Nayatel Guardian

Status

Domain rules are enforced by your AdGuard Home DNS server on the LAN (not Nayatel Safe DNS). Rules are written as ||domain^, which also blocks every subdomain. Only rules inside Guardian's own marker block are managed — anything you add in the AdGuard UI is left untouched.

Running the AdGuard Home add-on under Home Assistant? Enter Home Assistant's address (e.g. its tailnet address http://100.x.y.z:8123) as the URL and a long-lived access token of an admin user (HA profile → Security). AdGuard is then reached through the add-on's ingress; username/password are not used.

Devices that got their address from AdGuard. Manage a device to give it a fixed address and a name; rules and temporary changes can then target just that device instead of the whole house.

Block or unblock a device now — this applies to all its MACs across the 2.4G and 5G bands. A device under an active schedule rule is re-asserted to the rule on the next cycle.

A rule blocks its targets while any of its time windows is active, and unblocks them otherwise. Apps & sites rules can target chosen devices or everyone, and can switch on Safe Search or the adult-content filter. Rules made only of AdGuard services with a simple schedule are enforced by AdGuard and keep working even if Guardian is down. Daily limits block an app for a device once it used it for the allowed minutes today (counted from DNS lookups, so approximate). Internet off refuses DNS to a device and blocks it at the Nayatel router by its MAC address. Nayatel device blocks follow the device across repeaters and MAC changes.

Allow or block something for a while, or for a date range — "YouTube for 30 min", "extend bedtime by an hour", "exam week", "Eid: no rules". Allow with nothing picked lifts every Guardian rule (for the chosen devices, or for everyone including Nayatel device blocks).

⚠ This locks the entire internet connection during the scheduled window (every device, including yours). Nayatel enforces the schedule on their side.

The Guardian agent runs on a Linux computer at boot and applies the Chrome policy you set here to Chrome, Chromium and Brave — e.g. block installing extensions, or keep the browser's DNS going through AdGuard. It only ever writes its own zz-guardian.json policy file; it cannot run commands. Policy names: chrome://policy or Chrome Enterprise docs.

Installing the agent

Works on Linux computers with systemd and python3 (Ubuntu, Debian, Mint, Fedora…). Installing needs an admin (sudo) account on the computer; the agent then runs as a system service at every boot, also when nobody is logged in.

1. Click + Add computer above and name the computer. Guardian shows an install command with a one-time token, valid for an hour.
2. On the computer, open a terminal and paste that command. It asks for the sudo password, downloads the agent, enrolls the computer and starts the guardian-agent service. Or download install.sh and run it with the address and token:

   sudo bash install.sh  <token>

3. Click Refresh — the computer shows as online. Open Chrome policy, pick the policies and Apply.
4. Check on the computer: open chrome://policy in the browser and click Reload policies; Guardian's policies are listed with source Platform.

Troubleshooting (on the computer)

systemctl status guardian-agent        # is it running?
journalctl -u guardian-agent -n 50     # recent log lines
sudo systemctl restart guardian-agent  # reconnect now
python3 /usr/local/lib/guardian-agent/guardian_agent.py check  # DNS and internet

Updating the agent — agents v3 and later update themselves within a minute of a Guardian deploy. A computer still showing agent update needed has an older agent: run this on it once (keeps its enrollment and policy):

curl -fsSL /agent/install.sh | sudo bash -s -- --update

Uninstall — removes the service and Guardian's browser policy; then remove the computer here too:

curl -fsSL /agent/install.sh | sudo bash -s -- --uninstall

The agent connects out to Guardian over HTTPS (no open ports) and only writes zz-guardian.json in the Chrome, Chromium and Brave policy folders under /etc. It keeps working across reboots and network changes, and picks up policy changes within seconds while online.

Other apps, such as a chores-and-points app that rewards screen time, can use Guardian with your permission. Register an app here; it then sends you to Guardian, which asks for your Nayatel User ID and password before connecting it. The app never sees the password, gets only the access you see listed, and can be disconnected here any time. An app that may only give extra time must name the devices and can allow at most 240 minutes at a time.

For developers: authorize at /oauth/authorize, token at /oauth/token (authorization code + PKCE S256, refresh tokens), then call the /api/… endpoints with Authorization: Bearer …. Details: /.well-known/oauth-authorization-server.

Activity