Software installation¶

• Begin by selecting Browse Software in the main menu list and hit Enter.

• Scroll through the list of available software - for more details check the DietPi software list.

The list of optimised software is long. You either browse the list or use the option Search Software.

• To install software on your DietPi, select it in the list and press Space to add it to the installation list. If you change your mind, hit Space again to remove it.

• Once you’ve selected the software you wish to install, press Tab to switch to the confirmation options at the bottom. Select OK, then hit Enter to confirm.

• To begin installing your software, select Install from the main menu list, then hit Enter. DietPi will ask you to confirm your choice(s). Select OK, then hit Enter to begin the installation.

The software you selected will begin to install at this point. Once the process is completed, you may be asked to restart your device. Press OK to confirm.

DietPi supports a large number of software titles. Instead of scrolling through the Browse Software list to find a specific software title, you may use the Search Software option. Type in the software ID or any keyword from its title or description and you’ll get a list filtered by matching results.

Using simply journalctl prints out all logging messages stored in the system.
Each line shows:
<timestamp\> <hostname\> <process name\>[PID]: <log message\>

The following screenshot shows the logging of the boot process (of a DietPi virtual machine). You can see the various fields (timestamp, hostname, etc.) in the log entries:

Some of the options are described in the following table.
More detailed options may be studied in the man pages of journalctl.

In the software package descriptions, sometimes there is a tab called “View Logs”. This gives a jounalctl -u UNITNAME command example how to filter the logging messages of a given software package.
Example: See tab “View logs” of Unbound. It gives: journalctl -u unbound.

As described in the chapter Log system choices, DietPi has several options how the logging system operates. Especially the log history, the memory consumption and the frequency of SD card write accesses varies.
Find and set the options which fit to your demands, it is also an option to change the logging to examine some problems.

See log system choices for further details.

Install software item(s) which have been selected via Browse Software list, via Search Software, or via the SSH Server, File Server or Log System choices.

Select one or more software items which you would like to be removed from your DietPi system.

Although we enable forced encryption on all our BitTorrent clients, if you wish to ensure complete privacy and piece of mind for all your downloaded content, using a VPN is critical.
You can use any VPN provider you want, but DietPi-VPN specifically supports ProtonVPN and NordVPN.

Simply run dietpi-vpn to use the GUI, allowing you to setup your connection and provider.
DietPi will also automatically start and connect the VPN during system boot if you select autostart.

DietPi-VPN comes with an optional killswitch that will shut off your Internet in the case of you losing your connection to the VPN sever. This will still allow access from your LAN and allow you to fix any problems using SSH, if needed.

If no server exists yet, select Create server.

The defaults are fine for most users. The server gets the name wg0 and uses the UDP port 51820. Its VPN IPv4 address is 10.9.0.1, and it gets a local IPv6 address fd10:9::1, if IPv6 is enabled on the host. When you select Create, the server starts. It also starts automatically after a reboot.

If your DietPi system is behind a router, forward the UDP port to it.

The main menu shows the server settings. You can change them directly:

• Service state: Start, stop or restart the server. You can also turn the start at boot on or off.
• Listen port: Change the UDP port.
• Server address: Change the VPN address of the server. The clients are updated automatically.
• IPv6 (NAT66): Turn IPv6 for the VPN on or off, see the “IPv6” tab for details.
• Edit config: Edit the config file by hand. Wrong settings are detected and not applied.

You can run more than one server. The menu then shows a Server interface entry to switch between them. Further servers are created with the command line, see the “CLI” tab.

Each device which connects to your server is a client. The clients are listed below the server settings with their state:

• active: The client can connect.
• disabled: The client is blocked for now. Its config is kept, so that you can enable it again.
• unused: A config file exists, but the server does not know it. You can add it again or delete it.

Select Add client and enter a name, e.g. the name of the device.

The settings are fine for most users. You can change them if needed:

• Address: The VPN address of the client. The next free address is used.
• Endpoint: The address of your server on the Internet, followed by the port. Enter your domain name or public IP address here. For the first client, the public domain name from SOFTWARE_PUBLIC_DOMAIN_NAME in /boot/dietpi.txt is used by default, otherwise the hostname of your system.
• DNS: The DNS server which the client uses while connected.
• AllowedIPs: The traffic which goes through the VPN. Full tunnel sends everything through it. Server LAN only sends the traffic to your home network.
• Keepalive: Keeps the connection open, e.g. when the client is behind a router. A common value is 25 seconds.
• PresharedKey: An optional extra key for more security.

New clients use the settings of the newest client by default. This saves you time when you add several devices.

