103 lines
1.8 KiB
Rego
103 lines
1.8 KiB
Rego
package custom
|
|
|
|
_social_domains := [
|
|
"reddit.com",
|
|
"roblox.com",
|
|
# X
|
|
"twitter.com",
|
|
"x.com",
|
|
# YouTube
|
|
"googlevideo.com",
|
|
"youtube.com",
|
|
"youtu.be",
|
|
"ytimg.com",
|
|
]
|
|
|
|
_toxic_domains := [
|
|
# Facebook
|
|
"facebook.com",
|
|
"facebook.net",
|
|
"fbsbx.com",
|
|
# Pinterest
|
|
"pinterest.com",
|
|
# TikTok
|
|
"isnssdk.com",
|
|
"musical.ly",
|
|
"musically.app.link",
|
|
"musically-alternate.app.link",
|
|
"musemuse.cn",
|
|
"sgsnssdk.com",
|
|
"tiktok.com",
|
|
"tiktok.org",
|
|
"tiktokcdn.com",
|
|
"tiktokcdn-eu.com",
|
|
"tiktokv.com",
|
|
]
|
|
|
|
in_domains(list, name) if {
|
|
some item in list
|
|
lower(name) == lower(item)
|
|
}
|
|
|
|
in_domains(list, name) if {
|
|
some item in list
|
|
endswith(lower(name), sprintf(".%s", [lower(item)]))
|
|
}
|
|
|
|
# METADATA
|
|
# description: Apply childssfe rules to the request, reject if it's a social
|
|
# site between off-hours, reject if it's toxic.
|
|
# entrypoint: true
|
|
default redirect := ""
|
|
|
|
# HTTP -> HTTPS redirects for allowed domains
|
|
redirect := location if {
|
|
_social
|
|
input.request.scheme == "http"
|
|
location := sprintf("https://%s%s", [input.request.host, input.request.path])
|
|
}
|
|
|
|
default reject := 0
|
|
|
|
template := "template/blocked.html" if {
|
|
_childsafe_network
|
|
_social
|
|
# styx.time_between("18:00", "16:00") # allowed between 16:00-18:00
|
|
}
|
|
|
|
template := "template/blocked.html" if {
|
|
_toxic
|
|
}
|
|
|
|
# Sensitive domains are always allowed
|
|
permit if {
|
|
_sensitive
|
|
reject != 0
|
|
}
|
|
|
|
_sensitive if {
|
|
styx.domains_contain("sensitive", input.request.host)
|
|
}
|
|
|
|
_social if {
|
|
#styx.domains_contain("social", input.request.host)
|
|
in_domains(_social_domains, input.request.host)
|
|
}
|
|
|
|
_toxic if {
|
|
in_domains(_toxic_domains, input.request.host)
|
|
}
|
|
|
|
_childsafe_network if {
|
|
styx.networks_contain("kids", input.client.ip)
|
|
}
|
|
|
|
errors contains "Request to social networking site outside of allowed hours" if {
|
|
_childsafe_network
|
|
_social
|
|
}
|
|
|
|
errors contains "Request to toxic site" if {
|
|
_toxic
|
|
}
|