Warda-DNSDocs Warda: from ward — to protect, guardian
v0.9.3
Menu

Raspberry Pi image

For a Raspberry Pi 4 or later, the release page has a ready image, warda_<version>_raspberrypi-arm64.img.xz: Raspberry Pi OS Lite (64-bit) with Warda installed at the first start. What to buy (a Raspberry Pi 5 or 4, a microSD card of 32 GB A1 or A2, the official power supply, a case cooled for the Pi 5, a network cable) and shops by country, without any affiliate link: Where to buy the hardware.

  1. Install Raspberry Pi Imager 2.0.2 or later, download warda.rpi-imager-manifest from the same release page and open it (double-click): Imager starts with Warda <version> in its list of systems, downloads the image and checks it. Write it to a card of 16 GB or more. Imager 2.x only offers its customisation for an image listed in a manifest (not for "Use custom"): create your user and, for a shell on the Raspberry, turn SSH on with "Allow public-key authentication only" and your public key: the image refuses SSH passwords and root. The release job of the CI writes the manifest (.gitea/scripts/imager-manifest.sh TAG IMAGE REPOSITORY [SERVER], init_format cloudinit-rpi) and lists it in the signed SHA256SUMS. From 0.7.8 the manifest names the image of the release of GitHub (https://github.com/warda-dns/Releases/releases/download/<tag>/<file>), no longer the one of Gitea: one manifest for both release pages. From 0.7.9 it also holds the boards of the first step of Imager (imager.devices: Raspberry Pi 5 and Raspberry Pi 4, their tags those of the image) and the icon of the image: Imager 2 fills that step from the manifest alone, and with the manifests up to 0.7.8 its list of boards stayed empty and the wizard could not go on.
  2. Plug the Raspberry into your box with a network cable and power it on. The first start takes a few minutes (the system grows to the whole card, then installs Warda).
  3. Give the Raspberry a fixed address in your box (DHCP reservation), then open http://ADDRESS-OF-THE-RASPBERRY within 60 minutes after it starts. Install it as soon as it has started, from a computer of your own network: until the first account exists, anyone on the network who knows the default password of the version (public) can do it in your place (see Misuse and how Warda prevents it).

The image is on UTC (/etc/timezone Etc/UTC, checked by the build), no longer on the Europe/London of Raspberry Pi OS, which gave the boxes of 0.6.7 and before the country United Kingdom: the country now comes from the online service of Warda (see Country of the installation), and the installation assistant offers the time zone of the browser (Raspberry Pi Imager may also set one). The image turns on the hardware watchdog of the Raspberry: a system that hangs restarts by itself. Its name on the network is warda. The system updates itself (unattended-upgrades, installed as soon as the network is up): security updates of Debian, and updates of Raspberry Pi OS (kernel, firmware), with a restart at 05:30 only when an update needs one; the System page also lists every other update of the system and installs them on request (see Updates of the system). SSH takes keys only (/etc/ssh/sshd_config.d/10-warda.conf), and fail2ban bans the addresses that keep failing, longer each time: the SSH port can be opened on the box of a household you help from afar.