Offline
Install in a closed network: bring the archives and check their checksum, install from the local archive, import the definitions with a signed bundle, import your certificates.
A versão que instala
A versão pública é uma versão de desenvolvimento, chamada 0.3.0-dev. O nome não muda: cada publicação substitui a anterior e um identificador de compilação distingue duas compilações. Ainda não existe nenhuma versão estável: só será publicada quando cada sistema e cada pacote tiverem sido testados de ponta a ponta. Por isso, os comandos desta página instalam a partir do canal dev. Uma versão de desenvolvimento pode conter erros: experimente-a num site de teste antes de depender dela.
At a glance
- Nothing in ToutWAF needs Internet access at run time except the optional rule feeds and ACME.
- On a connected machine, download the archive of your channel for your architecture, the checksum file (and its signature when present) and install.sh (install.ps1 on Windows), check the checksum, then transfer.
- The --tarball option skips every download, and therefore the checksum step: verify it yourself first. You can also host an internal mirror with the same layout and pass --base-url.
- The definitions (CRS, KEV, FireHOL, Spamhaus DROP, Tor exits, DB-IP country data, bad user agents) are imported with a signed offline bundle, checked by hash and signature, with rollback possible.
The commands, step by step
Bring the archives and check the checksum
From the release folder of your channel in the public repository, fetch toutwaf-linux-
sha256sum -c --ignore-missing SHA256SUMSInstall from the local archive
No download: everything comes from the file. On Windows use -ZipPath (or -BaseUrl for a mirror).
sudo bash install.sh --tarball ./toutwaf-linux-amd64.tar.gz --component all --yessudo bash install.sh --base-url https://mirror.internal/toutwaf --version <version> --yes.\install.ps1 -ZipPath .\toutwaf-windows-amd64.zipDefinitions without Internet
In toutwaf-cp.yaml, switch downloading off; export a signed bundle from a connected control plane then import it into the isolated control plane (console or API).
updater:
offline_only: trueCertificates from an internal authority
Console: Certificates > Import (PEM certificate and key), or drop the files into the data plane's certs_dir then reload it.
sudo systemctl reload toutwaf-dpWhat is not verified
We prefer to say it plainly.
- ACME needs outbound access to the authority (and inbound port 80 for HTTP-01): in a closed network import certificates from an internal authority; a private ACME authority works with acme.ca_file or acme.ca_bundle.
- The AI assistant must be set to ai.provider: offline to make no external call.
- Container images are transferred with docker save and docker load, or through a mirror of your registry; this full procedure has not been tried in a real isolated network.