Debian / Ubuntu

Under review — wording may still change.

Install Warden on Debian or Ubuntu from the .deb package.

This is the Debian and Ubuntu path: over five short steps you download the .deb, install it with apt, free up port 53, then start Warden and confirm it’s blocking. Installing it changes nothing on its own — the service stays stopped until you start it, and your network isn’t filtered until you point it at this machine.

Requirements

Debian 13+ (Trixie) or Ubuntu 24.04+ (24.04 LTS or newer)
systemd
Architecture: amd64 (x86_64)
Root / sudo

The package needs only the standard C library (libc6) — no other dependencies to install. It requires glibc ≥ 2.39 (Ubuntu 24.04+, Debian 13+); support for older LTS releases (Ubuntu 22.04, Debian 12) is planned.

1. Download

Download the .deb for your architecture from the release page: {{TODO: release download link}}

amd64 (x86_64) — the available architecture today

(arm64 / ARM packages are planned for a later release.)

2. Install

bash

sudo apt install ./purge-warden_<version>_amd64.deb

Installing with apt (rather than dpkg -i) resolves the local file path and gives you clean upgrade/remove handling.

Warning

The package installs but does not start the service. This is deliberate: the box may already answer on port 53, and a DNS server going live unprompted is disruptive. You activate it in the next two steps.

What the install does: creates the purge-warden system user, installs the hardened systemd unit, and drops a working default config at /etc/purge-warden/config.toml (only if one isn’t already there) — so Warden filters out of the box once started.

3. Free port 53

Debian and Ubuntu run systemd-resolved, which listens on port 53. Hand port 53 to Warden by disabling only the stub listener (the system still resolves DNS normally through resolved):

bash
printf '[Resolve]\nDNSStubListener=no\n' | \
  sudo tee /etc/systemd/resolved.conf.d/purge-warden-no-stub.conf
sudo systemctl restart systemd-resolved

Info

Warden never edits your resolver configuration automatically — you run this step yourself, so nothing about your DNS changes without your say-so.

4. Enable + start

bash

sudo systemctl enable --now purge-warden

5. Verify

verify

$ dig @127.0.0.1 doubleclick.net # → 0.0.0.0 (blocked) $ dig @127.0.0.1 google.com # → real address (allowed)

Point your router’s or devices’ DNS at this machine’s IP to protect the whole network.

Upgrading

Install the newer .deb the same way. The running service is not restarted automatically — the old version keeps serving until you choose to restart:

bash

sudo systemctl restart purge-warden

Your config in /etc/purge-warden/config.toml is preserved across upgrades.

Removing

bash
sudo apt remove purge-warden    # remove the program, keep config + data
sudo apt purge  purge-warden    # remove everything, including config + data