Yes. FYRwall is open source under Apache-2.0 with Commons Clause: free to use, self-host and modify.

Does FYRwall run the web server as root?

No. The server runs unprivileged and only a tiny typed Unix-socket helper performs privileged firewall operations.

Which Linux distributions are supported?

Any distro with Go-compatible binaries: Debian, Ubuntu, RHEL/Rocky/Alma, Fedora, SUSE, Arch, Alpine and more, on amd64, arm64, arm, 386, ppc64le, s390x and riscv64.

Can FYRwall lock me out of my server?

It actively prevents that: lockout-risk conflicts block applies, and every change has an automatic restore point with verification and rollback.

Docs / Get started / Updating

Updating

In-tool notification

Enable update checks in Settings or config:

updates:
  check_enabled: true
  manifest_url: https://fyrwall.docs.potenfyr.in/updates.json
  check_interval_hours: 24

When a new version is released, a persistent notification appears in the

web UI with the changelog link. Disabled by default (no telemetry).

Manual update (recommended path)

sudo fyrwall update          # or:
curl -fsSL https://fyrwall.docs.potenfyr.in/install.sh | sudo sh

The installer/updater: creates a database backup and firewall restore

point, downloads the matching artifact, verifies SHA256SUMS, replaces the

binary, runs migrations, restarts services, runs post-update health checks.

Your config is never overwritten.

Rollback a bad update

Restore points and DB backups are kept. Reinstall the previous release

tarball from GitHub Releases (checksums on file) and restart.

Update checks are opt-in

FYRwall update checks are off by default - no telemetry. When enabled, the

only outbound request is the manifest GET.