Internet Use Control

Internet Use Control A architecture diagram generated by Archify. Home lab - Docker on .13, Caddy and Apprise on .35 Sam · browser dashboard · Architecture component Sam browser dashboard Caddy (.35) · TLS + vhost · Home lab - Docker on .13, Caddy and Apprise on .35 · webrestrict.lab Caddy (.35) TLS + vhost webrestrict.lab Control Service · Go + SQLite :8791 · Home lab - Docker on .13, Caddy and Apprise on .35 · source of truth Control Service Go + SQLite :8791 source of truth Mosquitto (.13) · 8883 TLS + topic ACLs · Home lab - Docker on .13, Caddy and Apprise on .35 · two planes Mosquitto (.13) 8883 TLS + topic ACLs two planes Kids' Android client · Kotlin, Accessibility + overlay · Architecture component Kids' Android client Kotlin, Accessibility + overlay Admin app · kotlin_phone_app_admin · Architecture component Admin app kotlin_phone_app_admin Hub · read-only /ask :8788 · Architecture component Hub read-only /ask :8788 Apprise (.35) · alerts :8210 · Home lab - Docker on .13, Caddy and Apprise on .35 Apprise (.35) alerts :8210 Legacy consumers · 1883 plain + anonymous · Architecture component Legacy consumers 1883 plain + anonymous HTTPS Bearer token /api/v1 Bearer token /ask retained config own config topic status + telemetry alerts + tamper 1883 plain Legend Frontend Backend Cloud Security Message bus External

Control Service

  • • Go and SQLite are the single source of truth
  • • Publishes each device config retained
  • • Serves dashboard, admin API and Hub API

MQTT two planes

  • • 8883 is TLS with per-device credentials and ACLs
  • • A device reads only its own config topic
  • • 1883 stays plain and anonymous for legacy use

Enforcement and gap

  • • Accessibility overlay blocks by interruption
  • • Tamper alert is the real enforcement, not Device Owner
  • • Phase 4 Windows client is deferred and not built