doona
Install on Debian or Ubuntu
Demo
English
Install on Debian or Ubuntu

Install on Debian or Ubuntu

Install doona from the doona-web .deb package and honk-core from the same release on Debian, Ubuntu or another APT-based system. Then continue with Minimal configuration.

Note

Download the beta.19 assets from the release page.

Before you start

  • Linux 6.12 or later and the kernel options listed in Requirements. Check the kernel with uname -r.
  • A user account with sudo, or a root shell. Commands that need root have a sudo tab and a root tab; pick the one that matches your shell.
  • Access to github.com.
  • Run every step in the same terminal: later steps use the VERSION, BASE and TARGET variables that earlier steps set.

For lite, ensure curl and CA certificates are installed, then go directly to 4. Install doona and select the doona lite tab. Skip the standard edition’s package, repository, download and verification steps before it.

1. Install curl and CA certificates

honk uses the system CA certificates to verify HTTPS subscription and geodata downloads.

sudo

sudo apt update
sudo apt install curl ca-certificates

root

apt update
apt install curl ca-certificates

2. Download doona

Set the release version, then download the package and the checksum file into the current directory.

VERSION=0.1.0-beta.19
BASE=https://github.com/Zakkaus/doona/releases/download/v$VERSION
curl -fL -O "$BASE/doona-web_${VERSION}-1_all.deb" -O "$BASE/SHA256SUMS"

3. Verify the download

grep " doona-web_${VERSION}-1_all.deb\$" SHA256SUMS | sha256sum -c -

You should see:

doona-web_0.1.0-beta.19-1_all.deb: OK

4. Install doona

With ui: embedded, the honk debug.2026.10.9.native-api.2 assets for doona beta.19 (commit eac5e0c5fba5078a7ff4517a3e3851e7fa0f4f8e) serve bundled doona 0.1.0-beta.19 without a separate UI package. You can also serve the beta.19 package installed here with ui: /usr/share/doona-web; see Minimal configuration.

For doona lite, use the archive; there are no lite distribution packages yet. Follow Install doona lite, set ui: /usr/share/doona-lite, then continue with the honk steps on this page. Choose the tab for your edition and shell.

Standard edition (sudo)

sudo apt install ./doona-web_${VERSION}-1_all.deb
ls -l /usr/share/doona-web/index.html

Standard edition (root)

apt install ./doona-web_${VERSION}-1_all.deb
ls -l /usr/share/doona-web/index.html

doona lite (sudo)

VERSION=0.1.0-beta.19
BASE=https://github.com/Zakkaus/doona/releases/download/v$VERSION
curl -fL -O "$BASE/doona-lite-${VERSION}.tar.gz" -O "$BASE/SHA256SUMS"
grep " doona-lite-${VERSION}.tar.gz\$" SHA256SUMS | sha256sum -c -
sudo mkdir -p /usr/share/doona-lite
sudo tar -xzf "doona-lite-${VERSION}.tar.gz" -C /usr/share/doona-lite
ls -l /usr/share/doona-lite/index.html

doona lite (root)

VERSION=0.1.0-beta.19
BASE=https://github.com/Zakkaus/doona/releases/download/v$VERSION
curl -fL -O "$BASE/doona-lite-${VERSION}.tar.gz" -O "$BASE/SHA256SUMS"
grep " doona-lite-${VERSION}.tar.gz\$" SHA256SUMS | sha256sum -c -
mkdir -p /usr/share/doona-lite
tar -xzf "doona-lite-${VERSION}.tar.gz" -C /usr/share/doona-lite
ls -l /usr/share/doona-lite/index.html

For lite, ls must list /usr/share/doona-lite/index.html. Continue at 5. Choose the honk-core build; skip the standard edition results and optional packages below. In Minimal configuration, set ui to /usr/share/doona-lite.

For the standard edition:

ls prints a line ending in /usr/share/doona-web/index.html. The doona-web package holds doona’s web files in /usr/share/doona-web and documentation in /usr/share/doc/doona-web; it installs no service.

The optional doona-web-precompressed package adds .br and .gz copies beside the web files so a server can send precompressed responses. Install the same version as doona-web; without it, the main package stays unchanged.

Optional: the doona-web-fonts package adds the Noto Sans TC and SC fonts for the Chinese interface in /usr/share/doona-web/fonts and depends on doona-web.

sudo

curl -fL -O "$BASE/doona-web-fonts_${VERSION}-1_all.deb"
grep " doona-web-fonts_${VERSION}-1_all.deb\$" SHA256SUMS | sha256sum -c -
sudo apt install ./doona-web-fonts_${VERSION}-1_all.deb

root

curl -fL -O "$BASE/doona-web-fonts_${VERSION}-1_all.deb"
grep " doona-web-fonts_${VERSION}-1_all.deb\$" SHA256SUMS | sha256sum -c -
apt install ./doona-web-fonts_${VERSION}-1_all.deb

5. Choose the honk-core build

uname -m

The release carries eight honk-core archives, named honk-core-debug-<target>.tar.gz. Build the target from the machine type and the C library:

uname -m prints Target starts with
x86_64 x86_64-unknown-linux-
aarch64 aarch64-unknown-linux-
Target ends with Choose it when
musl Unsure. Statically linked, so the system’s glibc version does not matter.
gnu The system has glibc 2.39 or later.
-stock suffix Uses the system allocator instead of mimalloc.

