Install on OpenWrt

Install doona v0.1.0-rc.4 and honk on an OpenWrt router. Run every command in a root shell on the router and keep the same shell open throughout the installation.

Quick install from the daeuniverse feed

On supported 64-bit OpenWrt or ImmortalWrt 25.12 routers, install honk from the daeuniverse feed, then follow Quick start to configure its embedded doona. The steps below are the manual archive route, an alternative for routers the feed does not support. The feed package and the manual route use different service names and data directories; choose one route.

1. Check the router and prepare tools

Check the backend prerequisites, including the kernel, BTF, cgroup, and CPU requirements, before downloading. A matching doona package does not establish that the router can run honk. Check storage for installed files and the download directory:

uname -r
uname -m
df -h / /tmp

OpenWrt 25.12 uses apk-tools 3; OpenWrt 24.10 and earlier use opkg and ipk packages. Stock OpenWrt 24.10 uses Linux 6.6, below honk’s minimum kernel requirement linked above. Installing a matching UI package does not resolve that incompatibility.

Choose the commands for the router’s package manager. OpenWrt provides the veth module and NFQUEUE modules as packages:

apk

apk update
apk add curl ca-bundle kmod-veth kmod-nft-queue

opkg

opkg update
opkg install curl ca-bundle kmod-veth kmod-nft-queue

If NFQUEUE lacks prerequisites despite its enabled setting, honk can continue running without NFQUEUE staging and issue a startup warning. Check the service log; successful service startup does not confirm active NFQUEUE staging.

2. Download and verify doona

These packages install the standard edition. For lite, use the archive route in manual installation, omitting sudo, then return at step 4.

Download into /tmp/doona and choose the package format used by the firmware. The OpenWrt apk packages are separate from Alpine’s packages.

/tmp uses RAM and loses its contents at reboot. Allow space for both the downloaded honk archive and its extracted directory at the same time.

mkdir -p /tmp/doona
cd /tmp/doona
BASE=https://github.com/Zakkaus/doona/releases/download/v0.1.0-rc.4

apk

FILE=doona-0.1.0_rc4-r1.apk
curl -fL -O "$BASE/$FILE" -O "$BASE/doona-openwrt.adb" \
  -O "$BASE/doona-openwrt.pem" -O "$BASE/SHA256SUMS"
awk -v file="$FILE" '$2 == file' SHA256SUMS | sha256sum -c -
awk '$2 == "doona-openwrt.adb"' SHA256SUMS | sha256sum -c -
awk '$2 == "doona-openwrt.pem"' SHA256SUMS | sha256sum -c -

opkg

FILE=doona_0.1.0-rc.4-1_all.ipk
curl -fL -O "$BASE/$FILE" -O "$BASE/SHA256SUMS"
awk -v file="$FILE" '$2 == file' SHA256SUMS | sha256sum -c -

Continue only when every selected file reports OK. If verification fails or finds no checksum line, check the filenames and download again before installing.

For download or binary errors, see Installation errors.

3. Install the package

For apk, install the verified public key and use the signed index. Keep the index and package files in the same directory.

apk

mkdir -p /etc/apk/keys
cp /tmp/doona/doona-openwrt.pem /etc/apk/keys/doona-openwrt.pem
apk add -X /tmp/doona/doona-openwrt.adb doona

opkg

opkg install "/tmp/doona/$FILE"

Without the release key and index, you can install a verified local apk directly:

apk add --allow-untrusted "/tmp/doona/$FILE"

This skips signature trust checking, so verify the package’s SHA-256 entry before using this alternative.

ls -l /usr/share/doona/index.html

The last command must list index.html. Use the separate UI configuration with this directory.

Optional packages

Choose optional assets only if you need them. Download the chosen file into /tmp/doona and verify its individual entry in SHA256SUMS as in step 2.

Package	apk filename	opkg filename
doona-fonts	doona-fonts-0.1.0_rc4-r1.apk	doona-fonts_0.1.0-rc.4-1_all.ipk
doona-precompressed	doona-precompressed-0.1.0_rc4-r1.apk	doona-precompressed_0.1.0-rc.4-1_all.ipk

For apk, repeat the install command with the chosen package name instead of doona. For opkg, set FILE to the chosen filename and repeat the install command.

4. Install honk

Follow Install honk in a separate download directory so its SHA256SUMS does not replace doona’s. Choose a musl build and the OpenWrt installation tab, which installs /usr/bin/honk-core. Then return here.

After verifying the installed binary, remove its downloaded archive and extracted directory using their absolute paths. Once you have installed all chosen optional UI packages, remove the downloaded doona packages, index, key copy, and checksums from /tmp/doona using their absolute paths. Keep any downloads still needed for installation.

5. Prepare the data directory

For this manual route, set global.data_dir to /etc/honk/data in the honk configuration, then prepare the persistent directory:

mkdir -p /etc/honk/config.d /etc/honk/data
chmod 0700 /etc/honk /etc/honk/config.d /etc/honk/data

Only download geodata when your rules need it; see geodata requirements. For this layout:

curl -fL --retry 3 -o /etc/honk/data/geosite.dat \
  https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geosite.dat
curl -fL --retry 3 -o /etc/honk/data/geoip.dat \
  https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geoip.dat

Alternatively, install the distribution’s v2ray geodata packages instead of downloading the files above:

apk

apk add v2ray-geosite v2ray-geoip

opkg

opkg install v2ray-geosite v2ray-geoip

honk searches /usr/share/dae, but not /usr/share/v2ray directly. Check for existing files or links under /usr/share/dae; create any missing links as follows:

mkdir -p /usr/share/dae
ln -s ../v2ray/geosite.dat /usr/share/dae/geosite.dat
ln -s ../v2ray/geoip.dat /usr/share/dae/geoip.dat

Files already present in the configured data directory take precedence over these packaged files.

Use the OpenWrt service in Service management, not the feed service.

Preserve configuration across sysupgrade

Before a normal sysupgrade that preserves configuration, add these paths to /etc/sysupgrade.conf if they are not already listed, then check the backup list:

printf '%s\n' '/etc/honk/' '/etc/init.d/honk-core' >> /etc/sysupgrade.conf
sysupgrade -l

Confirm that the list includes your honk configuration, data files, and init script. This configuration backup does not restore installed kernel modules, /usr/bin/honk-core, or /usr/share/doona.

After upgrading, repeat steps 1–4 to reinstall the tools, kernel modules, UI packages, and honk binary. If you chose packaged geodata, reinstall it and recreate its links using step 5. Keep the restored configuration and data, then enable and start the service.

Check the service log, then follow First sign-in.

---

Source: doona upstream, licensed under CC BY 4.0.