Install Arka

Arka comes as one .deb package for 64-bit Ubuntu and Debian. Installing it creates a service that starts at boot, a default configuration, and the control panel — there is nothing else to install.

Requirements#

Something else on ports 80 and 443? Only one program can listen on a port. If nginx, Apache or Caddy is running, stop it before installing (you can move its sites over afterwards — see Moving from nginx or Apache):

sudo ss -ltnp '( sport = :80 or sport = :443 )'   # who is listening?
sudo systemctl disable --now nginx                # or apache2, caddy

Install#

1. Download the package on your server:

curl -fL -o arka.deb https://upgrades.vulntech.com/v1/arka/download/stable/0.1.12/x86_64-linux

2. Check it (optional). The checksum must match the one on the download page:

sha256sum arka.deb

3. Install it:

sudo apt install ./arka.deb

The installer prints the address of the control panel and its access token:

  Arka is installed and running.
  Control panel:  https://203.0.113.10:9898
  Access token:   3f1c9a52d0…
  (also: sudo -u arka arka token)

4. Check that it runs. Open http://<your server>/ — a one-line welcome page answers. Or, on the server itself:

curl http://localhost/
systemctl status arka

What the package did#

• installed the program as /usr/bin/arka;
• created a system user arka with no shell and no password — Arka never runs as root;
• created /etc/arka (configuration), /var/lib/arka (state) and /var/log/arka (logs);
• gave the program the single capability it needs to open ports 80 and 443 (cap_net_bind_service);
• on a first install only, wrote a default /etc/arka/arka.toml and a welcome site on port 80;
• enabled and started arka.service (the server), arka-update.path (the helper that installs updates you approve in the panel) and arka-backup.timer (a daily backup of the configuration and state).

Sign in to the control panel#

Open https://<your server>:9898 in your browser. The panel starts with a certificate it made itself, so the browser warns once — accept it (later you can give the panel a real certificate).

Sign in with the access token. It was printed by the installer; to see it again:

sudo cat /etc/arka/.admin-token

The token is the owner's key and can do everything. Create personal accounts for yourself and your colleagues under Server → Users and use those day to day — see Accounts and roles.

Who can reach the panel. Out of the box the panel answers only this machine and private networks — home, office, VPN, Tailscale (allow under [admin] in /etc/arka/arka.toml). On a server you reach over the internet, the simplest way in is an SSH tunnel: ssh -L 9898:127.0.0.1:9898 you@server, then open https://127.0.0.1:9898.

To open it from your own address directly, add that address to allow — for example "203.0.113.4" — and run sudo systemctl restart arka. Keep the list short: ten wrong sign-in attempts lock an address out for fifteen minutes, but anyone the list lets in can try.

Open the firewall#

With ufw (Ubuntu's firewall):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp      # only if you turn on HTTP/3 for a site
sudo ufw allow OpenSSH      # before enabling ufw, or you lock yourself out
sudo ufw enable

Leave 9898 closed to the internet unless you added your own address to allow. Cloud providers (AWS, Google Cloud, Azure, Hetzner, DigitalOcean…) often have a firewall of their own in the web console — open 80 and 443 there too.

Where everything lives#

The service runs in a systemd sandbox: as the arka user, with the whole file system read-only except /etc/arka, /var/lib/arka and /var/log/arka, and without access to home directories. /etc/arka is readable by root and Arka only — on install and on every upgrade — since host files can hold passwords. Websites whose files live elsewhere work, as long as the arka user can read them (see file permissions) and the folder is in web_roots.

The welcome site#

The installer adds /etc/arka/hosts/welcome.toml, a host that answers every request on port 80 with one line of text. It is the default host — the one that answers names no other host claims. Delete it (in the panel, or sudo rm /etc/arka/hosts/welcome.toml) once your own sites are in place, or keep it to answer stray requests.

Updating#

When a new version is out, the panel says so under Server → Updates, with the release notes. Install downloads it, checks its Ed25519 signature against the key built into Arka, and has the update helper install the package with apt. The running server hands over to the new version without refusing a single connection.

You can also update by hand — download the new package and install it over the old one:

curl -fL -o arka.deb https://upgrades.vulntech.com/v1/arka/download/stable/<version>/x86_64-linux
sudo apt install ./arka.deb

Your configuration, sites, certificates and accounts are kept. Arka only ever installs a newer signed version; a download that does not match its signature is refused. To stop update checks, set check = false under [update] in arka.toml.

Removing Arka#

sudo apt remove arka     # stops and removes the program, keeps configuration and data
sudo apt purge arka      # also removes /etc/arka and /var/log/arka

Even purge keeps /var/lib/arka (certificates and accounts), so a reinstall picks up where you left off. Delete it by hand if you want it gone: sudo rm -rf /var/lib/arka.

Next: your first sites.