Install ToutWAF step by step

Update the system and install prerequisites

sudo dnf -y update
sudo dnf -y install curl tar ca-certificates firewalld policycoreutils-python-utils

Install with the one-line installer

The script downloads the native binaries for your architecture, creates a dedicated unprivileged user and installs the hardened systemd services toutwaf-dp (data plane, ports 80 and 443) and toutwaf-cp (control plane and console, port 9443), then prints your first-login information.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash

Prefer to read the script first?

Download it, review it, then run it. Recommended for production servers.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
less install.sh
sudo bash install.sh

Installer options

A new installation lives in a single home, /var/toutwaf (bin, conf, data and logs; change it with --home DIR or TOUTWAF_HOME), and the command-line tools are linked in /usr/local/bin. An installation made earlier keeps its own paths (/etc/toutwaf, /var/lib/toutwaf) and is never moved.

# only let your admin network reach the console (port 9443)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --console-from 203.0.113.0/24

# do not touch the host firewall / choose the installation home
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --no-firewall
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --home /opt/toutwaf

# name the channel explicitly (the installer of the dev branch already takes the dev channel; no stable version exists yet)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --channel dev

Open the firewall

The installer opens these ports by default when firewalld or ufw is active: 80 and 443, and the console port 9443 (restrict it to your admin network with --console-from). The agent port 9444 is never opened publicly. These commands are only needed with --no-firewall, with another firewall, or to do it by hand.

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port port="9443" protocol="tcp" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

SELinux

Keep SELinux enforcing. Label the ToutWAF directories and make sure no AVC denial is logged.

getenforce
sudo restorecon -Rv /var/toutwaf
sudo ausearch -m avc -ts recent

Manage the services

Both services start at boot. Use these commands to start, stop or restart them.

sudo systemctl enable --now toutwaf-cp toutwaf-dp
sudo systemctl restart toutwaf-cp toutwaf-dp
sudo systemctl stop toutwaf-dp toutwaf-cp

Check the services

sudo systemctl status toutwaf-cp toutwaf-dp --no-pager
toutwafctl doctor
curl -kI https://127.0.0.1:9443/
curl -s http://127.0.0.1:9101/healthz
sudo journalctl -u toutwaf-dp -u toutwaf-cp -n 50 --no-pager

Upgrade

Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.

sudo mkdir -p /var/toutwaf.bak
sudo cp -a /var/toutwaf/conf /var/toutwaf/data /var/toutwaf.bak/
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --update --yes
curl -s http://127.0.0.1:9101/healthz

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
sudo bash install.sh --uninstall

sudo bash install.sh --uninstall --purge

Update the system and install prerequisites

sudo dnf -y update
sudo dnf -y install curl tar ca-certificates firewalld policycoreutils-python-utils

Install with the one-line installer

The script downloads the native binaries for your architecture, creates a dedicated unprivileged user and installs the hardened systemd services toutwaf-dp (data plane, ports 80 and 443) and toutwaf-cp (control plane and console, port 9443), then prints your first-login information.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash

Prefer to read the script first?

Download it, review it, then run it. Recommended for production servers.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
less install.sh
sudo bash install.sh

Installer options

A new installation lives in a single home, /var/toutwaf (bin, conf, data and logs; change it with --home DIR or TOUTWAF_HOME), and the command-line tools are linked in /usr/local/bin. An installation made earlier keeps its own paths (/etc/toutwaf, /var/lib/toutwaf) and is never moved.

# only let your admin network reach the console (port 9443)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --console-from 203.0.113.0/24

# do not touch the host firewall / choose the installation home
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --no-firewall
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --home /opt/toutwaf

# name the channel explicitly (the installer of the dev branch already takes the dev channel; no stable version exists yet)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --channel dev

Manage the services

Both services start at boot. Use these commands to start, stop or restart them.

sudo systemctl enable --now toutwaf-cp toutwaf-dp
sudo systemctl restart toutwaf-cp toutwaf-dp
sudo systemctl stop toutwaf-dp toutwaf-cp

Check the services

sudo systemctl status toutwaf-cp toutwaf-dp --no-pager
toutwafctl doctor
curl -kI https://127.0.0.1:9443/
curl -s http://127.0.0.1:9101/healthz
sudo journalctl -u toutwaf-dp -u toutwaf-cp -n 50 --no-pager

Upgrade

Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.

sudo mkdir -p /var/toutwaf.bak
sudo cp -a /var/toutwaf/conf /var/toutwaf/data /var/toutwaf.bak/
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --update --yes
curl -s http://127.0.0.1:9101/healthz

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
sudo bash install.sh --uninstall

sudo bash install.sh --uninstall --purge

Install prerequisites (apt)

sudo apt update && sudo apt -y upgrade
sudo apt -y install curl tar ca-certificates ufw

Install with the one-line installer

The script downloads the native binaries for your architecture, creates a dedicated unprivileged user and installs the hardened systemd services toutwaf-dp (data plane, ports 80 and 443) and toutwaf-cp (control plane and console, port 9443), then prints your first-login information.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash

Prefer to read the script first?

