Debian / Ubuntu

Under review — wording may still change.

Install Warden on Debian or Ubuntu with the bundle installer.

Warden has no .deb package and no apt repository. You install it with the same one-line command on every supported distribution. This page lists what is specific to Debian and Ubuntu. The full walk-through, including how to point your network at Warden, is the quick start.

one command

$ curl -fsSL https://get.purge.cc | sudo sh

x86_64 only. Run it on the machine that will run Warden.

A standard Debian install has no curl. Without it, the command prints curl: command not found, installs nothing, and still exits with status 0. Install curl first with sudo apt-get install curl, or download the script with wget, which Debian installs by default:

bash

wget -qO- https://get.purge.cc | sudo sh

Requirements

Debian 12 or newer, or Ubuntu 22.04 or newer. The bundle is for x86_64. On aarch64, including a Raspberry Pi with a 64-bit ARM system, the download fails and you build from source.
About 700 MB of RAM for the default lists, and about 1.4 GB for a few seconds at a list update. A Raspberry Pi or another small machine can run Warden only with a small set of lists: see Memory and list size.
systemd
bash, tar and sha256sum, and curl or wget to download the script. The script names a missing bash, tar or sha256sum, but it cannot start without curl or wget.
Root, or sudo
Internet access. The installer checks that it can resolve lists.purge.cc, the host the first start downloads the blocklists from, and it downloads the bundle.

The installer installs two packages for you with apt-get: ca-certificates and dnsutils (for dig).

What is specific to Debian and Ubuntu

Port 53. Ubuntu runs systemd-resolved, which holds port 53 on 127.0.0.53. The installer asks before it turns off only the stub listener (DNSStubListener=no in /etc/systemd/resolved.conf.d/purge-warden-no-stub.conf). With --yes it does so without asking. Without a terminal, --yes is required: otherwise the installer stops and changes nothing. The system keeps resolving through systemd-resolved and its upstream servers. If another service holds port 53, the installer stops and names it.
Firewall. Debian normally ships with no firewall enabled. If you run one, allow 53/tcp and 53/udp from your LAN yourself. The installer changes firewall rules only for firewalld on Fedora and RHEL.
No package manager entry. apt list --installed will not show Warden. The files are in /usr/local and the bundle is in /usr/local/lib/purge-warden.

If a `purge-warden` package is already installed

No purge-warden package is published. If you built one yourself and installed it, the bundle installer refuses to run, because the bundle’s files in /usr/local would shadow the package’s files in /usr. Remove the package first, then install. (To override the refusal, set PURGE_ALLOW_PACKAGE_OVERLAP=1. You then own the mixed result.)

bash
sudo apt-get purge purge-warden
curl -fsSL https://get.purge.cc | sudo sh

apt-get purge removes the package’s configuration too. Take a warden config backup first. There is no upgrade path for a host installed from a package.

Verify

verify

$ dig @127.0.0.1 doubleclick.net # → 0.0.0.0 (blocked) $ dig @127.0.0.1 google.com # → real address (allowed)

The installer runs these two checks itself and exits with status 5 if either fails. If the daemon is still loading its lists when the wait ends, it skips them and exits with status 3: see Installer exit statuses.

Upgrading

Run the bundle installer’s upgrade mode. It is not an apt operation:

bash

curl -fsSL https://get.purge.cc | sudo sh -s -- --upgrade

Without curl, run wget -qO- https://get.purge.cc | sudo sh -s -- --upgrade.

See Upgrade for what it checks, how it rolls back, and what to do after a failure.

Removing

bash
sudo /usr/local/lib/purge-warden/scripts/uninstall.sh            # keep config and data
sudo /usr/local/lib/purge-warden/scripts/uninstall.sh --purge    # also delete /etc/purge-warden, /var/lib/purge-warden and the user

Without --purge, the next install adopts the kept configuration: see Reinstall over a kept configuration. While a configuration change is unfinished, an uninstall without --purge refuses and removes nothing; with --purge it goes ahead. The quick start explains it.

Add --restore-resolved to put back the systemd-resolved stub listener. If the installer had pointed /etc/resolv.conf away from the stub, the uninstaller points it back, but only if the stub listens again right after the uninstaller restarts systemd-resolved. Otherwise it warns and leaves the file as it is. A regular file, or a relative link as your distribution writes it, is left alone. A link you wrote yourself to the absolute path /run/systemd/resolve/resolv.conf looks like the installer’s, so the uninstaller points it at the stub as well. The uninstaller leaves the bundle directory in place; delete /usr/local/lib/purge-warden yourself once you no longer need it.

The uninstaller asks you to confirm on your terminal. With no terminal (a script, or ssh without a tty), it stops with exit code 1 and removes nothing unless you add --yes.