diff --git a/src/hqtoxbot.nim b/src/hqtoxbot.nim
index 8028f33..41ef7f6 100644
--- a/src/hqtoxbot.nim
+++ b/src/hqtoxbot.nim
@@ -1,6 +1,6 @@
 import toxcore
 
-import std/asyncdispatch, std/json, std/httpclient
+import std/asyncdispatch, std/json, std/httpclient, std/strutils
 
 const spaceApiUrl = "http://spaceapi.hq.c3d2.de:3000/spaceapi.json"
 
@@ -18,7 +18,27 @@ proc addAdmin(bot: Tox; id: Address) =
   discard bot.addFriend(
     id, "You have been granted administrative rights to " & bot.name)
 
+proc updateStatus(bot: Tox; http: AsyncHttpClient) {.async.} =
+  try:
+    let
+      rsp = await http.get(spaceApiUrl)
+      body = await rsp.body
+      space = parseJson body
+      status = $(space["status"])
+    if bot.statusMessage != status:
+      echo "change status to ", status
+      bot.statusMessage = unescape $(space["status"])
+  except:
+    echo "status update failed"
+    bot.statusMessage = "status update failed"
+
 proc setupCallbacks(bot: Tox) =
+  let http = newAsyncHttpClient()
+  addTimer(20*1000, oneshot=false) do (fd: AsyncFD) -> bool:
+    asyncCheck updateStatus(bot, http)
+
+  let schalterClient = newAsyncHttpClient()
+  schalterClient.headers = newHttpHeaders({ "Authorization": "Basic c3dvcmRmaXNo" })
 
   #[
   bot.onConferenceInvite do (friend: Friend; kind: ConferenceType;
@@ -27,7 +47,30 @@ proc setupCallbacks(bot: Tox) =
   ]#
 
   bot.onFriendMessage do (f: Friend; msg: string; kind: MessageType):
-    echo msg
+    case msg
+
+    of "lock":
+      bot.typing(f, true)
+      let fut = schalterClient.post("http://schalter.hq.c3d2.de/door/lock")
+      fut.addCallback do ():
+        bot.typing(f, false)
+        if fut.failed:
+          discard bot.send(f, "lock failed")
+        else:
+          discard bot.send(f, fut.read.status)
+
+    of "unlock":
+      bot.typing(f, true)
+      let fut = schalterClient.post("http://schalter.hq.c3d2.de/door/unlock")
+      fut.addCallback do ():
+        bot.typing(f, false)
+        if fut.failed:
+          discard bot.send(f, "unlock failed")
+        else:
+          discard bot.send(f, fut.read.status)
+
+    else:
+      discard bot.send(f, """unknown command "$1"""" % msg)
 
   for id in adminIds:
     bot.addAdmin(id)
@@ -41,32 +84,10 @@ proc newBot(name: string): Tox =
   result.bootstrap()
   echo result.name, " is at ", result.address
 
-proc updateStatus(bot: Tox; http: AsyncHttpClient) {.async.} =
-  try:
-    let
-      rsp = await http.get(spaceApiUrl)
-      body = await rsp.body
-      space = parseJson body
-      status = $(space["status"])
-    if bot.statusMessage != status:
-      echo "change status to ", status
-      bot.statusMessage = $(space["status"])
-  except:
-    echo "status update failed"
-    bot.statusMessage = "status update failed"
-
 proc main() =
-  let
-    bot = newBot("HQ Bot")
-    http = newAsyncHttpClient()
-
+  let bot = newBot("HQ Bot")
   echo "DHT port and key: ", bot.udpPort, " ", bot.dhtId
 
-  waitFor updateStatus(bot, http)
-
-  addTimer(20*1000, oneshot=false) do (fd: AsyncFD) -> bool:
-    asyncCheck updateStatus(bot, http)
-
   while true:
     iterate bot
     poll bot.iterationInterval