A box you own and actually understand, dashboards of your family's own data on your own screen, and a house you can pause with one word. Nobody can switch it off, put the price up, or change the rules under you.
The return
What those evenings buy.
POWER, AT YOUR FINGERTIPS
THE EDUCATION ENGINE
The learn-to-earn curriculum, 2,081 questions from Year 1 to NCEA with every answer explained, is worth the evenings on its own. AI tutors that teach rather than quiz are on the roadmap.
A TRUE FAMILY SERVER
Once there is one trusted machine humming in the hallway, doors start opening: the smart home, the cameras, the family's photos and files. The box is the beginning, not the end.
A small investment of time now, a large one in your family's favour later. The detail of exactly what the work involves is below, stated honestly.
Straight up
This is real infrastructure. Your agent does the hard part.
We are not going to tell you this is a two-minute app install, because it is not, and you would find out by nine o'clock anyway.
What you are standing up is the sort of thing a company pays a network engineer for: a gateway with its own isolated network, a firewall that rebuilds itself from a database, DNS with a different policy per person, containers, a database, timers. Five years ago that sentence was the end of the conversation for almost every parent alive.
Then the agents got good. That is the actual reason this project exists now and could not have existed in 2020. You do not have to know nftables. You have to be able to read what your agent tells you it did, say yes or no, and ask a question when something looks off. The complexity did not disappear, it stopped being yours to type. Everything in the repo is written for exactly that: plain-language runbooks, one command-line tool, and a manual addressed to your AI as much as to you.
So yes, it is an investment. Of a few hours across a few evenings, not of a credit card. And what you get at the end is better than the thing the subscriptions sell you, because it is yours, it does not report on your children, and nobody can switch it off or put the price up.
The trade, stated once and plainly. A few evenings instead of a subscription, and the hard part is the agent's job. That is the whole deal. We would rather write that sentence than pretend there is an installer, because you would find out at nine o'clock either way, and a project whose credibility rests on being honest about limits does not get to start by fudging the first one.
A few evenings
Install, hand it to your agent, name the devices. A few hours all up, and longer if you enjoy it, which plenty of people do.
A spare computer
The old laptop in the cupboard, a mini PC, or a Raspberry Pi. It does not need to be fast.
About NZD 20-45
A USB ethernet adapter, if the box has only one port. That is the entire shopping bill.
No subscription, ever
No account, no card, no per-child pricing, nothing that expires. MIT licensed and yours to keep.
The effort is not the price. It is part of the point. The Omarchy people are right about this: some things are worth building the muscle memory for, and you do not need an apology for the hour it takes. A parent who spends an evening learning something slightly hard, so the whole house works better, has just modelled the exact behaviour they keep asking for at the dinner table. That is a thing worth saying out loud to your kids. "I spent Saturday night setting this up so we would all be better off" lands rather differently to "because I said so".
You also get something out of it that is not on any feature list. Your own Linux box, humming in the hall, that you understand. Dashboards that are genuinely nice to look at, showing your data, on your screen. A first step out of the walled gardens Apple and Microsoft would prefer you stayed inside, into a world where the thing you own is the thing you can change. If you have never used an AI coding agent before, that is the one new skill in the box, and it is a good one to have picked up this year regardless.
Under the bonnetWhat the agent is doing while you make a cup of tea
Installing Docker and building the gateway image. Handing the USB network card into the container's own namespace with a small host-side warden, and putting it back if you ever unplug it. Loading around thirty schema files into Postgres in a dependency order that a script owns rather than a document, because the documented order drifted and a stranger's first install failed on it. Writing the firewall ruleset. Bringing up DHCP and DNS for the island.
None of which you need to know. It is here because you can check every line of it, and because roughly six hundred automated checks across fifteen suites have to pass before any of it ships.
You will not be doing it alone. The setup guides ship inside the repo, written to be handed straight to your agent, and the honest limits are documented next to the wins. Guides for more hardware, walkthroughs and community help are what the project wants to grow next. Those are intentions, not promises, and we will say plainly when they exist. What exists today is the code, the runbooks, and an agent that has read them.
What you need
Odds are it is already in a cupboard.
