Manage devices
Register the machines on your network and give each the profile it deserves.
What this step does
After warden init, nothing is registered. Every source that matches no [[devices]] entry and no [[subnets]] entry gets server.default_profile — one policy for your whole network, and a bare IP address in every log line.
Registering a device gives that address a name and, if you want one, a profile of its own. It is optional per host: a guest’s laptop or a smart bulb can stay unmapped forever and just inherit the subnet or global default.
Register a device
At least one of --ip or --mac is required — it is how the resolver identifies the device. Pin by address:
warden device add alice-iphone --ip 192.168.1.44 --profile kidsUnder the default [server] enforce_device_mac = true, a device pinned by IP only is ignored: its address falls through to its subnet or the default profile. Add --mac as well, or set enforce_device_mac = false. With a mac, the device keeps its profile while the ARP table shows that MAC or one of its mac_aliases at its address; a MAC that another configured device owns identifies that device instead. See the MAC check.
Or pin by hardware address, which survives a DHCP lease change:
warden device add living-room-tv --mac AA:BB:CC:DD:EE:FF --profile kidsThe MAC must be one exact address; there is no wildcard or prefix. After a lease change, Warden finds the device again only once it next reads the ARP table: at start, on a reload, while a TUI or warden device list --live asks for the device list, or, when the configuration has a schedule, within about a minute. See when a new lease is picked up. To cover many virtual machines, see many virtual machines or containers.
Attach labels
--owner, --device-type and --department classify a device for grouping and filtering in the TUI — a clean inventory instead of a list of anonymous names. They come from the same vocabulary as labels:
warden device add alice-iphone --ip 192.168.1.44 --profile kids \
--owner alice --device-type phone --department familyChange a field later
warden device set alice-iphone profile teenstags is not one of the settable fields — the verb refuses it, since a device tag no longer decides which lists reach it.
How the profile is picked
An active schedule is checked before the device’s own profile, so it wins inside its window. After that come the device’s own profile, then its highest-priority group, then the subnet its address falls in, then the global default. See decision precedence for the exact chain.
Check your work
--into <path> on add / set / remove picks which file the entry lands in; left unset, it auto-selects a devices.d/*.toml file if there’s exactly one, or falls back to the master config. To confirm what you actually wrote without waiting for a real query, run:
warden resolve 192.168.1.44It prints the matched device, the level it matched at, and the effective profile. warden resolve reads the ARP table of the host it runs on.
CLI reference
| Verb | Args / flags | Does |
|---|---|---|
device list | --live --json | List devices — from config, or live stats via IPC with --live; --json for machine output |
device show <id> | — | Full details for one device |
device add <id> | --ip --mac --profile --groups --owner --device-type --department --display-name --notes --into | Register a device. At least one of --ip / --mac is required |
device set <id> <field> <value> | --into | Change one field: ip, mac, profile, display_name, owner, device_type, department, notes, groups, network_name, network_name_wildcard |
device remove <id> | --into | Delete the device entry |
device block <id> | --into | Set the device’s profile to blocked, created if missing |
device unblock <id> | --profile (default default) --into | Set the device’s profile back after block |
device quiet <id> | --for <duration> or --until <RFC 3339>, --into | Put the device on blocked with a one-shot schedule that expires on its own |
device set-unfiltered <id> true|false | --into | Skip filtering for the device; its queries are still resolved and logged |
resolve <ip> | — | Print the matched device, match level and effective profile for an address, against the on-disk config |
In the TUI
Open warden dashboard, press 3 or g v for the Network section’s Devices leaf. The screen holds one list with both halves of your network: devices you’ve named, and everything else Warden has answered a query for, dimmed underneath. That second half is the fast path for onboarding — let the new phone look something up, and its row appears in the unmapped half within about five seconds, address and MAC already filled in. Press Enter on it to open the promote form, prefilled and locked on the address and MAC, and just fill in a name and a profile.