When the client is created, you can show its QR code. Open the WireGuard app on your phone, add a new tunnel and scan the code.

To manage a client, select it in the main menu. You can show its QR code and config, rename it, change its settings, disable, enable or remove it.

After you change a client, the device needs its new config. Scan the QR code again or copy the config file. The config files are stored in /etc/wireguard/clients/.

Clients which were created by older DietPi versions or by hand are found automatically. Their old key files (server_*.key and client_*.key) are not needed anymore. Remove them with the Old key files entry in the menu.

New servers also get an IPv6 address range, e.g. fd10:9::/64. Every client gets an address from it, which ends like its IPv4 address. For example, 10.9.0.2 gets fd10:9::2. The menu calls this IPv6 (NAT66).

This lets your clients use IPv6 websites and services through the VPN. Without it, connections to IPv6 services can hang or fail.

Use the IPv6 (NAT66) entry in the menu to turn IPv6 on or off. Your clients then need their new config.

A WireGuard server with IPv6 cannot start if IPv6 is disabled on your system. If you disable IPv6 with dietpi-network, DietPi therefore offers to turn it off for your VPN first. Without questions, e.g. in scripts, this happens automatically.

If you enable IPv6 again later, DietPi-WireGuard reminds you to turn it on for your VPN.

Everything in the menu is also available via command-line interface, e.g. for scripts. The commands only manage the config files. To see which clients are connected right now, use wg.

Create a client and show its QR code:

dietpi-wireguard add phone
dietpi-wireguard qr phone

Show all clients, and disable, enable or remove one:

dietpi-wireguard list
dietpi-wireguard disable phone
dietpi-wireguard enable phone
dietpi-wireguard remove phone

Change settings of a client or of the server:

dietpi-wireguard set phone dns=192.168.0.100
dietpi-wireguard server port=51821

Turn IPv6 for the VPN on or off:

dietpi-wireguard server ipv6=on
dietpi-wireguard server ipv6=off

Create a further server, and remove old key files:

dietpi-wireguard init wg1 port=51821 address=10.10.0.1/24
dietpi-wireguard cleanup

Here is an overview of all available commands:

Usage: dietpi-wireguard [<command>] [<options>]
Available commands:
    <empty>                         Open the interactive menu
    init [<interface>] [<key>=<value>...]
                                    Create a server config with defaults and start it, if no server config exists yet: port, address, ipv6
                                    The interface defaults to the first free wg0, wg1, ...
    list [<interface>]              List clients with address, state and config file
    add <name> [<options>]          Create a new client and add it as peer to the server
    remove <name>                   Remove a client: its server peer and its client config, after confirmation
    disable <name>                  Disable a client: remove its server peer, but keep it for re-enabling
    enable <name>                   Enable a disabled client again
    qr <name>                       Print the client config as QR code, without comments
    rename <name> <new name>        Rename a client config
    set <name> <key>=<value>...     Change client settings: dns, allowedips, endpoint, keepalive, psk=on|off
                                    An empty dns or keepalive value removes the setting.
    server [<interface>] <key>=<value>...
                                    Change server settings: port, address, ipv6
    cleanup                         Remove unused client configs and key files which are not needed anymore, after confirmation
Server address:
    address=<IPv4 address>/<prefix> The IPv4 address of the server, e.g. "10.9.0.1/24", whose subnet is used for the clients
                                    The CIDR netmask needs to be from 16 to 30.
    ipv6=on|off|<address>/<prefix>  The IPv6 (NAT66) address of this server, e.g. "fd10:9::1/64", "on" for the default fd10:<n>::1/64,
                                    whose subnet is used for the clients, with the same host part as their IPv4 address.
                                    Without it, clients cannot use IPv6 through the VPN, so that connections to IPv6 hosts hang until
                                    they fall back to IPv4, or fail. Defaults to "on" for new servers.
                                    "off" removes all IPv6 addresses and routes, also those which are not part of the NAT66 subnet.
                                    Changing the subnet and toggling IPv6 requires clients to import their config again.
Available options:
    -i <interface>                  Server interface, required only if more than one server config exists
    -y                              Do not ask for confirmation
    --ip <address>                  Client VPN IPv4 address, defaults to the next free one
    --dns <servers>                 Client DNS servers, comma-separated, empty for none
    --allowed-ips <networks>        Client AllowedIPs, comma-separated
    --endpoint <host>[:<port>]      Server endpoint for the client, port defaults to the server ListenPort
    --keepalive <seconds>           Client PersistentKeepalive, 0 for none
    --psk                           Add a PresharedKey
Defaults for "add" are taken from the newest client config of the same server.
<name> can also be the public key of a peer without local client config.