INSTALL / DEBIAN

Build and install DNS Deny on Debian or Ubuntu

A .deb bundles the executable, initial configuration, matching dashboard assets, and a systemd service. Build for the target architecture before installing.

1. Choose the package target

Use Rust 1.90+, Cargo, build-essential, pkg-config, and dpkg-dev. Follow the architecture guide for compiler/linker prerequisites.

Target	Build command	Prerequisites
AMD64	`make release-deb`	Native AMD64 Linux
ARM64	`make release-deb-arm64`	ARM64 target and toolchain
Original Pi Zero	`make release-deb-pi-zero`	ARMv6 cross-build host

From a source checkout at the repository root:

RUN FROM THE REPOSITORY ROOT

make release-deb
# On the target AMD64 machine:
sudo apt install ./target/dns-deny_0.1.0_amd64.deb

ARM64 output is target/dns-deny_0.1.0_arm64.deb. Pi Zero output is target/dns-deny_0.1.0_pi-zero_armhf.deb. Transfer the matching file to its target system before installation.

Package build options

Append -no-api for a dashboard-only package or -api-only for JSON endpoints without the dashboard. The packaging reference owns script options, scoring examples, and exact artifact names.

2. Configure before starting

ON THE TARGET MACHINE

sudoedit /etc/dns-deny/config.toml

Replace the sample api_key, restrict allowed DNS clients, and configure the HTTPS proxy. For a proxy on the same host, bind administration to 127.0.0.1. Pi Zero packages select the small-board preset automatically.

3. Start the service

AFTER CREDENTIALS AND HTTPS SETUP

sudo systemctl enable --now dns-deny
sudo systemctl status dns-deny
journalctl -u dns-deny -f

What goes where

Component	Installed path
Executable	`/usr/bin/dns-deny`
Initial seed	`/etc/dns-deny/config.toml`
Persistent state and logs	`/var/lib/dns-deny/`
Dashboard assets	`/var/lib/dns-deny/static/`
systemd unit	`/lib/systemd/system/dns-deny.service`

Variants and upgrades

Append -no-api (dashboard only) or -api-only to any package target. See the packaging reference for exact filenames. Stop the service and back up persistent data before installing an upgrade. TOML is a Debian conffile; live settings still belong to SQLite.

Before the first start

Set a unique api_key in the seed configuration; the shipped password is public.
Restrict DNS clients and the firewall to your trusted networks.
HTTP is enabled by default. To enforce HTTPS, set api_allow_insecure_http = false, configure a reverse proxy, and trust only its actual peer IP.

Follow the deployment guide for service installation, HTTPS, backups, and upgrades.

Free software. Built in Rust. Run by you.

← All installation options