2. Install Warda

Where to buy the hardware#

What to buy:

• a Raspberry Pi 5 or a Raspberry Pi 4 (the two models Warda supports);
• a microSD card: 16 GB at least; take a 32 GB card marked A1 or A2, from a known brand (SanDisk, Samsung, Kingston, or the official Raspberry Pi card). Buy it from the brand's own store, a Raspberry Pi reseller or a shop that sells it itself — not from an unknown seller of a marketplace: fake cards are common there;
• the official power supply: 27 W USB-C for a Raspberry Pi 5, 15 W USB-C for a Raspberry Pi 4 (a phone charger often causes random restarts);
• a case, with cooling (a fan or a heatsink) for a Raspberry Pi 5;
• a network cable long enough to reach your router.

Shops, checked on 11 October 2026 (prices and stock change; Warda has no affiliate link and earns nothing from these shops):

• United Kingdom: Raspberry Pi Direct (the official store), The Pi Hut, Pimoroni, Rapid Electronics, CPC.
• Ireland: SG Education, Farnell Ireland, The Pi Hut (from the UK: check customs and VAT), Kiwi Electronics (from the Netherlands), Harvey Norman (cards).
• United States: Adafruit, CanaKit, PiShop.us, Micro Center, SparkFun.
• Canada: CanaKit, PiShop.ca, Digi-Key, Best Buy Canada and Amazon.ca (cards, sold by Amazon itself).

Other countries, and what each shop sells: Where to buy the hardware.

With a Raspberry Pi (recommended)#

You need a Raspberry Pi 4 (or later), its power supply, a microSD card of 16 GB or more and a network cable.

The screenshots of this section come from Raspberry Pi Imager 2.0.11 with its interface in French, on Windows: the words in parentheses are its French labels. Those of the steps below show Warda 0.7.8: Imager offers the current version.

1. Install Raspberry Pi Imager (2.0.2 or later) on your computer. On the releases page, download the file warda.rpi-imager-manifest and open it (double-click): Imager starts with Warda in its list of systems. First step (Appareil): choose your Raspberry, Raspberry Pi 5 or Raspberry Pi 4 (the manifest gives Imager these two models, the only ones listed), then go on with the button at the bottom right (SUIVANT).

   

   

2. Second step (OS): choose Warda <version>, at the top of the list. Imager downloads the image by itself and checks its fingerprint. With the image .img.xz chosen through the custom image (Utiliser image personnalisée), Imager does not offer the customisation.

   

3. Third step (Stockage): choose your microSD card. Leave the box that leaves out the system disks ticked (Exclure les disques système): the disks of your computer are not listed.

   

4. The customisation (Personnalisation) begins with the hostname (Nom d'hôte): give the Raspberry a name on your network, for instance warda-lab (letters, digits and hyphens only).

   

5. Location (Localisation): choose your capital city, your time zone and your keyboard (Ville capitale, Fuseau horaire, Type de clavier).

   

6. User (Utilisateur): create your user, with its user name (Nom d'utilisateur) and its password, typed twice (Mot de passe, Confirmer le mot de passe).

   

7. Wi-Fi (Wi-Fi): leave everything empty and go on (SUIVANT): Warda is plugged in with a network cable.

   

8. Remote access (Accès à distance): to be able to help from afar, turn SSH on (Activer SSH), choose the public-key authentication (Utiliser l'authentification par clé publique) and paste your public key. Warda refuses passwords over SSH: with a password alone, SSH will refuse the connection.

   

9. Imager shows the summary (Écriture): the Raspberry model, the system and the card, then the customisations it is going to apply (Personnalisation à appliquer). Check them, then start the writing (ÉCRIRE).

   

   

10. Imager warns that everything on the card is about to be erased, for good. Check that it names your card, then confirm (JE COMPRENDS, EFFACER ET ÉCRIRE).

    

11. Imager writes the image: do not unplug the card.

    

12. Then it checks what it wrote: let it finish.

    

13. When everything is done (Écriture terminée !), Imager lists the customisations applied and has ejected the card: take it out, then close Imager (TERMINER). Put the card in the Raspberry, plug it into your router with the network cable, then plug the power in. The first start takes a few minutes.

    

    

With the image file, without the manifest. The other way to write the card: download the image warda_<version>_raspberrypi-arm64.img.xz from the releases page and give that file to Imager yourself. The two ways differ in one thing: with the image file Imager has no customisation step, while the manifest lets Imager set the hostname, the user, the Wi-Fi and SSH before it writes. The screenshots show an older file, already decompressed (warda_0.6.9_raspberrypi-arm64.img): take the file of the current release.

1. First step (Appareil): choose your Raspberry model, Raspberry Pi 5 or Raspberry Pi 4, then go on with the button at the bottom right (SUIVANT).

