INSTALL / EXECUTABLE

Build and install the DNS Deny Linux binary

Build a Linux executable with the features you need, then install the configuration and service files yourself. Use this path when you prefer to manage the layout.

1. Build the executable

Install Rust 1.90+, Cargo, a C compiler, and platform build tools. Build natively on Linux:

GET THE SOURCE

git clone https://github.com/dre-zouhair/dns-deny.git
cd dns-deny

RUN FROM THE REPOSITORY ROOT

make build-release
file target/release/dns-deny
ldd target/release/dns-deny

Output: target/release/dns-deny. Match the target architecture and libc. Cross-build recipes are in ARM64 and Pi Zero.

2. Choose features

Build	Native command	Includes
Full	`make build-release`	Dashboard + JSON API
Dashboard only	`make build-release-no-api`	HTTP dashboard; no external JSON API
JSON API only	`make build-release-api-only`	JSON endpoints; no dashboard
Resolver only	`cargo build --release --no-default-features`	DNS; set `api_enabled = false`

Optional scoring: cargo build --release --features feat-scoring. Enable scoring separately in configuration. The default build excludes it.

Cargo flag examples

--features adds to the defaults. Combine it with --no-default-features to select only the features you want.

CARGO BUILD FLAGS

# Dashboard only.
cargo build --release --no-default-features --features feat-web-ui

# JSON API plus optional scoring, without the dashboard.
cargo build --release --no-default-features --features "feat-json-api,feat-scoring"

# ARM64 dashboard only; configure the ARM64 compiler/linker first.
cargo build --release --target aarch64-unknown-linux-gnu \
  --no-default-features --features feat-web-ui

--release selects optimization; --target selects the compilation platform. Scoring also needs ml_scoring_enabled = true in saved configuration. Each variant replaces the binary at its output path. Runtime settings use environment variables, such as DNS_PORT=1053, rather than command-line flags.

3. Try a local DNS listener

From the source checkout, copy the seed to a private test file. Replace its sample password and select a loopback admin bind. HTTP is enabled by default through api_allow_insecure_http = true. Set it to false to require an HTTPS proxy.

RUN FROM THE REPOSITORY ROOT

cp config/default.toml /tmp/dns-deny-test.toml
chmod 600 /tmp/dns-deny-test.toml
# Edit the test seed before running:
${EDITOR:-vi} /tmp/dns-deny-test.toml
DNS_CONFIG=/tmp/dns-deny-test.toml DNS_STATE_DB=/tmp/dns-deny-test.db DNS_PORT=1053 ./target/release/dns-deny

For the original Pi Zero, copy config/pi-zero.toml instead. A prior /tmp/dns-deny-test.db keeps its saved configuration.

4. Install as a service

Follow the manual systemd recipe to create an unprivileged service account, install the binary and seed, and deploy dashboard assets. The supplied unit grants port-53 binding capability and uses /var/lib/dns-deny for state.

Variable	Use
`DNS_CONFIG`	Initial seed file
`DNS_STATE_DB`	Persistent state database
`DNS_STATIC_DIR`	Dashboard asset directory
`DNS_PORT`	DNS listener port (default 53)

Before the first start

Set a unique api_key in the seed configuration; the shipped password is public.
Restrict DNS clients and the firewall to your trusted networks.
HTTP is enabled by default. To enforce HTTPS, set api_allow_insecure_http = false, configure a reverse proxy, and trust only its actual peer IP.

Follow the deployment guide for service installation, HTTPS, backups, and upgrades.

Free software. Built in Rust. Run by you.

← All installation options