store

Documentation

Overview

Package store manages the local hexwall SQLite database. Unlike the Pi-hole DB, this database is owned by the tool and persists trusted IPs and kill logs across restarts.

Index

• type FraudCheckCacheEntry
• type Store
  • func NewStore(dbPath string) (*Store, error)
  • func (s *Store) Close() error
  • func (s *Store) GetRecentFraudCheck(ip string) (*FraudCheckCacheEntry, error)
  • func (s *Store) IsAllowed(ip string) (bool, error)
  • func (s *Store) LogKill(ip, pid, program string) error
  • func (s *Store) UpdateEstablished(ip string) error
  • func (s *Store) UpsertAllowedIP(ip, domain string) error
  • func (s *Store) UpsertFraudCheck(ip string, shouldKill bool) error

Types

type FraudCheckCacheEntry

type FraudCheckCacheEntry struct {
	ShouldKill bool
	CheckedAt  int64
}

FraudCheckCacheEntry stores the cached kill decision for a prior fraud API lookup.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store wraps the local hexwall database.

func NewStore

func NewStore(dbPath string) (*Store, error)

NewStore opens or creates the hexwall database at dbPath and applies the schema.

func (*Store) Close

func (s *Store) Close() error

Close closes both database connections.

func (*Store) GetRecentFraudCheck

func (s *Store) GetRecentFraudCheck(ip string) (*FraudCheckCacheEntry, error)

GetRecentFraudCheck returns the cached fraud-check decision when it was recorded within the cache window.

func (*Store) IsAllowed

func (s *Store) IsAllowed(ip string) (bool, error)

IsAllowed reports whether the IP is trusted based on a recent Pi-hole refresh or recent established-connection activity.

It returns true if the IP is trusted. An IP is trusted when either:

• It was refreshed from Pi-hole's domain history within the last hour, OR
• somo confirmed it as an active established connection within the last 60 seconds (keeps long-running connections alive even after their domain ages out)

func (*Store) LogKill

func (s *Store) LogKill(ip, pid, program string) error

LogKill records a killed connection in the audit log.

func (*Store) UpdateEstablished

func (s *Store) UpdateEstablished(ip string) error

UpdateEstablished stamps the current time as last_established for an IP. The monitor calls it when somo confirms the connection is still active.

func (*Store) UpsertAllowedIP

func (s *Store) UpsertAllowedIP(ip, domain string) error

UpsertAllowedIP inserts or refreshes a trusted IP. On conflict, it updates the domain and last_refreshed while preserving first_approved and last_established.

func (*Store) UpsertFraudCheck

func (s *Store) UpsertFraudCheck(ip string, shouldKill bool) error

UpsertFraudCheck stores the current fraud-check decision for an IP.