Offline
Install in a closed network: bring the archives and check their checksum, install from the local archive, import the definitions with a signed bundle, import your certificates.
Quale versione installi
La versione pubblica è una versione di sviluppo, chiamata 0.3.0-dev. Il suo nome non cambia: ogni pubblicazione sostituisce la precedente e un identificativo di build distingue due build. Non esiste ancora una versione stabile: sarà pubblicata solo quando ogni sistema e ogni pacchetto saranno stati testati end to end. I comandi di questa pagina installano quindi dal canale dev. Una versione di sviluppo può contenere difetti: provala su un sito di prova prima di farci affidamento.
At a glance
- Nothing in ToutWAF needs Internet access at run time except the optional rule feeds and ACME.
- On a connected machine, download the archive of your channel for your architecture, the checksum file (and its signature when present) and install.sh (install.ps1 on Windows), check the checksum, then transfer.
- The --tarball option skips every download, and therefore the checksum step: verify it yourself first. You can also host an internal mirror with the same layout and pass --base-url.
- The definitions (CRS, KEV, FireHOL, Spamhaus DROP, Tor exits, DB-IP country data, bad user agents) are imported with a signed offline bundle, checked by hash and signature, with rollback possible.
The commands, step by step
Bring the archives and check the checksum
From the release folder of your channel in the public repository, fetch toutwaf-linux-
sha256sum -c --ignore-missing SHA256SUMSInstall from the local archive
No download: everything comes from the file. On Windows use -ZipPath (or -BaseUrl for a mirror).
sudo bash install.sh --tarball ./toutwaf-linux-amd64.tar.gz --component all --yessudo bash install.sh --base-url https://mirror.internal/toutwaf --version <version> --yes.\install.ps1 -ZipPath .\toutwaf-windows-amd64.zipDefinitions without Internet
In toutwaf-cp.yaml, switch downloading off; export a signed bundle from a connected control plane then import it into the isolated control plane (console or API).
updater:
offline_only: trueCertificates from an internal authority
Console: Certificates > Import (PEM certificate and key), or drop the files into the data plane's certs_dir then reload it.
sudo systemctl reload toutwaf-dpWhat is not verified
We prefer to say it plainly.
- ACME needs outbound access to the authority (and inbound port 80 for HTTP-01): in a closed network import certificates from an internal authority; a private ACME authority works with acme.ca_file or acme.ca_bundle.
- The AI assistant must be set to ai.provider: offline to make no external call.
- Container images are transferred with docker save and docker load, or through a mirror of your registry; this full procedure has not been tried in a real isolated network.