rework

deploy/compose/config.yaml

@@ -0,0 +1,114 @@
+# Bare-metal equivalent of deploy/k8s/00-config.yaml.
+# Keep this file, zones/, rpz/, and TLS material in sync with the cluster's
+# ConfigMaps/Secret as appropriate. The persistent state in ./data is local
+# to this host and must not be copied/shared while the server is running.
+server:
+  max_concurrent: 2048
+  timeouts:
+    upstream: 2s
+    list_fetch: 60s
+
+dns:
+  # Container ports stay unprivileged; Compose publishes the conventional
+  # host ports 53, 853 and 443.
+  udp: ["0.0.0.0:1053"]
+  tcp: ["0.0.0.0:1053"]
+  max_udp_size: 1232
+  dot:
+    enabled: true
+    listen: ["0.0.0.0:1853"]
+    cert_file: /etc/fancy-dns/tls/fullchain.pem
+    key_file: /etc/fancy-dns/tls/privkey.pem
+  doh:
+    enabled: true
+    listen: ["0.0.0.0:8443"]
+    cert_file: /etc/fancy-dns/tls/fullchain.pem
+    key_file: /etc/fancy-dns/tls/privkey.pem
+    base_path: /dns-query
+
+upstream:
+  forward_zones:
+    - zone: local
+      servers:
+        - addr: 10.10.0.1:53
+          proto: udp
+  policy: parallel
+  max_attempts: 3
+  healthcheck_interval: 30s
+  servers:
+    - addr: 9.9.9.9:53
+      proto: udp
+    - addr: 1.1.1.1:853
+      proto: tls
+      server_name: cloudflare-dns.com
+    - addr: 9.9.9.9:853
+      proto: tls
+      server_name: dns.quad9.net
+
+memory:
+  limit: 1GiB
+  reserve: 256MiB
+  cache_max_bytes: 384MiB
+
+cache:
+  enabled: true
+  size: 500000
+  max_ttl: 1h
+  serve_stale: 30m
+  persist:
+    enabled: true
+    path: /var/lib/fancy-dns/cache.db
+    interval: 30s
+
+blocklist:
+  enabled: true
+  default_action: nxdomain
+  managed_zones: /var/lib/fancy-dns/managed-zones
+  local_zones: ["/etc/fancy-dns/zones/*.zone"]
+  lists:
+    - name: edge-router-x-address-overrides
+      format: rpz
+      path: /etc/fancy-dns/rpz/address-overrides.rpz
+      enabled: true
+      refresh: 0s
+    - name: haas
+      format: plain
+      url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
+      path: /var/lib/fancy-dns/lists/hosts
+      enabled: true
+      refresh: 24h
+      categories: [ads, tracking]
+
+acl:
+  default_policy: allow
+  groups: []
+
+qlog:
+  enabled: true
+  path: /var/lib/fancy-dns/queries.db
+  max_entries: 200000
+  sample_rate: 1.0
+  log_blocked: true
+  log_cached: false
+
+api:
+  enabled: true
+  listen: ["0.0.0.0:8080"]
+  base_path: /api
+  # Backup resolver mode keeps the console disabled. Set true when an operator
+  # wants the embedded console; it remains reachable only via host loopback.
+  ui: false
+  allow_config_write: false
+  auth:
+    mode: apikey
+    api_keys: ["${FANCYDNS_API_KEY}"]
+    trust_loopback: true
+
+metrics:
+  enabled: true
+  path: /metrics
+  protect: true
+
+log:
+  level: info
+  format: json