Laravel Bulwark

Laravel Bulwark is a local-first home security and access-control framework for Laravel. It provides the application layer for homes, security modes, sensors, device events, alarms, cameras, credentials, facial-recognition/fingerprint driver contracts, automations, access decisions, and hash-chained audit logs.

Bulwark is an application framework, not a certified life-safety alarm panel. Smoke/CO/fire protection and emergency notification should continue to use certified devices and services appropriate to your jurisdiction.

Requirements

• PHP 8.2+
• Laravel 11, 12, or 13

Install

composer require eloquent-works/laravel-bulwark
php artisan bulwark:install
php artisan migrate

Set a high-entropy secret before enabling the device-ingest endpoint:

BULWARK_DEVICE_EVENT_SECRET=change-me
BULWARK_REQUIRE_SIGNED_EVENTS=true

Arm / disarm

use EloquentWorks\Bulwark\Enums\SecurityMode;
use EloquentWorks\Bulwark\Facades\Bulwark;

Bulwark::security()->arm($home, SecurityMode::AWAY);
Bulwark::security()->disarm($home);

The facade proxies to the Bulwark container object. You may also inject SecurityStateManager, AlarmManager, DeviceManager, AccessManager, or BiometricManager directly.

Device event ingestion

POST /api/bulwark/events expects JSON such as:

{"device_uid":"front-door","event":"opened","occurred_at":"2026-08-10T12:00:00Z","payload":{"battery":92}}

Sign the exact request body using:

X-Bulwark-Timestamp: <unix timestamp>
X-Bulwark-Signature: HMAC_SHA256(timestamp + "." + raw_body, BULWARK_DEVICE_EVENT_SECRET)

Accepted events are persisted and queued for policy evaluation.

Biometrics

Bulwark intentionally ships contracts rather than a hard-coded biometric engine:

• FaceRecognitionDriver
• FingerprintDriver

The default drivers are inert. Bind them to a local service or hardware integration. Prefer storing opaque external template IDs, not raw face images or fingerprint scans.

Local-first design

Use a local controller (for example a Raspberry Pi, embedded controller, or dedicated alarm hardware) for time-critical behavior such as sirens. Laravel Bulwark is the policy, identity, history, remote-control, automation, and integration layer.

MQTT

MqttTransport is an adapter point. It deliberately does not force an MQTT client dependency. Bind Transport or MqttTransport to your preferred client implementation.

Extending

See docs/architecture.md, docs/drivers.md, and docs/biometrics.md.

Testing

composer install
composer test

License

MIT