Fedora

Under review — wording may still change.

Install Warden on Fedora from the .rpm package.

This is the Fedora path: over five short steps you download the .rpm, install it with dnf, free up port 53, then start Warden and confirm it’s blocking. Installing it changes nothing on its own — the service stays stopped until you start it, and your network isn’t filtered until you point it at this machine.

Requirements

Fedora 40 or newer (glibc 2.39+)
systemd
Architecture: x86_64
Root / sudo

The package needs only the standard C library (glibc) — no other dependencies to install. It requires glibc ≥ 2.39 (Fedora 40+); every current Fedora release satisfies this.

1. Download

Download the .rpm for your architecture from the release page: {{TODO: release download link}}

x86_64 — the available architecture today

(aarch64 / ARM packages are planned for a later release.)

2. Install

bash

sudo dnf install ./purge-warden-<version>.x86_64.rpm

Warning

The package installs but does not start the service. This is deliberate: the box may already answer on port 53, and a DNS server going live unprompted is disruptive. You activate it in the next steps.

What the install does: creates the purge-warden system user, installs the hardened systemd unit, and drops a working default config at /etc/purge-warden/config.toml (only if one isn’t already there) — so Warden filters out of the box once started.

3. Free port 53 (if needed)

If this machine runs systemd-resolved on port 53 (common on Fedora Workstation), hand port 53 to Warden by disabling only the stub listener:

bash
printf '[Resolve]\nDNSStubListener=no\n' | \
  sudo tee /etc/systemd/resolved.conf.d/purge-warden-no-stub.conf
sudo systemctl restart systemd-resolved

Check what holds port 53 first with sudo ss -ulpn 'sport = :53'. On a Fedora Server install that isn’t running the resolved stub, you can skip this step.

Info

Warden never edits your resolver configuration automatically — you run this step yourself, so nothing about your DNS changes without your say-so.

4. Enable + start

bash

sudo systemctl enable --now purge-warden

5. Verify

verify

$ dig @127.0.0.1 doubleclick.net # → 0.0.0.0 (blocked) $ dig @127.0.0.1 google.com # → real address (allowed)

SELinux note

Warden ships no SELinux policy module and runs as a stock systemd unit — under the default targeted policy it should need no extra setup. If the service fails to start under enforcing mode, capture the denials and open an issue with the AVC lines so we can ship a policy fix:

bash

sudo ausearch -m avc -ts recent

Upgrading

Install the newer .rpm the same way. The running service is not restarted automatically — the old version keeps serving until you choose to restart:

bash

sudo systemctl restart purge-warden

Your config in /etc/purge-warden/config.toml is preserved across upgrades.

Removing

bash

sudo dnf remove purge-warden

Removing the package leaves your config and data in place (/etc/purge-warden, /var/lib/purge-warden) so a reinstall picks up where you left off. Delete those directories by hand if you want a clean slate.