A REST web service for Mellon controllers

Latest on Hackage:

This package is not currently in any snapshots. If you're interested in using it, we recommend adding it to Stackage Nightly. Doing so will make builds more reliable, and allow to host generated Haddocks.

BSD3 licensed and maintained by Drew Hess


The mellon-web package wraps a mellon-core controller in a REST web service, making it possible to control physical access devices from an HTTP client. The package includes both a WAI application server, and native Haskell client bindings for the service.

Like the mellon-core controller interface, the mellon-web REST API is quite simple. There are only 3 methods:

  • GET /time returns the system time on the server. This is made available for diagnostic purposes, primarily to ensure the server has an accurate clock.

  • GET /state returns the controller’s current state (either Locked or Unlocked date where date is the UTC time at which the controller will automatically lock again).

  • PUT /state sets the controller’s current state. Use this method to lock and unlock the controller.

For detailed documentation, the server includes a self-documenting Swagger spec.

Note that the mellon-web server does not provide an authentication mechanism! You should proxy it behind a secure, authenticating HTTPS server such as Nginx.

Example servers

“Mock” server

An extremely simple example server (with on-line documentation support) is provided in the examples directory. You can run it with cabal run mock-mellon-server. The server is will run on the localhost loopback interface on port 8081.

This particular example server uses a “mock lock” device which only internally logs lock and unlock events without depending on any actual hardware, so it will run anywhere.

GPIO server

Another included example server uses the mellon-gpio package to drive a simple physical access device via a GPIO pin. This server must be run on a Linux host with GPIO hardware, e.g., a Raspberry Pi running Linux.

This server takes a GPIO pin number and a local port number, then starts a mellon-web server on all local interfaces on the specified port. When the server receives an unlock request, it will drive a high signal on the specified GPIO pin. When the unlock expires, or when the server receives a lock request, it will drive a low signal on the specified GPIO pin.

To use this server, simply connect a properly-designed physical access device (e.g., an electric strike driven by a relay circuit such as the one shown here) to an available GPIO pin on the host device, then run the server with the specified GPIO pin number and port. For example, to run the server on port 7533 using GPIO pin 65:

cabal run gpio-mellon-server -- sysfs --port 7533 65

The sysfs command tells the server to use the Linux sysfs GPIO interpreter. (Currently, this is the only supported GPIO platform.)

NOTE: the REST service provided by gpio-mellon-server offers no security/authentication for your access control device! You should always run it (or any mellon-web server) behind a secure proxy web service or equivalent HTTP(S)-based authentication mechanism.

Travis CI build status

Changes (2018-04-03)


  • Bump several package upper bounds.

  • Requires servant 0.13.

  • Drop support for Stackage LTS < 11. (2018-02-04)


  • Don’t run time-sensitive tests by default (fixes spurious failures on loaded CI servers).

  • Work around order-sensitive toJSON decoding in doctests. (2018-02-04)


  • This package now uses Protolude.

  • Disable hlint tests by default.

  • Add a stack-lts-9.yaml file for LTS 9 Stack builds.

  • Pare down support to just GHC 8.0.2 and GHC 8.2.2.


  • Fix the swagger.json test on Stack.

  • Add PVP bounds for mtl, http-client-tls, network dependencies.

  • Remove references in the documentation to the no-longer-present file. The SwaggerAPI server includes a self-documenting Swagger spec; please see that for detailed REST API documentation. (2018-01-26)

  • Require hlint 2.0.x.

  • Fix new hlint issues.

  • Bump QuickCheck bounds.

  • New and improved Nix packaging. (2018-01-11)

  • Use hpack.

  • Support for GHC 8.2.2.

  • Bump swagger2, optparse-applicative, doctest, QuickCheck, hspec-wai upper bounds.

  • Try to make the Mellon/Web/ClientSpec.hs test a little less time-sensitive.

  • Maintainer-related changes (better Nix support, Makefile, etc.). (2017-09-04)

  • Fix .cabal file for now-removed Paw file. (2017-09-04)

  • Hackage compliance fix. (2017-09-04)

  • Remove out-of-date Paw file.

  • Port to Servant 0.11. Due to Servant 0.11 API changes, our API has changed, as well (just the Haskell bits; the web API remains the same). (2017-05-24)

No changes; copyright has been assigned to Quixoftic, LLC. (2017-04-28)

  • Now requires servant-client >= 0.9.

  • Bump various dependency upper bounds. (2016-09-23)

  • Bump servant upper bounds. (2016-09-23)

  • Add an “–active-low” flag to gpio-mellon-server example. (2016-06-13)

  • Packaging fixes only. (2016-06-02)

  • Port to new mellon-core package.
  • Fix Servant bitrot.
comments powered byDisqus