For example, x86_64-unknown-linux-musl, aarch64-unknown-linux-gnu or x86_64-unknown-linux-musl-stock.

6. Download and verify honk-core

Set TARGET to the build you chose, then download it from the same release and check it against the same SHA256SUMS.

TARGET=x86_64-unknown-linux-musl
curl -fL -O "$BASE/honk-core-debug-$TARGET.tar.gz"
grep " honk-core-debug-$TARGET.tar.gz\$" SHA256SUMS | sha256sum -c -

You should see:

honk-core-debug-x86_64-unknown-linux-musl.tar.gz: OK

7. Install honk-core

The archive holds one directory with the honk-core binary. Install it as /usr/local/bin/honk-core, the path the service in Service management starts.

sudo

tar -xzf honk-core-debug-$TARGET.tar.gz
sudo install -m 0755 honk-core-debug-$TARGET/honk-core /usr/local/bin/honk-core
/usr/local/bin/honk-core --version

root

tar -xzf honk-core-debug-$TARGET.tar.gz
install -m 0755 honk-core-debug-$TARGET/honk-core /usr/local/bin/honk-core
/usr/local/bin/honk-core --version

The last command prints the honk build, for example:

honk-core debug.2026.10.9.native-api.2

HONK-SOURCE.txt in the same release records the honk build and links both its source and the matching doona source.

Before starting honk, follow Directories and geodata to install geosite.dat and geoip.dat.

Next: Minimal configuration.

If apt replaced doona with an unrelated package

If apt upgrade replaced doona with version 1.0+git20190108-2 and the web UI is gone, Debian or Ubuntu installed an unrelated network fuzzer with the same package name and a higher version.

Download and verify doona-web and doona-web-fonts as in steps 2–4, then install them from that directory:

sudo

sudo apt install ./doona-web_${VERSION}-1_all.deb ./doona-web-fonts_${VERSION}-1_all.deb

root

apt install ./doona-web_${VERSION}-1_all.deb ./doona-web-fonts_${VERSION}-1_all.deb

Set ui: /usr/share/doona-web in honk’s native_api configuration. Installing the new packages removes the earlier doona packages, doona and doona-fonts below version 1.0.

If the unrelated doona package is still installed, you can remove it; this leaves doona-web in place:

sudo

sudo apt remove doona

root

apt remove doona

If it doesn’t work

You see Cause and fix
curl: (22) The requested URL returned error: 404 The version or file name is wrong. Check VERSION against the releases.
sha256sum: 'standard input': no properly formatted checksum lines found grep found no line for that file: VERSION or TARGET was not set in this terminal, or it has a typo.
FAILED and WARNING: 1 computed checksum did NOT match The download is damaged or incomplete. Delete the file and download it again.
version 'GLIBC_2.38' not found The gnu build needs a newer glibc. Use the musl build.

For problems after installation, see Troubleshooting.

doona

doona documentation

English
doona documentationFor a direct-only first run, follow Quick start. Quick startStart the standard edition of doona with a direct-only honk configuration, sign in, and verify traffic from the gateway itself. Standard edition and doona liteThe standard edition manages configuration and observes traffic. Requirements Install on Debian or UbuntuInstall doona from the doona-web .deb package and honk-core from the same release on Debian, Ubuntu or another APT-based system. Install on Fedora or RHELInstall doona from its .rpm package and honk-core from the same release on Fedora, RHEL or another DNF-based system. Install on Arch LinuxInstall doona from its .pkg.tar.zst package and honk-core from the same release on Arch Linux or another pacman-based system. Install on GentooInstall doona with Portage from the repository's ebuild in a local ebuild repository, and honk-core from the same release. Install on OpenWrtInstall doona from a release package or archive and honk-core from the same release on OpenWrt 25.12. Install on other systemsInstall doona and honk-core from release archives on an x86_64 or aarch64 Linux system that meets the kernel requirements below. Installation detailsInstall honk, write its configuration, then install doona and start honk. Minimal configurationThis page writes the smallest honk configuration that starts honk and serves doona, then checks it by starting honk by hand. Service managementThis page runs honk as a systemd or OpenWrt procd service: it creates the service once, then lists the commands that start, stop, restart and reload honk and read its log. Route your first connectionContinue from Quick start, with honk running and your administrator signed in. First sign-inThis page opens doona in a browser, creates the administrator account and checks that doona shows the running honk. Interface tourUse the navigation to open a page, the top bar to search or refresh, and the page tabs to change views. Watching trafficUse Activity and System status to read engine health, and Connections, Routing log and DNS to inspect traffic. Routing, nodes and rulesPolicies manages group selection and membership. Config and settingsConfiguration reads, validates and applies honk's configuration files. Common tasksThis page covers the standard edition; for doona lite, see doona lite. FeaturesFor each feature’s prerequisites and disabled-action explanations, see Feature requirements. doona litedoona lite edits honk configuration through a smaller interface for beginners. Connect doona liteConnect doona lite to the honk native API, or open the demo without a backend. Common tasks in doona liteUse doona lite to import resources and edit honk configuration. ConfigurationUse this reference for honk's DAE settings exposed by doona, their defaults, and their application paths. What doona can changedoona changes configuration sources, runtime state, persistent geodata settings, and browser preferences through different controls. Feature requirementsFind your standard-edition feature in the table, then use its section to check prerequisites and enable it. Troubleshooting DevelopmentRead CONTRIBUTING.md before opening a pull request.