A spare computer
Any 64-bit PC with 4GB or more of RAM: an old desktop, a mini PC, a retired laptop. A Raspberry Pi 4 or 5 should work and would be the quietest option, though nobody has run one yet. It becomes the always-on Genkan box.Which operating system? →
A second network port
Its built-in ethernet is the uplink to your router; a cheap USB gigabit adapter (about NZD 20-45) becomes the kids' side.
A wifi access point
An old router or a mesh unit flipped to Access Point mode is perfect. This broadcasts the kids' network, ready for the Switcheroo.
A USB stick
To install the operating system. That is the whole shopping list.
Before you buy anything, read the hardware page. docs/HARDWARE.md is unusually blunt for a project page: it labels every combination Run (deployed and used in a house), Validated (built and checked on that hardware, but no live deploy) or Inference (nobody has tried it, here is the reasoning). The reference build is a mini PC with an ASIX AX88179 USB adapter, and that one is Run. No Raspberry Pi has run Genkan yet, so the Pi guide, careful as it is, is inference. You should know which one you are buying into.
That is the whole shopping list. Most families already have two of the three in a drawer. The adapter is the only thing you are likely to have to go and find.
Before you install anything, go and check us. Handing your family's network to code you found on the internet deserves a raised eyebrow, and Genkan is built so you can satisfy it. The whole repo is on GitHub, MIT licensed and readable. Clone it, open your own AI agent in the folder, and ask two plain questions: what does this actually do, and does anything leave my house? The answer comes from the code, not from us. Once it is running, it runs on your hardware, in your house, with no account and nothing phoning home.
Then read the third thing: the privacy charter. Thirteen numbered promises this project will not quietly break, and the checklist a reviewer runs every pull request through, so that the promises survive the people. It includes the ones that are inconvenient: no telemetry even anonymous, no decryption of your child's traffic ever, no report to anybody but that child's own parent, and no monetisation that depends on data. It also names the gaps rather than hiding them.
The flow
Install Linux. Clone the repo. Hand it the prompts.
The shape of the evening, in four moves. The detail underneath each one is in the prompts file, and the honest count is twelve prompts rather than four, because the database and the access point each deserve their own.
01
Install a fresh Linux
Write the image to the USB stick, boot the spare box from it, click through. Debian or Ubuntu Server is the best-trodden path; Omarchy is the agent-first one. Both are covered by a guide in the repo.
02
Hand it to your agent
Clone the repo, open your AI agent in the folder, and paste the prompts one at a time. It does the network ports, the database, the containers and the firewall, and stops to ask you whenever the answer is about your house rather than about networking.
03
Plug in the access point
One cable from the adapter to the access point, and the kids' network exists. Name each device as it appears, then do the Switcheroo and let them all walk on by themselves.
01Install a fresh Linux on the spare PC. Debian or Ubuntu if you want the best-trodden path, Omarchy if you like the idea of an agent-first machine. Either way, check docs/HARDWARE.md before you buy anything.
02Clone the Genkan repo and open your agent in it: git clone https://github.com/0800tim/genkan.git genkan && cd genkan && claude (or your agent of choice).
03Work through the prompts in docs/setup/PROMPTS.md, pasting one at a time and reading what comes back. The agent configures the network ports, provisions the database, deploys the containers, then proves the whole thing with a test suite that fires real packets on your box.
04Do the Switcheroo. Rename your router's wifi, give the new access point the old name and password, and watch every device walk itself onto the island.
Then talk to it from your phone. Put the box on a private network like Tailscale (free for families) and your agent is reachable from anywhere: "dinner", "kill gaming", "give Ben 30 minutes". Each kid gets their own portal on the island for quizzes, chores and their remaining time.
The prompts
There is no installer. There is something that suits this better.
A reviewer said Genkan lacks a simple, reliable installer and is an advanced self-hosted project rather than a polished appliance. That is a fair description, so the answer is not to argue with it. The answer is to make the agent-led install genuinely excellent and to write the prompts down.
docs/setup/PROMPTS.md is twelve copy-and-paste prompts, in order, covering the whole journey: flashing the operating system, first boot, cloning, working out which network port is which, the database, deploying, the access point, naming the people and devices, the dashboard, the Switcheroo, and the first week. Each one is self-contained, so pasting it into a fresh agent session still works. Each one names the files the agent has to read before it starts. And each one tells you what you should see, and what to do if it looks wrong.
