Fedora

Install Warden on Fedora or RHEL with the bundle installer.

Warden has no .rpm package and no dnf repository. You install it with the same one-line command on every supported distribution. This page lists what is specific to Fedora and its relatives. The full walk-through, including how to point your network at Warden, is the quick start.

$ curl -fsSL https://get.purge.cc | sudo sh

Requirements

• Fedora 40 or newer, or RHEL 9 and rebuilds such as Rocky and Alma. The bundle is for x86_64. On aarch64 the download fails and you build from source.
• About 700 MB of RAM for the default lists, and about 1.4 GB for a few seconds at a list update. A small machine can run Warden only with a small set of lists: see Memory and list size.
• systemd and dnf
• bash, tar, curl or wget, and sha256sum
• Root, or sudo
• Internet access. The installer checks that it can resolve lists.purge.cc, the host the first start downloads the blocklists from, and it downloads the bundle.

The installer installs two packages for you with dnf: ca-certificates and bind-utils (for dig).

What is specific to Fedora

• Port 53. Fedora Workstation runs systemd-resolved, which holds port 53 on 127.0.0.53. The installer asks before it turns off only the stub listener. With --yes it does so without asking. Without a terminal, --yes is required: otherwise the installer stops and changes nothing. If another service holds port 53, the installer stops and names it.
• Firewall. Fedora ships firewalld, and its default zone does not allow DNS. If firewalld is running, the installer adds the dns service (53/tcp and 53/udp) to the default zone and reloads. If DNS is already allowed it changes nothing. If you use another zone for your LAN, open DNS in that zone yourself.
• SELinux. The installer runs restorecon on the installed unit files when restorecon is present, so systemd accepts them. You do not need to change SELinux settings. If restorecon is missing, install policycoreutils.
• Backups on Fedora 44. The scheduled backup unit sets RestrictSUIDSGID=no, which tar on Fedora 44 needs. The upgrade installs this unit.
• No package manager entry. dnf list installed will not show Warden. The files are in /usr/local and the bundle is in /usr/local/lib/purge-warden.

If a purge-warden package is already installed

No purge-warden package is published. If you built one yourself and installed it, the bundle installer refuses to run, because the bundle’s files in /usr/local would shadow the package’s files in /usr. Remove the package first, then install. (To override the refusal, set PURGE_ALLOW_PACKAGE_OVERLAP=1. You then own the mixed result.)

sudo dnf remove purge-warden
curl -fsSL https://get.purge.cc | sudo sh

Take a warden config backup first. There is no upgrade path for a host installed from a package.

Verify

The installer runs these two checks itself and exits with status 5 if either fails. If the daemon is still loading its lists when the wait ends, it skips them and exits with status 3: see Installer exit statuses.

Upgrading

Run the bundle installer’s upgrade mode. It is not a dnf operation:

curl -fsSL https://get.purge.cc | sudo sh -s -- --upgrade

See Upgrade for what it checks, how it rolls back, and what to do after a failure.

Removing

sudo /usr/local/lib/purge-warden/scripts/uninstall.sh            # keep config and data
sudo /usr/local/lib/purge-warden/scripts/uninstall.sh --purge    # also delete /etc/purge-warden, /var/lib/purge-warden and the user

Without --purge, the next install adopts the kept configuration: see Reinstall over a kept configuration. While a configuration change is unfinished, an uninstall without --purge refuses and removes nothing; with --purge it goes ahead. The quick start explains it.

Add --restore-resolved to put back the systemd-resolved stub listener. If the installer had pointed /etc/resolv.conf away from the stub, the uninstaller points it back, but only if the stub listens again right after the uninstaller restarts systemd-resolved. Otherwise it warns and leaves the file as it is. A regular file, or a relative link as your distribution writes it, is left alone. A link you wrote yourself to the absolute path /run/systemd/resolve/resolv.conf looks like the installer’s, so the uninstaller points it at the stub as well. The uninstaller leaves the bundle directory in place; delete /usr/local/lib/purge-warden yourself once you no longer need it.

With firewalld running, the installer opened DNS in it, and the uninstaller does not close it. If firewalld still allows DNS, the uninstaller says so and prints the command that closes it. Run it only if nothing else on this host serves DNS:

sudo firewall-cmd --permanent --remove-service=dns && sudo firewall-cmd --reload

The uninstaller asks you to confirm on your terminal. With no terminal (a script, or ssh without a tty), it stops with exit code 1 and removes nothing unless you add --yes.