离线安装
Install in a closed network: bring the archives and check their checksum, install from the local archive, import the definitions with a signed bundle, import your certificates.
您安装的是哪个版本
目前公开的是名为 0.3.0-dev 的开发版。名称保持不变：每次发布都会替换上一次，并用构建编号区分两个构建。尚无稳定版：只有在每个系统和每个软件包都完成端到端测试之后，才会发布稳定版。因此本页的命令从 dev 通道安装。开发版可能存在缺陷：在依赖它之前，请先在测试站点上试用。
At a glance
- Nothing in ToutWAF needs Internet access at run time except the optional rule feeds and ACME.
- On a connected machine, download the archive of your channel for your architecture, the checksum file (and its signature when present) and install.sh (install.ps1 on Windows), check the checksum, then transfer.
- The --tarball option skips every download, and therefore the checksum step: verify it yourself first. You can also host an internal mirror with the same layout and pass --base-url.
- The definitions (CRS, KEV, FireHOL, Spamhaus DROP, Tor exits, DB-IP country data, bad user agents) are imported with a signed offline bundle, checked by hash and signature, with rollback possible.
The commands, step by step
Bring the archives and check the checksum
From the release folder of your channel in the public repository, fetch toutwaf-linux-
sha256sum -c --ignore-missing SHA256SUMSInstall from the local archive
No download: everything comes from the file. On Windows use -ZipPath (or -BaseUrl for a mirror).
sudo bash install.sh --tarball ./toutwaf-linux-amd64.tar.gz --component all --yessudo bash install.sh --base-url https://mirror.internal/toutwaf --version <version> --yes.\install.ps1 -ZipPath .\toutwaf-windows-amd64.zipDefinitions without Internet
In toutwaf-cp.yaml, switch downloading off; export a signed bundle from a connected control plane then import it into the isolated control plane (console or API).
updater:
offline_only: trueCertificates from an internal authority
Console: Certificates > Import (PEM certificate and key), or drop the files into the data plane's certs_dir then reload it.
sudo systemctl reload toutwaf-dpWhat is not verified
We prefer to say it plainly.
- ACME needs outbound access to the authority (and inbound port 80 for HTTP-01): in a closed network import certificates from an internal authority; a private ACME authority works with acme.ca_file or acme.ca_bundle.
- The AI assistant must be set to ai.provider: offline to make no external call.
- Container images are transferred with docker save and docker load, or through a mirror of your registry; this full procedure has not been tried in a real isolated network.