Sensitive categories

The Protections page sets, for each profile (child, teenager, adult and devices given to nobody), what Warda does with each category:

These are the defaults. Monitoring lets the name through and records an alert (at most one per device and name per hour), shown on the dashboard and in the report of the person while they are a minor; it is offered for minors only, adults are never watched. Child sexual abuse material is always blocked, even over a personal allow rule; the other categories give way to the personal allow rules. A category is applied before the pauses of "something is broken", also to the names behind a CNAME, and its blocks cannot be unblocked in one click. A device that changes address is recognised again within seconds. When a minor becomes an adult or a person is removed, their alerts are deleted.

VPN, proxies and encrypted DNS (and iCloud Private Relay) have their list, always loaded: for an adult's device (allowed), Warda records a notice shown to that adult only, in My account and on their dashboard ("this device is no longer protected"); nobody else sees it. Videos and online games use their list of warda-lists and lists kept with Warda (internal/category/builtin.go, also some social networks the downloaded lists leave out); they serve the homework mode below. A category named in WARDA_CATEGORY_LISTS drops the names kept with Warda. Job sites are allowed for everyone by default: a business blocks them for the profile of the group of its workstations (see Groups of devices).

Devices placed nowhere (guests, new devices, until they are given to someone or a group, and the addresses Warda does not know yet: a router that forwards every query, a new IPv6 address) are protected as nobody by default; they are never monitored, since they may be an adult's; the Protections page can protect them like a child or a teenager instead (PUT /api/v1/unknown-profile {"profile": "child"}).

The other lists are downloaded only when a profile blocks or monitors the category, from warda-lists (see Lists). New domains hold about a million names and block some new legitimate sites: turn them on only where needed. Child sexual abuse material has no default source, on purpose: such lists are only given to vetted organisations, and warda-lists publishes none. This category applies only to the lists you give in WARDA_CATEGORY_LISTS, which also replaces the list of any category, for example WARDA_CATEGORY_LISTS="violence=/etc/warda/violence.txt,social=" (an empty value turns a category off).

Lists#

Every list Warda downloads by default comes from the repository warda-dns/warda-lists, which gathers, checks and publishes them on its branch dist, one file per list, one domain per line (# comments): https://gitea.tips-of-mine.com/warda-dns/warda-lists/raw/branch/dist/<id>.txt.

The sources of each list and their licences are in LICENSES.md of warda-lists; the lists are downloaded by each Warda, never shipped with it. Each list is refreshed every hour (WARDA_LIST_REFRESH) with its ETag, and a download that is not a list keeps the previous copy. csam has no file and no default source (see above).

A first start, or an upgrade from a version that used other sources, may find a list of warda-lists out of reach with no copy on disk yet. That list then falls back on the source Warda used before it (HaGeZi Multi PRO for base.txt, HaGeZi for security, bypass and newdomains, The Block List Project for adult, drugs, gambling, piracy and social; category.Fallbacks): downloaded once, read from its copy and logged ("list not downloaded yet: its previous source is used meanwhile", the source shown with an error), and never again once the list itself is downloaded, when its copy is deleted. A list you configure yourself has no fallback.