   

   

2. Second step (OS): go down to the end of the list and choose its last entry, the custom image (Utiliser image personnalisée), then pick the file of Warda you downloaded.

   

3. Third step (Stockage): choose your microSD card. Leave the box that leaves out the system disks ticked (Exclure les disques système): the disks of your computer are not listed.

   

4. The customisation step (Personnalisation) stays grey: Imager skips it and shows the summary (Écriture). Check the Raspberry model, the file and the card, then start the writing (ÉCRIRE).

   

   

5. Imager warns that everything on the card is about to be erased, for good. Check that it names your card, then confirm (JE COMPRENDS, EFFACER ET ÉCRIRE).

   

6. Imager writes the image: do not unplug the card.

   

7. Then it checks what it wrote: let it finish.

   

8. When everything is done (Écriture terminée !), Imager has ejected the card: take it out, then close Imager (TERMINER).

   

   

Then go on as in the last step of the first way: the card in the Raspberry, the network cable, the power.

On a Debian or Ubuntu machine#

Download the package of your machine (amd64 for a PC, arm64 for a Raspberry Pi already installed), then:

sudo apt install ./warda_<version>_amd64.deb

Ports 53, 80 and 443 must be free: first stop another Pi-hole, dnsmasq or web server on the same machine.

On Fedora, RHEL, Rocky Linux or AlmaLinux#

Download the rpm package of your machine (x86_64 for a PC, aarch64 for an ARM machine), then:

sudo dnf install ./warda-<version>-1.x86_64.rpm

The package opens the ports of Warda in firewalld (service warda), and Warda updates itself as with the Debian package. Ports 53, 80 and 443 must be free: on Fedora, systemd-resolved often holds port 53; write DNSStubListener=no in /etc/systemd/resolved.conf, then run sudo systemctl restart systemd-resolved.

With Docker#

On a Raspberry Pi 4 or later with a 64-bit system, or on any 64-bit machine (PC or ARM) with Docker and its Compose plugin. Each release of Warda comes with a ready docker-compose.yml that installs that version. In an empty folder:

curl -fsSLO https://github.com/warda-dns/Releases/releases/latest/download/docker-compose.yml
docker compose up -d

The same file is also at the root of the repository of the releases: always the one of the latest version.

Warda uses the network of the machine directly: ports 53 (DNS), 80 and 443 (web interface) must be free.

A reverse proxy (Traefik, nginx, Caddy) or a NAS already uses ports 80 and 443? Before docker compose up -d, change these two lines of docker-compose.yml (under environment:), then open Warda at http://<address of the machine>:8080:

      WARDA_HTTP_LISTEN: ":8080"
      WARDA_HTTPS_LISTEN: ":8443"

Port 53 is taken? It cannot move: the devices only ask that port. Stop the other DNS server (Pi-hole, AdGuard Home, dnsmasq). On Debian or Ubuntu it is often systemd-resolved: write DNSStubListener=no in /etc/systemd/resolved.conf, then run sudo systemctl restart systemd-resolved.

Then:

docker logs warda
docker exec warda warda setup-info

The first command shows the address to open (with its port), the second the default password. If a port is already in use, Warda stops and its log names the port, the program that probably holds it and the line of the file to change; Docker starts it again, about once a minute, until the port is free. The log of the container stays small (3 files of 10 MB).

To update, write the new version number in the line image: of the file, then:

docker compose pull && docker compose up -d

Downloading the file of the new release again works too, but it replaces the ports you changed. Moving ports 80 and 443 only shares the machine with your reverse proxy: never publish Warda on the Internet through it (chapter 12).

First sign-in#

1. From a computer of the network, open http://warda (or http://ADDRESS-OF-THE-BOX). The certificate is self-signed: accept it once.
2. Sign in within the hour after the start with the account admin and the default password Ward@-MM-YYYY, where MM-YYYY is the month of the version (for example Ward@-09-2026). Past that, unplug the box and plug it back. This password is public: until the box is installed, anyone on your network could install it in your place. Install it right after its first start, from a computer of your own network (chapter 12).
3. The installation assistant opens, one step at a time: the terms of use to read and accept (a summary, and the link to the full text; the anonymous daily count is shown there too, on, and you can uncheck it), a new password for admin (the emergency account: keep it somewhere safe), your own account, then your box (chapter 3) and your household (chapter 4).

Later, once the box has its name and a certificate the browsers trust (chapter 3), http://warda leads by itself to https:// followed by that name, and the browser no longer shows a warning (from Warda 0.7.10).

Replacing an old box? On the first screen of the assistant, I have a backup of Warda brings back all your accounts and settings (chapter 6).

At the step of the network, the assistant also shows the country of the box and, when the time zone of the box differs from that of your browser, offers Use Europe/Paris (your zone): the hours of Internet and the reports follow the time of the box. The Raspberry Pi image starts on UTC: set it here.