Everything Warda records stays in its data directory (/var/lib/warda):
| File | Content |
|---|---|
warda.db (with -wal, -shm) |
Journal, devices, rules, suggestions, administration log, and from 0.8.0 the hashes of the secrets of the devices protected outside the home, the addresses watched for breaches and the breaches found, the restricted mode of the objects and their names, the state of the exposure — encrypted (Adiantum, 256-bit key) |
warda.key |
Database key |
api.token |
API token |
api.sock |
Socket of the warda commands (service user and root only) |
https.crt, https.key |
Self-signed certificate of the web interface and API |
schema-version |
Schema of the database (for the rollback of an upgrade) |
machine-history.json |
From 0.7.10: the last hour of the load and of the network card of the box (the charts of the dashboard), written every 5 minutes and at the stop |
update-request, update-status.json |
Update asked from the web interface, and the last result of the updater |
backups/, backup-usb-status.json |
Nightly backups (encrypted), and the last copy to a USB drive |
tls/ |
Certificate and key of the encrypted DNS (dns.crt, dns.key; dns.pending while a new pair is installed), key of the ACME account, key of the box at the online service |
system-request |
Restart or power off of the box, keepalived to set, or a check or an installation of the updates of the system (Raspberry Pi image: os-check, os-upgrade), asked from the web interface |
os-update-status.json |
Raspberry Pi image: the last check or installation of the updates of the system (written by root) |
keepalived.json, keepalived.conf, keepalived-status.json, ha-state.json, ha-sync-pending.json |
High availability: the parameters of keepalived, its configuration (Docker, and the page), the result of its last change, the state of VRRP told by keepalived, a configuration of the primary waiting for the next start |
lists/ |
Copies of the downloaded lists |
blockca/ |
From 0.8.3: the local certificate authority of the block page, ca.crt and its key ca.key (0600, readable by Warda only); made on first use, never in a backup, made again by Make a new authority |
The key sits next to the database: encryption protects a copied database or
a backup, not a stolen storage card. Back up with the service stopped, and
keep warda.key with warda.db: without it the database cannot be read.
The observation periods count the time Warda has been running, not the date: a Raspberry Pi has no clock of its own and may start with a wrong one.
The administration API (/api/v1/…) is only served over HTTPS, with a
session of the web interface (cookie restricted to the site, CSRF token,
origin check, 2 hours idle and 12 hours at most), the token
(Authorization: Bearer), or through api.sock for the warda commands:
no password or token crosses the network in clear. warda token prints
the token and the certificate fingerprint to check from another machine;
warda token -rotate replaces the token. Every change is written to the
administration log, and so is the first refused token of each address
(then at most once every 10 minutes).
/healthz and /api/v1/stats need no sign-in (port 80, and the HTTPS
port). They give states and counts only, never the addresses of the lists
or of the upstreams (a path may carry a token or an account). /healthz:
status, version, uptime_seconds, dns_listening, upstream
(last, the scheme and host of the upstream used last, and encrypted),
blocklist (sources and failing, numbers of lists, last_refresh,
domains; never names nor generated, which GET /api/v1/system
alone gives from 0.7.11, see Lists), cache_entries and
journal (enabled, written, dropped, failed). /api/v1/stats: queries, blocked, cache_hits,
forwarded, local_answers, upstream_errors, dropped, validated,
dot, doh, doq. They answer only a request that names the box
(warda, warda.<local domain>, the name of the machine, with or without
the local domain, localhost) or an IP address, else 403: a page of another
site that makes its name point to the box cannot read them. A member gets
the same service in GET /api/v1/system, with, from 0.7.11, names
and generated in its blocklist.
/wpad.dat and /proxy.pac need no sign-in either, on the plain HTTP
port, and only while the proxy auto-configuration is on (see
Proxy auto-configuration (WPAD)).
From 0.8.3, the block page and the certificate page need no
sign-in: the block page answers only a request for a name blocked lately
(its Host or its SNI), never the interface; it tells the reason only to
the device the block was decided for (from 0.8.5 at any of its addresses,
matched by the registry of the box), and nothing that names another
member. Its unblock request (from 0.8.5, POST /.warda/unblock on the
blocked name) needs no sign-in either: a token signed by the box bound to
the name and the address, refused from another site, 3 requests in a
moment per address and 10 a day per device. The certificate page (/certificate, its files
/certificate/<file> and GET /api/v1/certificate) answers only a
request that names the box or an address, from the networks allowed; it
gives the certificate of the authority and its fingerprint, never its
key. Both are rate limited by address (from 0.8.4: the block pages 2 a
second, burst 30, then a small fixed page; any other request for a
blocked name an empty answer, 200 a second, burst 400; the certificate
page 5 a second, burst 20; see Block page). The
decisions behind the block page are kept in memory only (10 minutes,
8,192 at most), never the names of the confidential lists. What
the box sends to the Internet is listed in
Terms of use and anonymous statistics.