ArkaThe web server with a control panel
you'll actually want to open.
Arka is a fast, secure web server written in Rust. Automatic HTTPS, a full web application firewall and a live control panel for every site you host — in one small package for Ubuntu and Debian.
Free to use, including commercially · x86-64 Ubuntu and Debian · License Agreement
Everything a busy server needs
Arka replaces the usual stack of a web server, a certificate tool, a firewall module and hand-edited configuration files — and stays readable at hundreds of sites.
Every site on its own
Each site is one self-contained file. A mistake in one never touches the others — a broken site keeps serving its last good version while you fix it, with a history of every change to roll back to.
Fast by design
One event loop per CPU core, an in-memory file cache that compresses once, zero-copy file sending, HTTP/2 and HTTP/3. Changes apply in milliseconds and upgrades happen without dropping a connection.
HTTPS without effort
Certificates are requested and renewed automatically over ACME (Let's Encrypt, ZeroSSL and others), including wildcards, with OCSP stapling, HSTS and modern TLS settings by default.
Proxy and applications
Load balancing with health checks, retries and queues for Django, Rails, Node.js and any HTTP app; PHP through FastCGI; WebSockets, gRPC, WebDAV shares, TCP and UDP streams, caching with request collapsing.
Security built in
A web application firewall — Arka's own fast rules or the complete OWASP Core Rule Set — automatic bans for repeat attackers, rate limits, country rules, single sign-on and signed links.
A panel for the whole team
Live charts, logs and a form for every setting, with accounts and roles (viewer, editor, admin), two-step sign-in and an audit log of who changed what. Light and dark, and it works on phones.
See every site at a glance
The control panel is built for many hosts and many people: it shows what needs attention first, and every setting has a form that checks it as you type — or the raw configuration, if you prefer.
Secure by default
Arka is written in Rust, a memory-safe language, and designed so that one problem stays one problem.
- A real web application firewall. Choose Arka's fast built-in rules or the complete OWASP Core Rule Set 4, which Arka runs on its own engine and which passes the CRS project's own regression suite.
- Attackers are shut out. Repeat offenders are banned across every site, refused before the TLS handshake, with bans that grow longer each time.
- Signed updates. New versions are verified with an Ed25519 signature before they are installed — from the control panel, in seconds.
- Least privilege. Arka runs as an unprivileged user, and no site can reach the server's own settings, keys or the panel's secrets.
- Hardened protocols. Protection against request smuggling, slow clients and HTTP/2 rapid-reset floods, with security headers and modern TLS.
Running in a minute
Download the package, install it, and open the control panel in your browser. Your first site is a form away.
curl -fL -o arka.deb https://upgrades.vulntech.com/v1/arka/download/stable/0.1.6/x86_64-linux
sudo apt install ./arka.deb
# The panel: https://your-server:9898
sudo cat /etc/arka/.admin-tokenSee it for yourself
Explore a real Arka control panel in your browser — no installation, nothing to sign up for.