and the buttons change nothing.

What this page cannot do

• A blocklist for one device. AdGuard's filter lists (OISD, the NSFW list and the rest) apply to every device or to none. A level can block services and turn parental control on; it cannot pick a list.
• Show the portal on an HTTPS page. A cut-off child typing an https address gets a connection reset, not the "time's up" page. That is every captive portal's limit, not ours: nothing can paint inside a secure page it does not own. Plain http addresses and the OS's own captive-portal check do reach it.
• See through a VPN or WARP. A device with a VPN on is one encrypted stream to one address. Its names are invisible, its categories cannot be metered, and the level's DNS rules do not reach it. The firewall refuses known Tor relays and the DNS forcing stops the easy bypasses; a proper VPN is bug-bounty territory in this house, by design.
• Read messages. Snapchat, Instagram and Discord DMs are end-to-end encrypted. The network sees that the app was used, never what was said.