Install Blockinator

Choose your installation

Install the Blockinator policy service first, then connect one of the resolver integrations below. Both server methods keep the same policy API and management console.

Connect your DNS server

Blockinator returns policy decisions over HTTP or HTTPS. Install the integration matching your resolver to enforce those decisions.

Before you start

Have Docker Engine, Docker Compose v2, Git, Bash, and OpenSSL available on your Docker host. The recommended path builds from the stable main branch. SQLite is the default database.

Clone Blockinator

git clone https://github.com/StealthCat/blockinator-web.git
cd blockinator-web

Create first-run credentials

Run this once from the repository directory. It generates private credentials and refuses to overwrite an existing .env.

(
  set -eu
  umask 077
  set -o noclobber
  admin_password=$(openssl rand -hex 24)
  policy_api_key=$(openssl rand -hex 32)
  cat > .env <<EOF
ADMIN_USERNAME=admin
ADMIN_PASSWORD=$admin_password
POLICY_API_KEY=$policy_api_key
DATABASE_BACKEND=sqlite
TZ=UTC
POLICY_PORT=8080
HTTPS_PORT=8443
EOF
)

Keep .env private. View it locally to retrieve the generated values; do not paste them into support requests. Set TZ to your IANA timezone before first startup.

Build and open the console

docker compose up -d --build

Open http://DOCKER-HOST:8080/ and sign in as admin with the password from .env. Replace DOCKER-HOST with the address reachable from your browser.

Make your first policy

1. Add a block list or whitelist, then apply it globally or assign it to a policy target.
2. Use Policy Tester with a client IP and domain to check the result.
3. Connect Technitium, CoreDNS, or PowerDNS Recursor to the policy API.
4. Check Query Log and Statistics for evaluated traffic.