Install ToutWAF offline
Install in a closed network: bring the archives and check their checksum, install from the local archive, import the definitions with a signed bundle, import your certificates.
Which version you install
The public version is a development version, named 0.3.0-dev. Its name stays the same: each publication replaces the previous one, and a build identifier tells two builds apart. No stable version exists yet: it will only be published once every system and package has been tested end to end. The commands on this page therefore install from the dev channel. A development version can contain bugs: try it on a test site before relying on it.
At a glance
- Nothing in ToutWAF needs Internet access at run time except the optional rule feeds and ACME.
- On a connected machine, download the archive of your channel for your architecture, the checksum file (and its signature when present) and install.sh (install.ps1 on Windows), check the checksum, then transfer.
- The --tarball option skips every download, and therefore the checksum step: verify it yourself first. You can also host an internal mirror with the same layout and pass --base-url.
- The definitions (CRS, KEV, FireHOL, Spamhaus DROP, Tor exits, DB-IP country data, bad user agents) are imported with a signed offline bundle, checked by hash and signature, with rollback possible.
The commands, step by step
Bring the archives and check the checksum
From the release folder of your channel in the public repository, fetch toutwaf-linux-
sha256sum -c --ignore-missing SHA256SUMSInstall from the local archive
No download: everything comes from the file. On Windows use -ZipPath (or -BaseUrl for a mirror).
sudo bash install.sh --tarball ./toutwaf-linux-amd64.tar.gz --component all --yessudo bash install.sh --base-url https://mirror.internal/toutwaf --version <version> --yes.\install.ps1 -ZipPath .\toutwaf-windows-amd64.zipDefinitions without Internet
In toutwaf-cp.yaml, switch downloading off; export a signed bundle from a connected control plane then import it into the isolated control plane (console or API).
updater:
offline_only: trueCertificates from an internal authority
Console: Certificates > Import (PEM certificate and key), or drop the files into the data plane's certs_dir then reload it.
sudo systemctl reload toutwaf-dpWhat is not verified
We prefer to say it plainly.
- ACME needs outbound access to the authority (and inbound port 80 for HTTP-01): in a closed network import certificates from an internal authority; a private ACME authority works with acme.ca_file or acme.ca_bundle.
- The AI assistant must be set to ai.provider: offline to make no external call.
- Container images are transferred with docker save and docker load, or through a mirror of your registry; this full procedure has not been tried in a real isolated network.