# Bare-metal equivalent of deploy/k8s/00-config.yaml.
# Keep this file, zones/, rpz/, and TLS material in sync with the cluster's
# ConfigMaps/Secret as appropriate. The persistent state in ./data is local
# to this host and must not be copied/shared while the server is running.
server:
  max_concurrent: 2048
  timeouts:
    upstream: 2s
    list_fetch: 60s

dns:
  # Container ports stay unprivileged; Compose publishes the conventional
  # host ports 53, 853 and 443.
  udp: ["0.0.0.0:1053"]
  tcp: ["0.0.0.0:1053"]
  max_udp_size: 1232
  dot:
    enabled: true
    listen: ["0.0.0.0:1853"]
    cert_file: /etc/fancy-dns/tls/fullchain.pem
    key_file: /etc/fancy-dns/tls/privkey.pem
  doh:
    enabled: true
    listen: ["0.0.0.0:8443"]
    cert_file: /etc/fancy-dns/tls/fullchain.pem
    key_file: /etc/fancy-dns/tls/privkey.pem
    base_path: /dns-query

upstream:
  forward_zones:
    - zone: local
      servers:
        - addr: 10.10.0.1:53
          proto: udp
  policy: parallel
  max_attempts: 3
  healthcheck_interval: 30s
  servers:
    - addr: 9.9.9.9:53
      proto: udp
    - addr: 1.1.1.1:853
      proto: tls
      server_name: cloudflare-dns.com
    - addr: 9.9.9.9:853
      proto: tls
      server_name: dns.quad9.net

memory:
  limit: 1GiB
  reserve: 256MiB
  cache_max_bytes: 384MiB

cache:
  enabled: true
  size: 500000
  max_ttl: 1h
  serve_stale: 30m
  persist:
    enabled: true
    path: /var/lib/fancy-dns/cache.db
    interval: 30s

blocklist:
  enabled: true
  default_action: nxdomain
  managed_zones: /var/lib/fancy-dns/managed-zones
  local_zones: ["/etc/fancy-dns/zones/*.zone"]
  lists:
    - name: edge-router-x-address-overrides
      format: rpz
      path: /etc/fancy-dns/rpz/address-overrides.rpz
      enabled: true
      refresh: 0s
    - name: haas
      format: plain
      url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
      path: /var/lib/fancy-dns/lists/hosts
      enabled: true
      refresh: 24h
      categories: [ads, tracking]

acl:
  default_policy: allow
  groups: []

qlog:
  enabled: true
  path: /var/lib/fancy-dns/queries.db
  max_entries: 200000
  sample_rate: 1.0
  log_blocked: true
  log_cached: false

api:
  enabled: true
  listen: ["0.0.0.0:8080"]
  base_path: /api
  # Backup resolver mode keeps the console disabled. Set true when an operator
  # wants the embedded console; it remains reachable only via host loopback.
  ui: false
  allow_config_write: false
  auth:
    mode: apikey
    api_keys: ["${FANCYDNS_API_KEY}"]
    trust_loopback: true

metrics:
  enabled: true
  path: /metrics
  protect: true

log:
  level: info
  format: json