Download it, review it, then run it. Recommended for production servers.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
less install.sh
sudo bash install.sh

Installer options

A new installation lives in a single home, /var/toutwaf (bin, conf, data and logs; change it with --home DIR or TOUTWAF_HOME), and the command-line tools are linked in /usr/local/bin. An installation made earlier keeps its own paths (/etc/toutwaf, /var/lib/toutwaf) and is never moved.

# only let your admin network reach the console (port 9443)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --console-from 203.0.113.0/24

# do not touch the host firewall / choose the installation home
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --no-firewall
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --home /opt/toutwaf

# name the channel explicitly (the installer of the dev branch already takes the dev channel; no stable version exists yet)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --channel dev

Open the firewall (ufw)

The installer opens these ports by default when firewalld or ufw is active: 80 and 443, and the console port 9443 (restrict it to your admin network with --console-from). The agent port 9444 is never opened publicly. These commands are only needed with --no-firewall, with another firewall, or to do it by hand.

sudo ufw allow 80,443/tcp
sudo ufw allow from 203.0.113.0/24 to any port 9443 proto tcp
sudo ufw --force enable
sudo ufw status

Manage the services

Both services start at boot. Use these commands to start, stop or restart them.

sudo systemctl enable --now toutwaf-cp toutwaf-dp
sudo systemctl restart toutwaf-cp toutwaf-dp
sudo systemctl stop toutwaf-dp toutwaf-cp

Check the services

sudo systemctl status toutwaf-cp toutwaf-dp --no-pager
toutwafctl doctor
curl -kI https://127.0.0.1:9443/
curl -s http://127.0.0.1:9101/healthz
sudo journalctl -u toutwaf-dp -u toutwaf-cp -n 50 --no-pager

Upgrade

Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.

sudo mkdir -p /var/toutwaf.bak
sudo cp -a /var/toutwaf/conf /var/toutwaf/data /var/toutwaf.bak/
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --update --yes
curl -s http://127.0.0.1:9101/healthz

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
sudo bash install.sh --uninstall

sudo bash install.sh --uninstall --purge

Open PowerShell as Administrator and run the installer

Installs the native binaries, registers the ToutWAF Windows service for the data plane and a startup task for the console, and opens the firewall ports. The installer has not been run on a real Windows host yet.

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1 | iex

Open the firewall

The installer opens these ports by default when firewalld or ufw is active: 80 and 443, and the console port 9443 (restrict it to your admin network with --console-from). The agent port 9444 is never opened publicly. These commands are only needed with --no-firewall, with another firewall, or to do it by hand.

New-NetFirewallRule -DisplayName "ToutWAF Web" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow
New-NetFirewallRule -DisplayName "ToutWAF Console" -Direction Inbound -Protocol TCP -LocalPort 9443 -RemoteAddress 203.0.113.0/24 -Action Allow

Check the services

Get-Service ToutWAF
toutwafctl doctor
Test-NetConnection 127.0.0.1 -Port 9443

Upgrade

Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.

Copy-Item "$env:ProgramData\ToutWAF" "$env:ProgramData\ToutWAF.bak" -Recurse
& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Update -Yes

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall

& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall -Purge

Docker Compose on a Mac or Linux

Docker Compose on Linux or a Mac (Docker Desktop, OrbStack, Colima), with the all-in-one image (control plane and data plane). The files come with your ToutWAF distribution (the deploy folder, which is not in the public repository: that one holds binaries and installers only). The image packages prebuilt binaries per architecture (bin/amd64 or bin/arm64) and no image is published to a registry yet. Tested on Linux amd64 only; untested on a real Mac, where the client IP seen behind Docker Desktop is the Docker gateway address. The one-time credentials appear once in the control plane log.

cd deploy/docker
# bin/amd64/{toutwaf-cp,toutwaf-dp,toutwafctl}  (Intel Mac, Linux x86-64)
# bin/arm64/{toutwaf-cp,toutwaf-dp,toutwafctl}  (Apple Silicon, Linux ARM)
cp .env.example .env
docker compose up -d --build
docker compose logs toutwaf-cp

Upgrade (containers)

Take a backup first. The Update button of the console cannot work in a container: replace the binaries in the bin folder (or the image, once one is published) and rebuild; the volumes, so your data, are kept.

docker compose up -d --build

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

docker compose down

docker compose down -v

Install with Helm

Deploys the data plane as an ingress, with a control plane in the cluster if you want one. The chart and the manifests (sidecar mode included) are in the deploy folder of your ToutWAF distribution, not in the public repository, which holds binaries and installers only. The operator is CRDs and a skeleton.

helm install toutwaf ./deploy/helm/toutwaf --namespace toutwaf --create-namespace -f my-values.yaml

Check the pods and open the console

kubectl -n toutwaf get pods
kubectl -n toutwaf port-forward svc/toutwaf-cp 9443:9443

Upgrade (containers)

Take a backup first. The Update button of the console cannot work in a container: replace the binaries in the bin folder (or the image, once one is published) and rebuild; the volumes, so your data, are kept.

helm upgrade toutwaf ./deploy/helm/toutwaf --namespace toutwaf -f my-values.yaml

Uninstall

The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.

helm uninstall toutwaf --namespace toutwaf

kubectl delete namespace toutwaf