They are written against what the repo actually does. A prompt that tells an agent to run a script that does not exist is worse than no prompt at all.
Clone https://github.com/0800tim/genkan.git into ~/genkan and read, in
this order: CLAUDE.md, docs/setup/README.md, and the platform guide that
matches this box. Also read docs/HARDWARE.md.
Then do the interface work and nothing else:
1. List every network interface with its MAC, driver, speed and carrier
state. Tell me which one is the uplink to my house router and which
one you propose as the kids' side.
2. If there is no second wired interface, say so plainly and stop. Do
not invent one and do not silently fall back to the wifi topology.
3. Set KIDS_NIC_MAC and UPLINK_IFACE in config.env.
4. Make this host's network manager leave the kids' interface alone,
and prove it worked.
Do not run deploy.sh. Do not touch the uplink. Show me config.env when
you are done, and stop.
Notice what that prompt is doing. It tells the agent to stop rather than guess, because an agent that picks your uplink as the kids' side takes the whole house offline. It refuses a silent fallback. It asks for proof, not a claim. Every prompt in the file is shaped like that, and the reason is simple: this box becomes your family's only route to the internet, so an agent that stops and asks is doing the right thing.
What the agent does
Reads the repo. Works out what your particular hardware needs. Installs the packages, keeps your network manager off the kids' port, provisions the database, loads the schema in the one order that works, runs the deploy, and then proves it with a packet-level test suite on your own box.
What you do
Plug in two cables. Answer the questions only you can answer: whose device is that, what should the wifi be called, how much time does each kid get. Read what the agent says it did and say yes or no. Type a sudo password when it asks.
What neither of you can skip
Physical work, and root. deploy.sh and the test suites need sudo, so if your box asks for a password the agent will stop and hand it back to you. That is correct behaviour, not a failure.
And one prompt to keep your agent honest. The file ends with an audit prompt you run a few days later, ideally with a different agent from the one that did the build. It checks whether anything on the box is sending data outside your house, whether the dashboard is bound to a private address only, whether the safety net actually resolves, and whether anything in the firewall ruleset was quietly changed to make a test pass. It reports and changes nothing. Being able to check the work is the point of owning it.
The cabling
Two cables. That is the physical part done.
One goes in from your router. One goes out to the access point. Everything else is software, and your agent handles it.
Which port is which is up to you. The built-in ethernet usually becomes the uplink to your router, and the USB adapter becomes the kids' side. Your agent works out what it is looking at, labels both, and refuses to start if the wiring looks wrong rather than fighting your router.
Drag the diagram sideways to see both cables.
The guides
A platform guide for whatever hardware you have.
Step-by-step setup guides ship inside the repo, written so a first-timer's AI agent can follow them end to end. Pick the one that matches your box.
Debian or Ubuntu most common
A mini PC, a retired laptop or a server you already run. The most common "hardware we already had" path, and the family the reference box is from. Covers the second NIC, ufw, and the laptop-as-gateway extras.
Omarchy
The reference platform in spirit: an agent-first Arch setup where a coding agent is a first-class citizen and Docker is ready. The stack has been built and checked on a real Omarchy box; the live deploy on it needed a human at the keyboard for sudo.
Raspberry Pi
The quietest, lowest-power option: a Pi 4 or 5 with a USB ethernet adapter. The guide is thorough and covers both topologies. Read it alongside the honesty on the hardware page, because no Pi has actually run Genkan yet.
Any other Linux
Fedora, openSUSE, plain Arch, whatever is humming in the corner. This one is the contract rather than a recipe: exactly what Genkan needs from a host, and how to satisfy it with your distro's packages.
Everything on this site describes software that exists and is tested on the box it was built on: the island firewall, the per-category metering, the quizzes, the captive portal, the lot. What varies by platform is how confidently we can say it will behave the same on your box, and docs/HARDWARE.md labels each combination rather than leaving you to guess. The most useful thing anyone can contribute right now is a report from hardware nobody has tried.
One more thing before you flip the switch. Tell the kids. Show them the bug bounty, show them how to earn, show them what the box can and cannot see. Genkan works best as something the family runs together, not something done to them.