Download Arka

One package for 64-bit Ubuntu and Debian servers. Free to use, including commercially.

Arka 0.1.6

Stable · released 16 October 2026 · 8.0 MB · .deb for x86-64

SHA-256 556871f51d683d2a1027349ac236548bb2aaadbe607b5997641d6f55a0a2c8cf

By downloading or using Arka you agree to the Arka License Agreement.

Install

Download the package on your server:

curl -fL -o arka.deb https://upgrades.vulntech.com/v1/arka/download/stable/0.1.6/x86_64-linux

Install it — this creates the arka user, a systemd service and a default configuration, and starts Arka:
```
sudo apt install ./arka.deb
```
Open the control panel at https://your-server:9898 (your browser warns once about its self-signed certificate) and sign in with the access token:
```
sudo cat /etc/arka/.admin-token
```
Add your first site from the panel's New host button — HTTPS certificates are requested for it automatically.

Firewall: open ports 80 and 443 for your sites. The control panel listens on port 9898; restrict it to your own address (admin.allow) or reach it through an SSH tunnel.

Requirements

System	64-bit x86 (x86-64) Linux with systemd: Ubuntu 18.04 LTS or newer, Debian 10 or newer (any distribution with glibc 2.17 or newer). Tested on Ubuntu 24.04 LTS.
Memory	About 35 MB for Arka itself; about 40 MB more with the OWASP Core Rule Set enabled.
Ports	80 and 443 for websites (and certificates), 9898 for the control panel.

Updates

Arka looks for new versions every six hours and offers them in the control panel (Updates), where one click installs them; the service restarts in about a second. Every release is signed: Arka verifies its Ed25519 signature before installing it and refuses anything else. Update checks can be turned off with check = false in the [update] section of /etc/arka/arka.toml.

Verify a download

Compare the checksum of the file you downloaded with the one shown above:

sha256sum arka.deb

After installing

Configuration	`/etc/arka/arka.toml` and one file per site in `/etc/arka/hosts/`
Data and certificates	`/var/lib/arka/`
Logs	`/var/log/arka/` and `journalctl -u arka`
Documentation	`/usr/share/doc/arka/configuration.md` — every setting, with examples
Service	`sudo systemctl status arka` · `sudo systemctl reload arka`

Release notes

Arka 0.1.6 · 16 October 2026

Control panel lockout: only different wrong tokens or passwords count towards it, so a panel tab left open across a restart or update no longer locks its owner out.

Arka 0.1.5 · 16 October 2026

The control panel follows its certificate files: a certificate Arka renews for the panel's own name reaches it without a restart.
The Updates page says when the panel stops answering during an install, instead of waiting.

Arka 0.1.4 · 16 October 2026

The complete OWASP Core Rule Set 4.30 as a firewall rule set (ruleset = "crs"), with request and response rules, paranoia levels and anomaly scoring.
Security: control-panel editors can no longer reach Arka's own files through a site; symbolic links that lead out of a web root are refused unless allowed.
rustls 0.23.46 (four security advisories fixed).
The package starts the update helper on install, and the panel says clearly when it is not running.