apiVersion: v1
kind: Namespace
metadata:
  name: dns
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: fancy-dns-config
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
data:
  config.yaml: |
    # Rendered by the deployment below; kept in a ConfigMap so a change is a
    # `kubectl apply` rather than a rebuild.
    server:
      max_concurrent: 2048
      timeouts:
        upstream: 2s
        list_fetch: 60s

    dns:
      udp: ["0.0.0.0:53", "[::]:53"]
      tcp: ["0.0.0.0:53", "[::]:53"]
      max_udp_size: 1232
      dot:
        enabled: true
        listen: ["0.0.0.0:853"]
        cert_file: /etc/fancy-dns/tls/tls.crt
        key_file: /etc/fancy-dns/tls/tls.key
      doh:
        enabled: true
        listen: ["0.0.0.0:443"]
        cert_file: /etc/fancy-dns/tls/tls.crt
        key_file: /etc/fancy-dns/tls/tls.key
        base_path: /dns-query

    upstream:
      policy: parallel
      max_attempts: 3
      healthcheck_interval: 30s
      servers:
        - addr: 9.9.9.9:53
          proto: udp
        - addr: 1.1.1.1:53
          proto: tls
          server_name: cloudflare-dns.com
        - addr: 9.9.9.9:853
          proto: tls
          server_name: dns.quad9.net

    cache:
      enabled: true
      size: 500000
      max_ttl: 1h
      serve_stale: 30m
      persist:
        enabled: true
        path: /var/lib/fancy-dns/cache.db
        interval: 30s

    blocklist:
      enabled: true
      default_action: nxdomain
      local_zones: [/etc/fancy-dns/zones/*.zone]
      lists:
        - name: haas
          format: plain
          url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
          path: /var/lib/fancy-dns/lists/hosts
          enabled: true
          refresh: 24h
          categories: [ads, tracking]

    acl:
      default_policy: allow
      groups: []

    qlog:
      enabled: true
      path: /var/lib/fancy-dns/queries.db
      max_entries: 200000
      sample_rate: 1.0
      log_blocked: true
      log_cached: false

    api:
      enabled: true
      listen: ["0.0.0.0:8080"]
      base_path: /api
      ui: true
      allow_config_write: false
      # Read the key from a Secret and mount it; the value here is a placeholder
      # that MUST be replaced before this reaches a network.
      auth:
        mode: apikey
        api_keys: ["REPLACE-ME"]
        trust_loopback: false

    metrics:
      enabled: true
      path: /metrics
      protect: true

    log:
      level: info
      format: json
---
apiVersion: v1
kind: Secret
metadata:
  name: fancy-dns-tls
  namespace: dns
type: kubernetes.io/tls
# Replace with a real cert-manager managed secret in production:
#   cert-manager.io/v1 -> Certificate -> CertificateRequest -> Secret
stringData:
  tls.crt: ""
  tls.key: ""