ToutWAF requirements
Supported systems, ports, privileges and dependencies: what the installers check, install or expect, and what each component needs. Read it before you plan an installation.
Which version you install
The public version is a development version, named 0.3.0-dev. Its name stays the same: each publication replaces the previous one, and a build identifier tells two builds apart. No stable version exists yet: it will only be published once every system and package has been tested end to end. The commands on this page therefore install from the dev channel. A development version can contain bugs: try it on a test site before relying on it.
At a glance
- A 64-bit server (amd64 or arm64) running Linux (systemd 239+, glibc 2.28+, kernel 4.18+) or Windows, with root or administrator rights.
- Ports: 80 and 443 (web traffic), 9443 (console, restrict it to your admin network), 9444 (API used by nodes and agents: open it only from your own servers), 127.0.0.1:9101 (local health). UDP 443 stays closed: HTTP/3 is not implemented.
- No runtime to install: self-contained binaries, data in SQLite, no database server.
- The installer checks free disk space, DNS and the clock; memory is not checked.
Requirements and dependencies
What your server needs, what the installer adds, and what stays optional.
Supported systems
Linux with systemd 239 or newer and glibc 2.28 or newer, on amd64 or arm64: AlmaLinux, Rocky Linux, RHEL and Oracle Linux 8 to 10, CentOS Stream, Fedora, Amazon Linux 2023, Debian 11 to 13, Ubuntu 20.04 to 26.04, openSUSE and Arch (full table below). Windows 10, 11 and Server 2016 to 2025 (not yet run on a real Windows host). The installer checks your system before changing anything. Servers you add from the console: the host agent exists for Linux (amd64, arm64) and Windows (amd64).
Network ports
80 and 443: web traffic (data plane). 9443: console (change it with --cp-port). 9444: API used by data-plane nodes and server agents; the installer does not open it, allow it only from your own servers. 127.0.0.1:9101: local health endpoint. UDP 443 stays closed (HTTP/3 is not implemented). Server agents only make outbound connections to port 9444.
What the installer does
Needs root or administrator rights and outbound HTTPS to download the release. Installs curl, tar and libcap if they are missing (and policycoreutils-python-utils on SELinux systems), creates an unprivileged toutwaf user and one installation home (/var/toutwaf with bin, conf, data and logs; --home DIR changes it, and an older installation keeps its paths), installs hardened systemd services (Windows services on Windows), lets the data plane bind ports 80 and 443 without root, opens the firewall by default when firewalld or ufw is active (80, 443 and the console port; --console-from restricts the console, --no-firewall opts out), labels files for SELinux and checks SHA-256 sums.
Installer language
English by default; the installer detects the system language. Force one with --fr --de --es --it --pt --nl --ru --zh --ar or --en (Windows: -Fr and so on, or the TOUTWAF_LANG variable).
Self-contained binaries
The data plane is written in Rust, the control plane and the agent in Go, and the console is embedded in the control plane. No Python, Node.js or Java runtime and no database server to install: data is stored in SQLite. The Rust data plane needs glibc 2.28 or newer. Main third-party components: tokio, hyper and rustls (Rust), Svelte and xterm.js (console).
Optional components
ClamAV for antivirus scans on Linux hosts (the console can install it for you); Microsoft Defender on Windows. openssl only if you enable release-signature checks, and cosign only if you want it to verify signatures. Docker is not required: the Docker and Kubernetes manifests are alternative ways to deploy.
ToutPanel (web hosting server)
Installed from the console over SSH, or with its own installer. Linux: Debian 11 to 13, Ubuntu 20.04 to 24.04, AlmaLinux, Rocky Linux and RHEL 9 and 10, Fedora 40 and later. Windows 10 and 11, Windows Server 2016 to 2025. Needs root and bash (Linux) or an elevated PowerShell 5.1+ (Windows), Python 3.9 to 3.14 (installed by its script when the distribution provides it), 1 GB of RAM at least (2 GB recommended with MariaDB and PHP), 2 GB of free disk plus your sites, and outbound HTTPS. Its panel listens on port 8888 by default; ports 80 and 443 serve the sites. Source: the ToutPanel README.
ToutWAF does not publish minimum CPU, RAM or disk figures yet: size your server with a test on your own traffic.
Supported systems
Checked by the installer before it changes anything. The statuses come from the installer's own data.
- tested The full container install test passed on this exact version.
- expected Same family, recent enough glibc and systemd, but the full test was not run.
- unsupported Refused before any change (override at your own risk with --skip-os-check).
| Distribution | Versions |
|---|---|
| AlmaLinux | 10tested9tested8tested |
| Rocky Linux | 10tested9tested8tested |
| Red Hat Enterprise Linux | 10tested9tested8tested7unsupported |
| CentOS Stream | 10tested9tested8unsupported7unsupported |
| Oracle Linux | 10tested9tested8tested7unsupported |
| Fedora | 44tested43tested42tested41tested |
| Amazon Linux | 2023tested2unsupported |
| Debian | 13tested12tested11tested10unsupported |
| Ubuntu | 26.04tested25.10tested24.04tested22.04tested20.04tested18.04unsupported |
| Linux Mint / LMDE | all versionsexpected |
| Pop!_OS | all versionsexpected |
| Zorin OS | all versionsexpected |
| elementary OS | all versionsexpected |
| Kali Linux | rollingexpected |
| Raspberry Pi OS (32-bit, Raspbian) | all versionsunsupported |
| Devuan | all versionsunsupported |
| openSUSE Leap | 16.0tested15.6tested |
| openSUSE Tumbleweed | rollingtested |
| openSUSE Slowroll | rollingexpected |
| SUSE Linux Enterprise Server | 16.0expected15.7expected15.6expected |
| SUSE Linux Micro / MicroOS / Aeon | all versionsunsupported |
| openSUSE MicroOS / Aeon / Kalpa | all versionsunsupported |
| Arch Linux | rollingtested |
| Manjaro | rollingexpected |
| EndeavourOS | rollingexpected |
| Garuda Linux | rollingexpected |
| CachyOS | rollingexpected |
| Artix Linux | all versionsunsupported |
| Alpine Linux | all versionsunsupported |
| Void Linux | all versionsunsupported |
| NixOS | all versionsunsupported |
| Windows | Windows 11expectedWindows 10expectedWindows Server 2025expectedWindows Server 2022expectedWindows Server 2019expectedWindows Server 2016expected |
What is not verified
We prefer to say it plainly.
- ToutWAF does not publish minimum CPU, RAM or disk figures yet: size your server with a test on your own traffic.
- The “tested” and “expected” statuses of the table mean: full installation passed in a container with systemd, or same family without that test. Windows is “expected” everywhere.