more code

deploy/k8s/00-config.yaml

@@ -0,0 +1,120 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fancy-dns-config
+  namespace: dns
+  labels:
+    app.kubernetes.io/name: fancy-dns
+data:
+  config.yaml: |
+    # Rendered by the deployment below; kept in a ConfigMap so a change is a
+    # `kubectl apply` rather than a rebuild.
+    server:
+      max_concurrent: 2048
+      timeouts:
+        upstream: 2s
+        list_fetch: 60s
+
+    dns:
+      udp: ["0.0.0.0:53", "[::]:53"]
+      tcp: ["0.0.0.0:53", "[::]:53"]
+      max_udp_size: 1232
+      dot:
+        enabled: true
+        listen: ["0.0.0.0:853"]
+        cert_file: /etc/fancy-dns/tls/tls.crt
+        key_file: /etc/fancy-dns/tls/tls.key
+      doh:
+        enabled: true
+        listen: ["0.0.0.0:443"]
+        cert_file: /etc/fancy-dns/tls/tls.crt
+        key_file: /etc/fancy-dns/tls/tls.key
+        base_path: /dns-query
+
+    upstream:
+      policy: parallel
+      max_attempts: 3
+      healthcheck_interval: 30s
+      servers:
+        - addr: 9.9.9.9:53
+          proto: udp
+        - addr: 1.1.1.1:53
+          proto: tls
+          server_name: cloudflare-dns.com
+        - addr: 9.9.9.9:853
+          proto: tls
+          server_name: dns.quad9.net
+
+    cache:
+      enabled: true
+      size: 500000
+      max_ttl: 1h
+      serve_stale: 30m
+      persist:
+        enabled: true
+        path: /var/lib/fancy-dns/cache.db
+        interval: 30s
+
+    blocklist:
+      enabled: true
+      default_action: nxdomain
+      local_zones: [/etc/fancy-dns/zones/*.zone]
+      lists:
+        - name: haas
+          format: plain
+          url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
+          path: /var/lib/fancy-dns/lists/hosts
+          enabled: true
+          refresh: 24h
+          categories: [ads, tracking]
+
+    acl:
+      default_policy: allow
+      groups: []
+
+    qlog:
+      enabled: true
+      path: /var/lib/fancy-dns/queries.db
+      max_entries: 200000
+      sample_rate: 1.0
+      log_blocked: true
+      log_cached: false
+
+    api:
+      enabled: true
+      listen: ["0.0.0.0:8080"]
+      base_path: /api
+      ui: true
+      allow_config_write: false
+      # Read the key from a Secret and mount it; the value here is a placeholder
+      # that MUST be replaced before this reaches a network.
+      auth:
+        mode: apikey
+        api_keys: ["REPLACE-ME"]
+        trust_loopback: false
+
+    metrics:
+      enabled: true
+      path: /metrics
+      protect: true
+
+    log:
+      level: info
+      format: json
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: fancy-dns-tls
+  namespace: dns
+type: kubernetes.io/tls
+# Replace with a real cert-manager managed secret in production:
+#   cert-manager.io/v1 -> Certificate -> CertificateRequest -> Secret
+stringData:
+  tls.crt: ""
+  tls.key: ""