RTFM · Networking
Install software and operate services with APK
APK installs ordinary Saphira packages. It does not guess your topology, open a firewall, publish DNS, or make a daemon safe; those remain deliberate operator decisions.
What APK is for
Saphira uses APK to install, remove, inspect, and upgrade software. Think of a package as a carefully delivered set of files: a program, configuration defaults, perhaps an OpenRC service, and its dependencies. Installing haproxy gives you HAProxy; it does not make it the public edge of your business until you write a configuration, test it, and allow the chosen ports through the firewall.
| Question | Command | What success looks like |
|---|---|---|
| Which repositories will APK use? | apk policy | The configured repositories and available package candidates are shown. |
| Is a package already installed? | apk info nftables | The package name and installed version are returned. |
| Which package provides a tool? | apk search -v haproxy | Available HAProxy package names and versions are listed. |
| What files did a package install? | apk info -L haproxy | Installed paths are listed; use this before assuming a configuration path. |
These examples are APK commands, not Arch commands. Do not substitute pacman syntax, AUR advice, or an Arch service layout into a Saphira machine.
Install only the role you have drawn
Start with a topology and a role. A direct web host may need webDragon's normal web packages and nftables. A dedicated proxy needs haproxy and nftables. A VPN endpoint needs wireguard-tools and nftables. A router or address service host may need Kea, dnsmasq, BIND, or Unbound according to the design. Installing every networking package because it sounds useful makes troubleshooting harder and can create competing listeners.
# Refresh the local package index, then inspect before installing.
apk update
apk search -v haproxy
apk info -a haproxy
# Example: a dedicated HTTPS/TCP proxy host.
apk add haproxy nftables
# Example: a WireGuard management gateway.
apk add wireguard-tools nftables
# Example: an authoritative DNS host.
apk add bind-server bind-tools
# Prove the intended command is now present.
command -v haproxy nft wg named dig1. Read the package name and files first
Use apk search and apk info -a. This catches spelling mistakes and shows whether you are looking at the server package, a client package, documentation, or a development package.
2. Install the smallest complete role
Use apk add with the specific packages for the host. Keep DNS authority, public proxying, and Wi-Fi authentication on separate hosts or zones when the business design calls for separation.
3. Find the installed contract
Use apk info -L <package>, command -v <binary>, and the daemon's own validation command before editing configuration. Paths are facts to inspect, not names to copy from another distribution.
OpenRC first, systemd only when selected
A normal Saphira installation uses OpenRC. An OpenRC service is operated with rc-service and enabled at a runlevel with rc-update. Saphira can also be built to use systemd, but a systemd command only applies when that installation actually has the corresponding unit. Do not run both init systems as competing owners of the same daemon.
# OpenRC: inspect, test, start, then enable a service.
rc-service haproxy status
rc-service haproxy start
rc-update add haproxy default
# systemd installation: prove the unit exists before operating it.
systemctl list-unit-files | grep -E '^haproxy\.service'
systemctl status haproxy.service
systemctl enable --now haproxy.serviceDo not enable a daemon merely because APK installed it. First validate its configuration, decide which interfaces it may listen on, and make sure nftables permits only the traffic you intend. Keep a working console or management VPN before changing a remote firewall.
Prove it works: The installation is understandable
apk info confirms the package, command -v finds the binary, the service manager reports one chosen service owner, and ss -lntup shows only the listeners you deliberately enabled.
Upgrade without guessing
An upgrade is a change to executable code and sometimes defaults. Read the package candidate, take a configuration backup, validate the service configuration, upgrade, then repeat the validation and external tests. Do not upgrade a mail edge, firewall, or VPN gateway during the only time you can recover it.
apk update
apk upgrade
# Afterwards, validate the role that changed.
haproxy -c -f /etc/haproxy/haproxy.cfg
nft -c -f /etc/nftables.conf
ss -lntup