Infrastructure · 2026-07-28 · 8 min read

Install an OoklaServer on Debian 12 and Debian 13

This guide installs the public Ookla Speedtest Server on one Debian host. It keeps DNS, firewall policy and Ookla registration under the administrator’s control.

Before you start

Use a fresh or reviewed Debian 12/13 host with a public IPv4 or IPv6 address. Choose a hostname such as speedtest.example.com and create its DNS records before requesting a certificate.

Run as root or through sudo.
Allow the service ports required by the current Ookla documentation and TCP/80 for the certificate challenge.
Read and accept Ookla’s server requirements and registration process before making the server public.

Use the versioned installer

The installer detects Debian 12/13, asks for the hostname and certificate contact address, installs the official server package, creates a systemd unit and can apply an optional balanced tuning profile. It never creates DNS records.

curl -fsSL https://scripts.lrq.lat/speedtest/v1.1.7/install.sh | sudo bash

Downloads the immutable v1 installer and starts its interactive install flow with administrator privileges.

curl -fsSL https://scripts.lrq.lat/speedtest/v1.1.7/install.sh | sudo bash -s -- status

Shows the installed service state and the saved local configuration without changing the host.

curl -fsSL https://scripts.lrq.lat/speedtest/v1.1.7/install.sh | sudo bash -s -- tls

Retries only the Certbot and certificate attachment stage after DNS or port 80 is ready.

Install manually

The following route is intentionally explicit. It is useful for review, change control and environments where a one-line installer is not acceptable.

sudo apt update
sudo apt install -y ca-certificates curl tar

Refreshes the APT package index and installs the tools used to download and unpack the official Ookla release.

sudo install -d -m 0755 /opt/ooklaserver
curl -fsSLo /tmp/ooklaserver.sh https://install.speedtest.net/ooklaserver/ooklaserver.sh
sudo sh /tmp/ooklaserver.sh --force --installdir /opt/ooklaserver install

Downloads Ookla’s own installation helper and installs the server files below /opt/ooklaserver without answering the vendor prompt interactively.

ini

[Unit]
Description=OoklaServer
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
WorkingDirectory=/opt/ooklaserver
RuntimeDirectory=ooklaserver
PIDFile=/run/ooklaserver/ooklaserver.pid
ExecStart=/opt/ooklaserver/OoklaServer --daemon --pidfile=/run/ooklaserver/ooklaserver.pid
Restart=on-failure

[Install]
WantedBy=multi-user.target

This is the systemd unit. It makes the vendor binary a supervised service without relying on a broad process kill command.

sudo install -m 0644 /dev/stdin /etc/systemd/system/ooklaserver.service <<'EOF'
[Unit]
Description=OoklaServer
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
WorkingDirectory=/opt/ooklaserver
RuntimeDirectory=ooklaserver
PIDFile=/run/ooklaserver/ooklaserver.pid
ExecStart=/opt/ooklaserver/OoklaServer --daemon --pidfile=/run/ooklaserver/ooklaserver.pid
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now ooklaserver

Writes the unit, reloads systemd and starts the service now and on future boots.

Optional balanced tuning

Only apply this after reviewing the effect on the host. The profile uses a dedicated sysctl drop-in, so it can be removed without touching /etc/sysctl.conf.

sysctl net.ipv4.tcp_available_congestion_control
sudo tee /etc/sysctl.d/90-lrqnet-ooklaserver.conf >/dev/null <<'EOF'
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
net.core.somaxconn=65535
net.core.rmem_max=16777216
net.core.wmem_max=16777216
EOF
sudo sysctl --system

Confirms BBR is available, writes the optional profile and loads all sysctl drop-ins. Do not apply it if another team owns host-wide network policy.

TLS with Certbot

The TLS command uses an HTTP-01 standalone challenge. The domain must already resolve to this host and port 80 must be reachable. After issuance, the Certbot systemd timer renews the certificate automatically and a deploy hook restarts OoklaServer. A certificate failure leaves the installed service intact.

sudo apt install -y certbot
sudo systemctl enable --now certbot.timer
sudo certbot certonly --standalone -d speedtest.example.com -m admin@example.com --agree-tos --no-eff-email

Installs Certbot, explicitly enables its automatic renewal timer, then obtains a Let’s Encrypt certificate. Replace the example hostname and contact address with your own values.

sudo tee -a /opt/ooklaserver/OoklaServer.properties >/dev/null <<'EOF'
openSSL.server.certificateFile = /etc/letsencrypt/live/speedtest.example.com/fullchain.pem
openSSL.server.privateKeyFile = /etc/letsencrypt/live/speedtest.example.com/privkey.pem
EOF
sudo systemctl restart ooklaserver

Associates the issued certificate and private key with OoklaServer, then restarts the service. Use the real hostname in both paths.

sudo install -d -m 0755 /etc/letsencrypt/renewal-hooks/deploy
sudo tee /etc/letsencrypt/renewal-hooks/deploy/ooklaserver-restart >/dev/null <<'EOF'
#!/bin/sh
systemctl restart ooklaserver
EOF
sudo chmod 750 /etc/letsencrypt/renewal-hooks/deploy/ooklaserver-restart
sudo systemctl status certbot.timer --no-pager

Creates the deploy hook that restarts OoklaServer after each successful renewal, then confirms that Certbot’s automatic renewal timer is active.

Validate and maintain

Check the service before completing the public registration process. Keep the server configuration under versioned change control where possible.

sudo systemctl status ooklaserver --no-pager
sudo journalctl -u ooklaserver -n 100 --no-pager
sudo /opt/ooklaserver/OoklaServer -v

Shows service health, recent logs and the installed server version.

sudo certbot renew --dry-run

Tests the renewal path without changing the active certificate.