Manage devices
Register the machines on your network and give each the profile it deserves.
What this step does
After warden init, nothing is registered. Every source that matches no [[devices]] entry and no [[subnets]] entry gets server.default_profile — one policy for your whole network, and a bare IP address in every log line.
Registering a device gives that address a name and, if you want one, a profile of its own. It is optional per host: a guest’s laptop or a smart bulb can stay unmapped forever and just inherit the subnet or global default.
Register a device
At least one of --ip or --mac is required — it is how the resolver identifies the device. Pin by address:
warden device add anna-iphone --ip 192.168.1.44 --profile kidsOr pin by hardware address, which survives a DHCP lease change:
warden device add living-room-tv --mac AA:BB:CC:DD:EE:FF --profile kidsAttach labels
--owner, --device-type and --department classify a device for grouping and filtering in the TUI — a clean inventory instead of a list of anonymous names. They come from the same vocabulary as labels:
warden device add anna-iphone --ip 192.168.1.44 --profile kids \
--owner anna --device-type phone --department famigliaChange a field later
warden device set anna-iphone profile teenstags is not one of the settable fields — the verb refuses it, since a device tag no longer decides which lists reach it.
How the profile is picked
A device’s own profile wins first, then its highest-priority group, then the subnet its address falls in, then the global default. An active schedule overrides the device’s own profile for the window it’s active. See decision precedence for the exact chain.
Check your work
--into <path> on add / set / remove picks which file the entry lands in; left unset, it auto-selects a devices.d/*.toml file if there’s exactly one, or falls back to the master config. To confirm what you actually wrote without waiting for a real query, run:
warden resolve 192.168.1.44It prints the matched device, the level it matched at, and the effective profile.
CLI reference
| Verb | Args / flags | Does |
|---|---|---|
device list | --live --json | List devices — from config, or live stats via IPC with --live; --json for machine output |
device show <id> | — | Full details for one device |
device add <id> | --ip --mac --profile --groups --owner --device-type --department --display-name --notes --into | Register a device. At least one of --ip / --mac is required |
device set <id> <field> <value> | --into | Change one field: ip, mac, profile, display_name, owner, device_type, department, notes, groups, network_name, network_name_wildcard |
device remove <id> | --into | Delete the device entry |
resolve <ip> | — | Print the matched device, match level and effective profile for an address, against the on-disk config |
In the TUI
Open warden dashboard, press 3 or g v for the Network section’s Devices leaf. The screen holds one list with both halves of your network: devices you’ve named, and everything else Warden has answered a query for, dimmed underneath. That second half is the fast path for onboarding — let the new phone look something up, and its row appears in the unmapped half within about five seconds, address and MAC already filled in. Press Enter on it to open the promote form, prefilled and locked on the address and MAC, and just fill in a name and a profile.