Everything Warda records stays in its data directory (/var/lib/warda):
| File | Content |
|---|---|
warda.db (with -wal, -shm) |
Journal, devices, rules, suggestions, administration log — encrypted (Adiantum, 256-bit key) |
warda.key |
Database key |
api.token |
API token |
api.sock |
Socket of the warda commands (service user and root only) |
https.crt, https.key |
Self-signed certificate of the web interface and API |
schema-version |
Schema of the database (for the rollback of an upgrade) |
update-request, update-status.json |
Update asked from the web interface, and the last result of the updater |
backups/, backup-usb-status.json |
Nightly backups (encrypted), and the last copy to a USB drive |
tls/ |
Certificate and key of the encrypted DNS (dns.crt, dns.key; dns.pending while a new pair is installed), key of the ACME account, key of the box at the online service |
system-request |
Restart or power off of the box asked from the web interface |
lists/ |
Copies of the downloaded lists |
The key sits next to the database: encryption protects a copied database or
a backup, not a stolen storage card. Back up with the service stopped, and
keep warda.key with warda.db: without it the database cannot be read.
The observation periods count the time Warda has been running, not the date: a Raspberry Pi has no clock of its own and may start with a wrong one.
The administration API (/api/v1/…) is only served over HTTPS, with a
session of the web interface (cookie restricted to the site, CSRF token,
origin check, 2 hours idle and 12 hours at most), the token
(Authorization: Bearer), or through api.sock for the warda commands:
no password or token crosses the network in clear. warda token prints
the token and the certificate fingerprint to check from another machine;
warda token -rotate replaces the token. Every change is written to the
administration log, and so is the first refused token of each address
(then at most once every 10 minutes).
/healthz and /api/v1/stats need no sign-in (port 80, and the HTTPS
port). They give states and counts only, never the addresses of the lists
or of the upstreams (a path may carry a token or an account). /healthz:
status, version, uptime_seconds, dns_listening, upstream
(last, the scheme and host of the upstream used last, and encrypted),
blocklist (sources and failing, numbers of lists, last_refresh,
domains), cache_entries and journal (enabled, written, dropped,
failed). /api/v1/stats: queries, blocked, cache_hits,
forwarded, local_answers, upstream_errors, dropped, validated,
dot, doh, doq. They answer only a request that names the box
(warda, warda.<local domain>, the name of the machine, with or without
the local domain, localhost) or an IP address, else 403: a page of another
site that makes its name point to the box cannot read them. A member gets
the same service in GET /api/v1/system.
/wpad.dat and /proxy.pac need no sign-in either, on the plain HTTP
port, and only while the proxy auto-configuration is on (see
Proxy auto-configuration (WPAD)). What
the box sends to the Internet is listed in
Terms of use and anonymous statistics.