Free to Run.
Yours to Host.
WAFio is free to download and self-host. No account, no API key — just run the installer.
One-line install
Run on your Linux server. The installer asks which component to install (or takes it from the command), installs the dependencies, and downloads and verifies the signed binaries.
curl -fsSL https://wafio.cloud/install.sh | sudo bash - Linux x86_64 — Debian/Ubuntu or RHEL/Rocky, root access
- Host agent — kernel 5.10 or newer with BTF (
/sys/kernel/btf/vmlinux) - Control plane — PostgreSQL 17 + TimescaleDB, set up by the installer if missing
Adding agents to a running control plane?
Open your dashboard at Hosts › Connect this host and copy the command it shows. It installs the
host agent (or WAF agent) and enrolls it with the host's one-time key: the agent's private key is generated on the
server, and nothing is installed unless the control plane's CA fingerprint matches --ca-sha256.
See what the installer does before you run it.
A replay of install.sh on a fresh Ubuntu server: a new control plane, a host agent enrolled with the
command from the dashboard, and an upgrade. The output is the installer's own text; names, addresses, keys and
hashes are examples.
You type: Enter for each default, n for PostgreSQL, the admin name and email, a password (hidden) and a project name. apt-get output is shortened. Highlighted notes explain a line; they are not installer output.
Or download bundles directly
Obfuscated, signed Linux/amd64 tarballs. Every download is anonymous — no key needed.
Skeptical? That's the right instinct.
Running a binary from the internet on your server should never be an act of faith. Every WAFio release is signed with Ed25519 and ships with a software bill of materials — and you don't have to take our word for any of it. Verify the checksum, the signature, and the dependency list yourself, in about a minute.
Follow the verification guide →Next: read the documentation to configure and connect your agents.